14 ms·

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of thing

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point? How many new servers are going to be needed now that https is used for everything and requests can't be cached? America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. By contrast it's fashionable among a certain set (no doubt including the author of this mess, Mr. Butler himself) to hold that the real culprits are the door manufacturers. What said facile analysis excludes, of course is that there is always a greater level of security possible. The level we currently employ reflects our tradeoffs between the available threats and the cost/convenience loss of bolting our doors and putting finials on our gates. Butler has simply raised the threat level for everyone. He did not invent a new lock or close a hole. He's now forcing lots of people to live up to his level of security. Congratulations to the new Jason Fortuny.

zecg 16y ago
This is IMO a completely wrong approach to security. Butler has not raised the threat level, he has merely illuminated the existing threat level.
- bsaunder 16y ago
  Illumination is one thing. Enabling a ten year old to do malicious stuff with a few clicks and poorly considered actions is entirely another.
  - evilduck 16y ago
    If it can be that easily scripted, 10 year olds were already doing it. Suppressing knowledge, especially knowledge of a flawed system, doesn't make the system safer. In terms of severity, computing has overcome worse exploits; this is a problem awaiting an answer, which sounds like opportunity to me.
    - ramanujan 16y ago
      > Suppressing knowledge Again, degrees matter. Abstract knowledge is one thing. A simple tool to facilitate griefing people is quite another. Mobile web browsing existed before the Iphone. Search existed before Google. Telecommunication preceded the internet. You could share mp3s before Napster and mp4s before Youtube. And you used to have to delve into Wireshark to pull this off, but now you can snag grandma's credentials from any Starbucks in the country with a mouse. Degrees do matter.
      - rsanders 16y ago
        And without raising awareness of the issue, everybody might always be somewhat vulnerable forever, whereas now that "we know", after being highly vulnerable for a short time everybody's vulnerability to this should drop to zero very quickly. If you assume a limited number of evildoers and a limited ability to exploit this at will (e.g. you have to catch your victim in close proximity on public wi-fi that you're sharing with him), releasing a tool like Firesheep may produce significantly less total damage.
  - enneff 16y ago
    I know 10-year-olds who do this already.
- jberryman 16y ago
  I agree. Releasing a point and click exploit is standard practice among white hat, well intentioned hackers. Decades of this kind of tough love is why microsoft finally has an OS that is reasonably secure.
mike-cardwell 16y ago
People have been doing this for years already with tools like Wireshark. The only thing the app he has released does it to draw a massive amount of attention to the already existing problem. I say superb. Brilliant effort. Well done. Hopefully more people will stop stupidly sending session cookies over unsecured channels now.
- mike-cardwell 16y ago
  Also. If you want to use Facebook completely over https. Install the "HTTPS Everywhere" Firefox addon. It forces a number of sites to make all of their requests over an SSL secured channel.
pmjordan 16y ago
How many new servers are going to be needed now that https is used for everything and requests can't be cached? The main thing holding us back there are browsers that go apeshit if you load images via HTTP on an HTTPS page. Requiring JavaScript or other active content to be loaded from the same HTTPS server would be a good thing in many cases. I think currently ANY https server is allowed, which doesn't actually defend against any kind of XSS, so it's pretty meh. Or is there some kind of meta tag etc. that enforces same-origin? (If not, that would be a cool addition. Maybe a list of allowed domains?)
- timcraft 16y ago
  http://stackoverflow.com/questions/954327/hidden-features-of-html/960111#960111 http://stackoverflow.com/questions/954327/hidden-features-of...
  - pmjordan 16y ago
    That will still load images via https, not http. They'll still be cached client-side of course, but they can't be cached by proxies and you need an SSL certificate for your static content server.
- jdunck 16y ago
  FWIW, non-JS is still a vector. For example, img tags can stomp on cookies. Yes, serving static media over SSL is diminishing returns, and it would suck for mid-stream proxies (and every ISP will hurt from it). But don't argue that it doesn't matter from a security perspective.
  - pmjordan 16y ago
    When done correctly, it should at least avoid this sort of cookie stealing scenario, though - HTTPS-only cookies won't leak into HTTP requests for non-active content, though malicious Set-Cookie: injection into the HTTP responses can obviously log the user out, etc. and may even reveal unwanted info if the HTTPS server doesn't handle the situation gracefully.
chaitanya 16y ago
> How many new servers are going to be needed now that https is used for everything and requests can't be cached? Wrong. You don't need to use https for everything -- you can specify a domain and a path in the cookie. For things like images, videos and css, you still don't need SSL.
- ramanujan 16y ago
  Many browsers give warnings when mixing secure and insecure content. Know of a good cross-browser example that mixes http and https requests?
  - chaitanya 16y ago
    That's a good point -- I hadn't thought about this.
cousin_it 16y ago
America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. The analogy is not complete because in our situation there's a third party involved beside the victim and the criminal: the website. What if your bank leaves the vault unlocked so anyone can take your money? Isn't the bank at least partly to blame?
- ra88it 16y ago
  In parent's analogy, the third party is the door manufacturer.
sushrutbidwai 16y ago
I will blame lock manufacturers if any damn key on the planet can open it up.
jfager 16y ago
Butler has not raised the threat level on anything. This has been a widely known issue since forever. A friend of mine wrote a sniffer that could do this back in college, and he was one of the last to the party. Want something else to kvetch about? His tool could impersonate the router and act as a proxy, including serving up ssl-encrypted pages to users who didn't realize they shouldn't accept certs from unknown signers - again, that was years ago, and even then it was nothing new or unique at all. When a tool like this rises to even a minimum level of public consciousness, you're better off thinking "people have probably been doing this for close to a decade" than "this asshole just ruined the internet by pointing out an obvious flaw that someone will now be able to exploit". And yes, at some point, a door manufacturer that knows how easily their doors will open and how frequently people will just walk through does take on some responsibility to add a lock (and the homeowner to use it). It's going to cost more in servers? Okay, so what? It costs more to install seatbelts, are you upset at Ralph Nader, too? [Edited to bring it down a notch]
- ramanujan 16y ago
  > Butler has not raised the threat level on anything. Flat out false. Ever heard the term "crime of opportunity"? What's your over/under on the number of identity thefts facilitated by Eric Butler's little gift? Let's make this empirical.
  - jfager 16y ago
    Anyone who wanted to hijack http sessions was five minutes of Googling and installing away from being able to do so before "Eric Butler's little gift" anyways. Are you claiming that the marginal impact of packaging it up into a firefox extension is so great as to make it a threat of a wholly different kind?
    - ramanujan 16y ago
      That is exactly what I'm claiming. That's also why this article has 200+ comments and was on the top of Hacker News all day! You vastly underestimate the barrier that "five minutes of Googling" presents. I assure you, the overwhelming majority of aspiring script kiddies would never be able to figure it out. It took an expert to package an exploit in a nice GUI (and write cookie parsing code for every major social site under the sun).
jberryman 16y ago
America was a better place when people could keep their doors unlocked I hate this mythical "good old days" B.S. I know people who live in the country who don't lock their doors because they live in the country. The idea that people who lived in urban areas ever could leave their doors unlocked is absurd.
- Encosia 16y ago
  I live in a suburb of Atlanta and haven't locked my front door during the day in about a decade (since moving from an apartment to a house). The world isn't really as scary as the news makes it seem.
  - daten 16y ago
    While I completely agree, I wouldn't consider personal experience a valid data point for generalizing the whole world.
  - BrandonM 16y ago
    > I... haven't locked my front door during the day This isn't what people mean when they say they don't lock their doors. I grew up in the country in northeast Ohio. I knew many people who simply never locked their doors, including overnight or even when they weren't home.
    - Encosia 16y ago
      For most of the time I've been here, I didn't lock them overnight either. My girlfriend takes comfort in that illusion of security though, so I play along.
    - mattmillr 16y ago
      I lived in middle-of-nowhere Texas for several years, and I think the only time I ever locked the door to my home was when I left for two weeks at Christmas. If my car didn't automatically lock itself after you get out, I would have left it unlocked as well, with the key lying in the center console. I live in Brooklyn now. Things are a little different here. My door has a $350 deadbolt lock that -- when it broke and locked me in -- took a locksmith, a serious drill and a couple hardened bits to defeat. Whether you should lock something and how secure you make it isn't a binary decision - it depends on the value of the thing you're protecting and the likelihood of an attack.
staktrace 16y ago
There are probably going to be a lot of people negatively affected by this for quite some time to come. Yes, but it's better than the alternative, where there would be an increasing number of people negatively affected for even longer. At least the problem is out in the open now and there will be public pressure to fix it. America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. You are correct. But those days are long gone, and they're not coming back. Unless you want to throw out a good chunk of technology, kill half the people on the planet and go back living in communities where you knew personally everybody you interacted with during your entire lifetime. Butler has simply raised the threat level for everyone. Yes, he has. But he has also raised the defense-level for everyone, and by a greater margin. Before his post, there was a much larger divide between the people who knew about this exploit and those who didn't (the fox and the sheep, if you will). It's true that now more people can exploit those who don't know, but it's also true that even more people can defend against it. He did not invent a new lock or close a hole. Making other people aware of the hole is the first step in getting it closed, if you are unable to do it yourself. Shame on the rest of us for not doing this earlier.
gbog 16y ago
It is nice to see a common security issue taken seriously, but for me the even worse gigantic hole is that most people use only one password for their email account and all other accounts. (writing on phone, sorry if unclear)
deleted 16y ago
[deleted]
cazlab 16y ago
LOL at the "Everything was better in a magical time that never existed, but my faulty memory has synthesized from biscuit commercials i saw as a child." ramanujan: no one blames door manufacturers for break ins and there has never been a time when it was wise to leave your door unlocked.
baddox 16y ago
Security through obscurity. Information is dangerous. Two sentiments that you're espousing that I consider bogus.
ax0n 16y ago
Bull crap. Hamster and Ferret was only slightly harder to use than Firesheep. You had to run it, then adjust your proxy to localhost:1234. Aside from that, it does exactly the same thing. And before it was around, we were using cookie editing plugins in FireFox to import stuff we grabbed from Wireshark. And before that, we were manually editing our browser's cookie stores to bring in cookies we caught with tcpdump. And before that... This isn't a new threat. Just a new shiny piece of ware that lowers the bar a little further.
BrandonM 16y ago
Please reread the name of this site. I'm surprised that so many members of a site named "Hacker News" agree with you that what is clearly a very clever hack is inherently a bad thing.
- redthrowaway 16y ago
  Not necessarily a clever hack (nothing new here), just a user-friendly interface.
- ramanujan 16y ago
  This "clever hack" is costing a lot of people a lot of money today. Concrete example: are you a location based startup? Well, you might need to shell out $10,000 for a Google Maps API Premier key in order to get HTTPS. "Access to the API via a secure HTTPS connection" http://code.google.com/apis/maps/documentation/premier/guide.html http://code.google.com/apis/maps/documentation/premier/guide... "Google Maps API Premier is extremely cost-effective, starting at just $10,000 per year." http://www.google.com/enterprise/earthmaps/maps_features.html http://www.google.com/enterprise/earthmaps/maps_features.htm... Multiply that by thousands and you'll begin to have some idea of the discussions going on at every web based company with a clue today. For those who make their living in computer security, like Mr. Butler, of course it's a good day (and month, and year). Pretty good business when you can start fires and then get paid well to put them out. Serves them right, of course, because they shouldn't have built that house out of wood in the first place. While we're on the topic, I don't understand how a lot of people fail to realize that spending on computer security is a lot like spending on national security -- you can always spend more money on it, thereby taking away resources from other priorities. http://www.goodreads.com/author/quotes/23920.Dwight_D_Eisenhower http://www.goodreads.com/author/quotes/23920.Dwight_D_Eisenh... "Every gun that is made, every warship launched, every rocket fired signifies in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed. This world in arms is not spending money alone. It is spending the sweat of its laborers, the genius of its scientists, the hopes of its children. This is not a way of life at all in any true sense. Under the clouds of war, it is humanity hanging on a cross of iron." -- Eisenhower
Natsu 16y ago
The problem with vulnerabilities like this is that they're too easy for people to rationalize as "hard" and it's too easy to pretend that they don't happen. People seem to think that as long as the problem can remain invisible (to them), nothing bad is happening. What actually happened back in the day before people started forcing the issue with full disclosure was that the bad guys operated with impunity because the good guys couldn't work together because people got upset when folks let the "secret" vulnerability knowledge out. I don't want to go back to those days. Things have improved so much since then.
doron 16y ago
when you log into most banks and websites that perform financial transactions you are routed to an SSL logon, its a default choice, in fact most of the transactions are done under SSL. why should social networks be different?! by now it is clear that unauthorized access to social networks can cause much distress and even worse to a great many people who use them. Banks minimize their liability when they use SSL, facebook should do this too. at this point it should be clear that the effect on a person social life can be severe, career destroying, financially damaging, what have you, we are witnessing stories along these lines in increasing rates. The release of this extension is a blessing in my view, it forces the issue that companies like facebook or twitter would prefer to ignore, or cover in obscure terminology, this simply demonstrates how trivial this is. When Ingersoll Rand released the Kryptonite lock, they named it after the mythical element that would bring superman to his knees. Too bad the lock was revealed to have a design flaw that enabled cracking it up with a BIC pen, was it shameful to display that defective design? Facebook etc... talk about privacy all the time. This forces them to walk the walk, not just talk.
asnark 16y ago
As said before, these tools [edit: the stupidly easy point & click ones, btw] have already been available for about 3 years. (e.g. http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=Hamster+and+Ferret http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...) Butler isn't doing anything earth-shattering, he is just reminding everyone AGAIN that the current system is messed up. There will always be this debate about disclosure, but you can't ignore that it works. Sure, innocents suffer (and they would[they are!] anyway), but at least it's one more reason why websites should change to https.

zecg 16y ago

This is IMO a completely wrong approach to security. Butler has not raised the threat level, he has merely illuminated the existing threat level.

bsaunder 16y ago
Illumination is one thing. Enabling a ten year old to do malicious stuff with a few clicks and poorly considered actions is entirely another.
- evilduck 16y ago
  If it can be that easily scripted, 10 year olds were already doing it. Suppressing knowledge, especially knowledge of a flawed system, doesn't make the system safer. In terms of severity, computing has overcome worse exploits; this is a problem awaiting an answer, which sounds like opportunity to me.
  - ramanujan 16y ago
    > Suppressing knowledge Again, degrees matter. Abstract knowledge is one thing. A simple tool to facilitate griefing people is quite another. Mobile web browsing existed before the Iphone. Search existed before Google. Telecommunication preceded the internet. You could share mp3s before Napster and mp4s before Youtube. And you used to have to delve into Wireshark to pull this off, but now you can snag grandma's credentials from any Starbucks in the country with a mouse. Degrees do matter.
    - rsanders 16y ago
      And without raising awareness of the issue, everybody might always be somewhat vulnerable forever, whereas now that "we know", after being highly vulnerable for a short time everybody's vulnerability to this should drop to zero very quickly. If you assume a limited number of evildoers and a limited ability to exploit this at will (e.g. you have to catch your victim in close proximity on public wi-fi that you're sharing with him), releasing a tool like Firesheep may produce significantly less total damage.
- enneff 16y ago
  I know 10-year-olds who do this already.
jberryman 16y ago
I agree. Releasing a point and click exploit is standard practice among white hat, well intentioned hackers. Decades of this kind of tough love is why microsoft finally has an OS that is reasonably secure.

mike-cardwell 16y ago

People have been doing this for years already with tools like Wireshark. The only thing the app he has released does it to draw a massive amount of attention to the already existing problem. I say superb. Brilliant effort. Well done. Hopefully more people will stop stupidly sending session cookies over unsecured channels now.

mike-cardwell 16y ago
Also. If you want to use Facebook completely over https. Install the "HTTPS Everywhere" Firefox addon. It forces a number of sites to make all of their requests over an SSL secured channel.

pmjordan 16y ago

How many new servers are going to be needed now that https is used for everything and requests can't be cached? The main thing holding us back there are browsers that go apeshit if you load images via HTTP on an HTTPS page. Requiring JavaScript or other active content to be loaded from the same HTTPS server would be a good thing in many cases. I think currently ANY https server is allowed, which doesn't actually defend against any kind of XSS, so it's pretty meh. Or is there some kind of meta tag etc. that enforces same-origin? (If not, that would be a cool addition. Maybe a list of allowed domains?)

timcraft 16y ago
http://stackoverflow.com/questions/954327/hidden-features-of-html/960111#960111 http://stackoverflow.com/questions/954327/hidden-features-of...
- pmjordan 16y ago
  That will still load images via https, not http. They'll still be cached client-side of course, but they can't be cached by proxies and you need an SSL certificate for your static content server.
jdunck 16y ago
FWIW, non-JS is still a vector. For example, img tags can stomp on cookies. Yes, serving static media over SSL is diminishing returns, and it would suck for mid-stream proxies (and every ISP will hurt from it). But don't argue that it doesn't matter from a security perspective.
- pmjordan 16y ago
  When done correctly, it should at least avoid this sort of cookie stealing scenario, though - HTTPS-only cookies won't leak into HTTP requests for non-active content, though malicious Set-Cookie: injection into the HTTP responses can obviously log the user out, etc. and may even reveal unwanted info if the HTTPS server doesn't handle the situation gracefully.

chaitanya 16y ago

> How many new servers are going to be needed now that https is used for everything and requests can't be cached? Wrong. You don't need to use https for everything -- you can specify a domain and a path in the cookie. For things like images, videos and css, you still don't need SSL.

ramanujan 16y ago
Many browsers give warnings when mixing secure and insecure content. Know of a good cross-browser example that mixes http and https requests?
- chaitanya 16y ago
  That's a good point -- I hadn't thought about this.

cousin_it 16y ago

America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. The analogy is not complete because in our situation there's a third party involved beside the victim and the criminal: the website. What if your bank leaves the vault unlocked so anyone can take your money? Isn't the bank at least partly to blame?

ra88it 16y ago
In parent's analogy, the third party is the door manufacturer.

sushrutbidwai 16y ago

I will blame lock manufacturers if any damn key on the planet can open it up.

jfager 16y ago

Butler has not raised the threat level on anything. This has been a widely known issue since forever. A friend of mine wrote a sniffer that could do this back in college, and he was one of the last to the party. Want something else to kvetch about? His tool could impersonate the router and act as a proxy, including serving up ssl-encrypted pages to users who didn't realize they shouldn't accept certs from unknown signers - again, that was years ago, and even then it was nothing new or unique at all. When a tool like this rises to even a minimum level of public consciousness, you're better off thinking "people have probably been doing this for close to a decade" than "this asshole just ruined the internet by pointing out an obvious flaw that someone will now be able to exploit". And yes, at some point, a door manufacturer that knows how easily their doors will open and how frequently people will just walk through does take on some responsibility to add a lock (and the homeowner to use it). It's going to cost more in servers? Okay, so what? It costs more to install seatbelts, are you upset at Ralph Nader, too? [Edited to bring it down a notch]

ramanujan 16y ago
> Butler has not raised the threat level on anything. Flat out false. Ever heard the term "crime of opportunity"? What's your over/under on the number of identity thefts facilitated by Eric Butler's little gift? Let's make this empirical.
- jfager 16y ago
  Anyone who wanted to hijack http sessions was five minutes of Googling and installing away from being able to do so before "Eric Butler's little gift" anyways. Are you claiming that the marginal impact of packaging it up into a firefox extension is so great as to make it a threat of a wholly different kind?
  - ramanujan 16y ago
    That is exactly what I'm claiming. That's also why this article has 200+ comments and was on the top of Hacker News all day! You vastly underestimate the barrier that "five minutes of Googling" presents. I assure you, the overwhelming majority of aspiring script kiddies would never be able to figure it out. It took an expert to package an exploit in a nice GUI (and write cookie parsing code for every major social site under the sun).

jberryman 16y ago

America was a better place when people could keep their doors unlocked I hate this mythical "good old days" B.S. I know people who live in the country who don't lock their doors because they live in the country. The idea that people who lived in urban areas ever could leave their doors unlocked is absurd.

Encosia 16y ago
I live in a suburb of Atlanta and haven't locked my front door during the day in about a decade (since moving from an apartment to a house). The world isn't really as scary as the news makes it seem.
- daten 16y ago
  While I completely agree, I wouldn't consider personal experience a valid data point for generalizing the whole world.
- BrandonM 16y ago
  > I... haven't locked my front door during the day This isn't what people mean when they say they don't lock their doors. I grew up in the country in northeast Ohio. I knew many people who simply never locked their doors, including overnight or even when they weren't home.
  - Encosia 16y ago
    For most of the time I've been here, I didn't lock them overnight either. My girlfriend takes comfort in that illusion of security though, so I play along.
  - mattmillr 16y ago
    I lived in middle-of-nowhere Texas for several years, and I think the only time I ever locked the door to my home was when I left for two weeks at Christmas. If my car didn't automatically lock itself after you get out, I would have left it unlocked as well, with the key lying in the center console. I live in Brooklyn now. Things are a little different here. My door has a $350 deadbolt lock that -- when it broke and locked me in -- took a locksmith, a serious drill and a couple hardened bits to defeat. Whether you should lock something and how secure you make it isn't a binary decision - it depends on the value of the thing you're protecting and the likelihood of an attack.

staktrace 16y ago

There are probably going to be a lot of people negatively affected by this for quite some time to come. Yes, but it's better than the alternative, where there would be an increasing number of people negatively affected for even longer. At least the problem is out in the open now and there will be public pressure to fix it. America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. You are correct. But those days are long gone, and they're not coming back. Unless you want to throw out a good chunk of technology, kill half the people on the planet and go back living in communities where you knew personally everybody you interacted with during your entire lifetime. Butler has simply raised the threat level for everyone. Yes, he has. But he has also raised the defense-level for everyone, and by a greater margin. Before his post, there was a much larger divide between the people who knew about this exploit and those who didn't (the fox and the sheep, if you will). It's true that now more people can exploit those who don't know, but it's also true that even more people can defend against it. He did not invent a new lock or close a hole. Making other people aware of the hole is the first step in getting it closed, if you are unable to do it yourself. Shame on the rest of us for not doing this earlier.

gbog 16y ago

It is nice to see a common security issue taken seriously, but for me the even worse gigantic hole is that most people use only one password for their email account and all other accounts. (writing on phone, sorry if unclear)

deleted 16y ago

[deleted]

cazlab 16y ago

LOL at the "Everything was better in a magical time that never existed, but my faulty memory has synthesized from biscuit commercials i saw as a child." ramanujan: no one blames door manufacturers for break ins and there has never been a time when it was wise to leave your door unlocked.

baddox 16y ago

Security through obscurity. Information is dangerous. Two sentiments that you're espousing that I consider bogus.

ax0n 16y ago

Bull crap. Hamster and Ferret was only slightly harder to use than Firesheep. You had to run it, then adjust your proxy to localhost:1234. Aside from that, it does exactly the same thing. And before it was around, we were using cookie editing plugins in FireFox to import stuff we grabbed from Wireshark. And before that, we were manually editing our browser's cookie stores to bring in cookies we caught with tcpdump. And before that... This isn't a new threat. Just a new shiny piece of ware that lowers the bar a little further.

BrandonM 16y ago

Please reread the name of this site. I'm surprised that so many members of a site named "Hacker News" agree with you that what is clearly a very clever hack is inherently a bad thing.

redthrowaway 16y ago
Not necessarily a clever hack (nothing new here), just a user-friendly interface.
ramanujan 16y ago
This "clever hack" is costing a lot of people a lot of money today. Concrete example: are you a location based startup? Well, you might need to shell out $10,000 for a Google Maps API Premier key in order to get HTTPS. "Access to the API via a secure HTTPS connection" http://code.google.com/apis/maps/documentation/premier/guide.html http://code.google.com/apis/maps/documentation/premier/guide... "Google Maps API Premier is extremely cost-effective, starting at just $10,000 per year." http://www.google.com/enterprise/earthmaps/maps_features.html http://www.google.com/enterprise/earthmaps/maps_features.htm... Multiply that by thousands and you'll begin to have some idea of the discussions going on at every web based company with a clue today. For those who make their living in computer security, like Mr. Butler, of course it's a good day (and month, and year). Pretty good business when you can start fires and then get paid well to put them out. Serves them right, of course, because they shouldn't have built that house out of wood in the first place. While we're on the topic, I don't understand how a lot of people fail to realize that spending on computer security is a lot like spending on national security -- you can always spend more money on it, thereby taking away resources from other priorities. http://www.goodreads.com/author/quotes/23920.Dwight_D_Eisenhower http://www.goodreads.com/author/quotes/23920.Dwight_D_Eisenh... "Every gun that is made, every warship launched, every rocket fired signifies in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed. This world in arms is not spending money alone. It is spending the sweat of its laborers, the genius of its scientists, the hopes of its children. This is not a way of life at all in any true sense. Under the clouds of war, it is humanity hanging on a cross of iron." -- Eisenhower

Natsu 16y ago

The problem with vulnerabilities like this is that they're too easy for people to rationalize as "hard" and it's too easy to pretend that they don't happen. People seem to think that as long as the problem can remain invisible (to them), nothing bad is happening. What actually happened back in the day before people started forcing the issue with full disclosure was that the bad guys operated with impunity because the good guys couldn't work together because people got upset when folks let the "secret" vulnerability knowledge out. I don't want to go back to those days. Things have improved so much since then.

doron 16y ago

when you log into most banks and websites that perform financial transactions you are routed to an SSL logon, its a default choice, in fact most of the transactions are done under SSL. why should social networks be different?! by now it is clear that unauthorized access to social networks can cause much distress and even worse to a great many people who use them. Banks minimize their liability when they use SSL, facebook should do this too. at this point it should be clear that the effect on a person social life can be severe, career destroying, financially damaging, what have you, we are witnessing stories along these lines in increasing rates. The release of this extension is a blessing in my view, it forces the issue that companies like facebook or twitter would prefer to ignore, or cover in obscure terminology, this simply demonstrates how trivial this is. When Ingersoll Rand released the Kryptonite lock, they named it after the mythical element that would bring superman to his knees. Too bad the lock was revealed to have a design flaw that enabled cracking it up with a BIC pen, was it shameful to display that defective design? Facebook etc... talk about privacy all the time. This forces them to walk the walk, not just talk.

asnark 16y ago

As said before, these tools [edit: the stupidly easy point & click ones, btw] have already been available for about 3 years. (e.g. http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=Hamster+and+Ferret http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...) Butler isn't doing anything earth-shattering, he is just reminding everyone AGAIN that the current system is messed up. There will always be this debate about disclosure, but you can't ignore that it works. Sure, innocents suffer (and they would[they are!] anyway), but at least it's one more reason why websites should change to https.