Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter Joins the HTTPS By Default Party

Posted by CmdrTaco on from the encrypted-packets-are-better dept.

wiredmikey writes "Following a trend in allowing users to automatically utilize the secure HTTPS protocol when accessing Web based services, Twitter announced this week that it has added the option for users to force HTTPS connections by default when accessing Twitter.com. The reasons to utilize HTTPS when accessing any personal accounts aren't new, but an easy to use extension for FireFox called 'FireSheep,' released in October 2010, spiked concern, as it enables HTTP session hijacking for the masses."

8 of 95 comments (clear)

  1. Good by Tukz · · Score: 3, Informative

    I''d like to see all community sites do that.

    I got an addon that tries to force SSL where available, and it's surprising so many sites that doesn't have SSL enabled at all.

    --
    - Don't do what I do, it's probably not healthy nor safe. -
  2. HTTPS by default? Not exactly, Misleading headline by Anonymous Coward · · Score: 2, Informative

    Users are required to change this setting themselves, nothing default about it. It's simply an added option

    Now Gmail, this is HTTPS by default..
    also I read mobile.twitter.com will not even switch to HTTPS? wut.

    Smarten up slashdot and editors

  3. Re:What's the penalty for HTTPS? by buchner.johannes · · Score: 4, Informative

    Any thoughts on HTTPS only for the login page, or for all pages?

    You can just steal the session cookie after login, so just doing the login page is almost useless. It prevents the attacker from learning the password and re-entering the system, but a) he can change the password and b) there is no reason he wouldn't get the job done within one session.

    --
    NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
  4. Re:What's the penalty for HTTPS? by hart · · Score: 4, Informative

    There's still a performance hit for SSL. Solutions for that include load balancers with dedicated hardware SSL support. As for what the performance hit is, try this: http://serverfault.com/questions/43692/how-much-of-a-performance-hit-for-https-vs-http-for-apache Re: HTTPS all vs. only on login page - as the recent Facebook session hijacking proved, it's the session cookies in cleartext that are the security problem - it doesn't sniff your password, it steals your session cookies to access your account. HTTPs should be on everything, IMHO. Cheers Leigh

  5. Re:What's the penalty for HTTPS? by Baloo+Uriza · · Score: 4, Informative

    Most sites expect you to enter the current password to be able to change it, even if you are logged in.

    --
    Furries make the internet go.
  6. It is built in to Firefox 4 by Chrisq · · Score: 3, Informative

    It is built in to Firefox 4 so soon you won't need an extension.

    1. Re:It is built in to Firefox 4 by Chrisq · · Score: 3, Informative

      From what I am understanding of the article its there to stop:

      http://www.example..../ [redirect to] https://..../

      Which could be grounds for a Man In The Middle Attack. It does not say anything about forcing people to use HTTPS, just that it will be done automatically instead of using a redirect. So it'll make sites which force HTTPS safer, but it won't force twitter to push https if you haven't asked for it.

      There is a better explanation here. Basically after the header is received the browser will convert any http: requests to https:, therefore bypassing any redirect. Whether this will force you to use https depends on whether Twitter will set this header on their https sites only or on both http and https. Even if they do set it only on the https site it will force you to use https if you visit the https URL even once.

  7. Re:Good start, but install HTTPS everywhere by ftobin · · Score: 3, Informative

    Slashdot has HTTPS access if you are a paying subscriber.