3 ms·

Has anyone checked the source code to check that the passwords aren't sent to the author's website? :)

cdine 16y ago
It's 100% open source! Please feel free to review it. http://github.com/codebutler/firesheep http://github.com/codebutler/firesheep It doesn't currently do anything with passwords, it's only pulling out cookies from HTTP Response headers. But it would be trivial to also get passwords in non-HTTPS requests for logins with the same method.
- chrisbroadfoot 16y ago
  Indeed. Sorry if I implied that you were doing evil things. People should also be aware of the security implications of installing various software on their system. :)
- staktrace 16y ago
  Again, not assuming you're evil, but it's possible that the compiled binary (.xpi) was not created from the source posted on the github account :)
phamilton 16y ago
Passwords are not a part of this... It's the session cookie, which is an entirely different matter. It's unique to the login process, so one compromised account isn't able to lead to compromising other websites. It's also time sensitive (generally) and so that hijacked cookie will expire. If he were collecting all this information, he wouldn't be able to do much with it.
- chrisbroadfoot 16y ago
  Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere. It's very possible, given that the extension seemingly captures HTTP requests/responses. If passwords are sent or received in plaintext, then they can be captured.
losvedir 16y ago
Not sure why you're being downvoted, seems like a legitimate question to me! I was a little leery of checking it out at first, too, but curiosity got the better of me... Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author? I downloaded the source code from github and glanced through it, enough to comfort me somewhat, but I wasn't super thorough. All that said, EricButler seems to be an HN member in good standing, and someone like that wouldn't do anything malicious, right? :-)
- ItarPeyo 16y ago
  >> Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author? If it could sniff packets on network interfaces why couldn't it send data to a website? ;) This kind of FF plugin requires extensive C++ coding. But even simple plugins that are only JS could easily send your username and password (if entered within them) to any web server.

cdine 16y ago

It's 100% open source! Please feel free to review it. http://github.com/codebutler/firesheep http://github.com/codebutler/firesheep It doesn't currently do anything with passwords, it's only pulling out cookies from HTTP Response headers. But it would be trivial to also get passwords in non-HTTPS requests for logins with the same method.

chrisbroadfoot 16y ago
Indeed. Sorry if I implied that you were doing evil things. People should also be aware of the security implications of installing various software on their system. :)
staktrace 16y ago
Again, not assuming you're evil, but it's possible that the compiled binary (.xpi) was not created from the source posted on the github account :)

phamilton 16y ago

Passwords are not a part of this... It's the session cookie, which is an entirely different matter. It's unique to the login process, so one compromised account isn't able to lead to compromising other websites. It's also time sensitive (generally) and so that hijacked cookie will expire. If he were collecting all this information, he wouldn't be able to do much with it.

chrisbroadfoot 16y ago
Just because the user interface only exposes cookies, doesn't mean that passwords aren't captured and sent somewhere. It's very possible, given that the extension seemingly captures HTTP requests/responses. If passwords are sent or received in plaintext, then they can be captured.

losvedir 16y ago

Not sure why you're being downvoted, seems like a legitimate question to me! I was a little leery of checking it out at first, too, but curiosity got the better of me... Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author? I downloaded the source code from github and glanced through it, enough to comfort me somewhat, but I wasn't super thorough. All that said, EricButler seems to be an HN member in good standing, and someone like that wouldn't do anything malicious, right? :-)

ItarPeyo 16y ago
>> Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author? If it could sniff packets on network interfaces why couldn't it send data to a website? ;) This kind of FF plugin requires extensive C++ coding. But even simple plugins that are only JS could easily send your username and password (if entered within them) to any web server.