3 ms·

I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.

by mayank 16y ago

redthrowaway 16y ago
It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.
- matwood 16y ago
  With apps on both the iPhone and Android wouldn't it be possible for his phone to poll the FB site in the background without his knowledge? EDIT I know 3G is encrypted. What I'm wondering though is if you ever let your phone join an unencrypted wifi network (say at a coffee shop) would it remember the network and then join again automatically the next time you are there?
  - redthrowaway 16y ago
    3G is encrypted [1], so it would still have to be on an open wifi. [1] http://en.wikipedia.org/wiki/3g#Security http://en.wikipedia.org/wiki/3g#Security
    - w1ntermute 16y ago
      Zuckerberg's probably got an iPhone, and 3G GSM encryption's been cracked: http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked-in-less-than-two-hours/ http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked...
      - deleted 16y ago
        [deleted]
      - redthrowaway 16y ago
        I'd be interested to see if an optimized implementation of that attack could be run in a convenient timeframe for a cafe-sniffing attack. The article you linked mentioned a 2 hour attack window; something in the sub-15 minute range would be a pressing concern.
        w1ntermute 16y ago
        Only something in the sub-15 minute range would be a concern for you or me, but don't forget that this is Zuckerberg - it's not at all impossible that someone followed him around for 2 hours to crack his GSM encryption.
  - redthrowaway 16y ago
    Possibly. Worth an experiment, at any rate. I suspect the behaviour in question would depend upon the phone, unless the iOS/Android/BB apps are all functionally the same.
- mayank 16y ago
  > but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. He'd just have to be logged in, not specifically accessing his fan page, and there's a nice Starbucks near the Facebook campus in Palo Alto that has free (unencrypted) wifi. Or maybe that's all Starbucks these days...

I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.

by mayank 16y ago

I wouldn't rule out some guy following Zuck around Palo Alto with airtools and hijacking cookies.

It would be rather poetic if he just used firesheep, but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. Possible, but unlikely.

matwood 16y ago
With apps on both the iPhone and Android wouldn't it be possible for his phone to poll the FB site in the background without his knowledge? EDIT I know 3G is encrypted. What I'm wondering though is if you ever let your phone join an unencrypted wifi network (say at a coffee shop) would it remember the network and then join again automatically the next time you are there?
- redthrowaway 16y ago
  3G is encrypted [1], so it would still have to be on an open wifi. [1] http://en.wikipedia.org/wiki/3g#Security http://en.wikipedia.org/wiki/3g#Security
  - w1ntermute 16y ago
    Zuckerberg's probably got an iPhone, and 3G GSM encryption's been cracked: http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked-in-less-than-two-hours/ http://www.engadget.com/2010/01/15/3g-gsm-encryption-cracked...
    - deleted 16y ago
      [deleted]
    - redthrowaway 16y ago
      I'd be interested to see if an optimized implementation of that attack could be run in a convenient timeframe for a cafe-sniffing attack. The article you linked mentioned a 2 hour attack window; something in the sub-15 minute range would be a pressing concern.
      - w1ntermute 16y ago
        Only something in the sub-15 minute range would be a concern for you or me, but don't forget that this is Zuckerberg - it's not at all impossible that someone followed him around for 2 hours to crack his GSM encryption.
- redthrowaway 16y ago
  Possibly. Worth an experiment, at any rate. I suspect the behaviour in question would depend upon the phone, unless the iOS/Android/BB apps are all functionally the same.
mayank 16y ago
> but I somehow doubt Zuck is logging on to his fan (not personal) page from cafes with unencrypted wireless. He'd just have to be logged in, not specifically accessing his fan page, and there's a nice Starbucks near the Facebook campus in Palo Alto that has free (unencrypted) wifi. Or maybe that's all Starbucks these days...