Blogroll

• Above the Law
  
• Althouse
  
• Bag and Baggage
  
• Dennis Kennedy
  
• Ernie the Attorney
  
• Patent Baristas
  
• Patently-O
  
• PrawfsBlawg
• Professor Bainbridge
  
• SCOTUSblog
  
• Volokh Conspiracy
  
• The Wall Street Journal's Law Blog
  

« New York's 311 Data Provides Window Into Complaints and Questions | Main | Obligatory Election Day Scandal Story »

Tech Lawyers Debate Legality of Firesheep Application

The danger inherent in "over-sharing" has been a favorite topic of ours here at Legal Blog Watch. Yesterday, FutureLawyer ratcheted the issue, and the potential for panic, up a notch.

Last week, some wacky programmer released an add-on for the Firefox browser, which he cleverly named "Firesheep." What does Firesheep do? Let's hear it straight from the guy who created it, Eric Butler:

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Today at Toorcon 12 I announced the release of Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

OK, maybe you're a little lost. The next couple of lines, with screen shots, should make it clear to even novice internetters:

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.

As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:

Double-click on someone, and you're instantly logged in as them.

That's it.

Uh oh. If playing around on Facebook at your local coffee shop is no longer safe, about 72 percent of my neighbors here in Austin, Tex. are going to be out of "work."

The ComputerWorld article to which FutureLawyer links reveals that experts aren't yet sure they know whether someone who uses Firesheep to impersonate you at the Starbucks is violating federal wiretapping laws or not. So we'll all just sit around and wait to see which U.S. Attorney tries to grab headlines with the first Firesheep prosecution. In a firewall-protected, super-encrypted underground bunker, surrounded by canned food.

Posted by Eric Lipman on November 2, 2010 at 12:53 PM | Permalink | Comments (3)

Comments

Tech Lawyers Debate Legality of Firesheep Application

The danger inherent in "over-sharing" has been a favorite topic of ours here at Legal Blog Watch. Yesterday, FutureLawyer ratcheted the issue, and the potential for panic, up a notch.

Last week, some wacky programmer released an add-on for the Firefox browser, which he cleverly named "Firesheep." What does Firesheep do? Let's hear it straight from the guy who created it, Eric Butler:

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Today at Toorcon 12 I announced the release of Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

OK, maybe you're a little lost. The next couple of lines, with screen shots, should make it clear to even novice internetters:

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.

As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:

Double-click on someone, and you're instantly logged in as them.

That's it.

Uh oh. If playing around on Facebook at your local coffee shop is no longer safe, about 72 percent of my neighbors here in Austin, Tex. are going to be out of "work."

The ComputerWorld article to which FutureLawyer links reveals that experts aren't yet sure they know whether someone who uses Firesheep to impersonate you at the Starbucks is violating federal wiretapping laws or not. So we'll all just sit around and wait to see which U.S. Attorney tries to grab headlines with the first Firesheep prosecution. In a firewall-protected, super-encrypted underground bunker, surrounded by canned food.