bk99.de entertain the web since 1997

bk99.de
HN · Wi-Fi securityCurated

Firesheep makes unencrypted sessions visible

Summary

Eric Butler releases a Firefox extension that captures session cookies on open Wi-Fi networks and thus demonstrates the consequences of incomplete HTTPS use. Security problems get priority as soon as exploiting them becomes cheap and easy to grasp. Partial encryption does not protect secrets if the subsequent session remains unprotected.

Ideas

  • At the time many services encrypted the login but sent later session cookies in the clear.
  • A captured cookie could take over an existing session without a password.
  • Firesheep made a well-known protocol flaw immediately visible to non-specialists.

Recommendations

  • Enforce HTTPS for the entire session and set cookies to Secure and HttpOnly.
  • On other people's networks, do not use services that still allow unencrypted HTTP.

References

Read the original post

Search the Web Archive

HN · 2009

Pipe Viewer makes invisible data streams visible

Peteris Krumins shows how pv displays progress, throughput and remaining time of any Unix pipeline without changing its data flow. It reads from standard input and writes to standard output. The program displays time, rate, amount and progress.

HN · 2026

Dirty Frag: a note on a Linux privilege escalation

The oss-security post describes a chained local Linux privilege escalation and its problematic disclosure before a coordinated fix. The publication contains working demonstration code for x86-64 systems. Chaining vulnerabilities makes individually limited bugs system-critical together.

HN · 2026

Little Snitch for Linux: making connections visible

Objective Development shows an eBPF-based network monitor that maps Linux connections to applications and makes them controllable. Little Snitch requires Linux 6.12 or newer and BTF support. The interface runs locally on port 3031 and can be installed as a PWA.