4 ms·
I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?
by ericflo 16y ago
I don't understand your argument here--are you saying we shouldn't mind if the vulnerable sites aren't Facebook or Twitter?
- ryanto 16y agohes saying that most sites that use adsense do not require a login, thus do not need https. he is somewhat correct, but not enough for google to just ignore this issue.
- ericflo 16y agoMost content sites have login systems that people use to customize their experience, post comments or upload content, etc. Millions and millions and millions of people are logged into content sites and are vulnerable to this attack. Also, I disagree on the premise that adsense is mostly used on content sites. It's used on all kinds of websites.
- elliottcarlson 16y agoMost notably would be the oodles of forums out there that are ad supported and require logging in.
- gregmuellegger 16y agoThere are sites that make use of sessions without forcing you into using an account. These are also vulnerable.
- bigiain 16y agoWell, sometimes for strange values of "vulnerable". Some of my sites use Apache::Session over non secured http connections, which makes them technically "vulnerable". The only practical thing an attacker can do with those session ids though, is to mess with some custom visitor tracking in my management backend. So perhaps my information about whether a particular inquiry visited my terms and conditions page or my privacy policy page will be wrong. I can live with that.
- harshpotatoes 16y agoI think he's arguing that since both twitter and facebook (and other unnamed sites) do not use adsense, but are still vulnerable to firesheep, there must be another reason why developers don't update the security for their website.
- BrandonM 16y agoFacebook has an HTTPS version, but Facebook Chat doesn't work over HTTPS.
- mike-cardwell 16y agoUnfortunately, Facebook's XMPP service doesn't utilise SSL either. They hash the password, but everything else is trivally decodable on the wire. Plus there was the hole in Facebook chat which exposed your conversations to your friends earlier this year. Possibly the worse IM system in existence.
- tlrobinson 16y agoFacebook's HTTPS site is utterly useless. 1. Go to https://www.facebook.com/ https://www.facebook.com/ 2. Log in. 3. Immediately you get redirected back to http://www.facebook.com http://www.facebook.com WTF?! 4. Click logout. 5. Go back to https://www.facebook.com/ https://www.facebook.com/ 6. This time you get redirected to https://ssl.facebook.com/ https://ssl.facebook.com/ and you're STILL LOGGED IN. Actually now that I try the same thing with the non-SSL version of the site I have the same problem. WTF is going on? The only way I'm able to log out is by deleting the facebook.com cookies. I'm on Safari 5.