4 ms·

The reply from Facebook: "Hi Stevie, This issue has been reported some already so unfortunately cannot reward you, instagram is working to get https for all e

The reply from Facebook: "Hi Stevie, This issue has been reported some already so unfortunately cannot reward you, instagram is working to get https for all endpoints. Its a pretty high barrier to exploitation to already sniffing someones traffic however. Thanks, name removed Security Facebook" And here I am sitting in the Apple Store around the corner from my apartment watching various cookies whizz past my screen. I don't agree the barrier to exploit is high. All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it. At that point Pandora's Box has been blown apart. The obvious precedent for this is Firesheep (now sadly not functional) from back in 2010.

smtddr 12y ago
>>"All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it" And that's why this was made :-)... http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep Maybe you should contribute instagram-sniffing to it :) https://github.com/codebutler/firesheep https://github.com/codebutler/firesheep
- sjtgraham 12y ago
  Thanks, I referenced Firesheep in the grandparent. FS is currently very broken. I still couldn't get it to work after downloading the source and making some changes. The OS X API used by FS has long been deprecated and simply doesn't work on Mavericks. If there is enough interest I will write "Instasheep" this evening.
  - smtddr 12y ago
    Oh wow, yeah my bad... totally missed your reference. I fully support the creation of tools like firesheep to help/nudge companies into SSL.
  - codebutler 12y ago
    Hi, I'm the author of Firesheep. The code in git master should work with recent versions of Firefox, but there is an issue when running on recent versions of OS X related to elevating privileges. If you manually setuid the firesheep-backend binary, it might work. Let me know if you're interested in helping to fix this! Writing a handler for this Instagram vulnerability should be trivial.
  - donfrancisco 12y ago
    Got the instasheep domain name if you want me to point it at a github repo.
    - tansou_471ss 12y ago
      #1380asal
      - tansou_471ss 12y ago
        salam
    - tansou_471ss 12y ago
      #1380asal
    - tansou_471ss 12y ago
      #1380asal #pinar_mg

smtddr 12y ago

>>"All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it" And that's why this was made :-)... http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep Maybe you should contribute instagram-sniffing to it :) https://github.com/codebutler/firesheep https://github.com/codebutler/firesheep

sjtgraham 12y ago
Thanks, I referenced Firesheep in the grandparent. FS is currently very broken. I still couldn't get it to work after downloading the source and making some changes. The OS X API used by FS has long been deprecated and simply doesn't work on Mavericks. If there is enough interest I will write "Instasheep" this evening.
- smtddr 12y ago
  Oh wow, yeah my bad... totally missed your reference. I fully support the creation of tools like firesheep to help/nudge companies into SSL.
- codebutler 12y ago
  Hi, I'm the author of Firesheep. The code in git master should work with recent versions of Firefox, but there is an issue when running on recent versions of OS X related to elevating privileges. If you manually setuid the firesheep-backend binary, it might work. Let me know if you're interested in helping to fix this! Writing a handler for this Instagram vulnerability should be trivial.
- donfrancisco 12y ago
  Got the instasheep domain name if you want me to point it at a github repo.
  - tansou_471ss 12y ago
    #1380asal
    - tansou_471ss 12y ago
      salam
  - tansou_471ss 12y ago
    #1380asal
  - tansou_471ss 12y ago
    #1380asal #pinar_mg