Timeline for Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?
Current License: CC BY-SA 3.0
60 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 3, 2017 at 22:06 | history | edited | OdedStaffMod |
edited tags
|
|
| Mar 16, 2017 at 20:51 | review | Close votes | |||
| Mar 19, 2017 at 0:01 | |||||
| S Jun 20, 2013 at 14:32 | history | bounty ended | Ry-Mod | ||
| S Jun 20, 2013 at 14:32 | history | notice removed | Ry-Mod | ||
| S Jun 16, 2013 at 23:50 | history | bounty started | Ry-Mod | ||
| S Jun 16, 2013 at 23:50 | history | notice added | Ry-Mod | Reward existing answer | |
| S Jun 6, 2013 at 12:49 | history | bounty ended | CommunityBot | ||
| S Jun 6, 2013 at 12:49 | history | notice removed | CommunityBot | ||
| Jun 5, 2013 at 1:35 | history | edited | Nick CraverMod |
edited tags
|
|
| Jun 5, 2013 at 1:35 | answer | added | Nick CraverMod | timeline score: 63 | |
| May 29, 2013 at 14:19 | comment | added | user206222 | @Adnan Well, at least we know it will be done at some point. As for six to eight weeks.... | |
| May 29, 2013 at 12:13 | comment | added | Adi | A recent blog post by Nick from StackExchange explains the implications of implementing SSL network-wide. The wording of the last paragraph suggests that this issue will be resolved in the next few weeks. | |
| S May 29, 2013 at 11:27 | history | bounty started | Adi | ||
| S May 29, 2013 at 11:27 | history | notice added | Adi | Current answers are outdated | |
| S Mar 3, 2013 at 13:30 | history | bounty ended | CommunityBot | ||
| S Mar 3, 2013 at 13:30 | history | notice removed | CommunityBot | ||
| S Feb 23, 2013 at 11:44 | history | bounty started | Manishearth | ||
| S Feb 23, 2013 at 11:44 | history | notice added | Manishearth | Current answers are outdated | |
| S Feb 18, 2013 at 17:59 | history | bounty ended | Tobias Kienzler | ||
| S Feb 18, 2013 at 17:59 | history | notice removed | Tobias Kienzler | ||
| Feb 12, 2013 at 12:31 | comment | added | Tobias Kienzler | @aef I'd even accept to trust a SE root CA certificate, but as Zypher said the problem is more about performance than about the certification. Although I'd argue that shouldn't be that much trouble after all. | |
| S Feb 11, 2013 at 17:36 | history | bounty started | Tobias Kienzler | ||
| S Feb 11, 2013 at 17:36 | history | notice added | Tobias Kienzler | Draw attention | |
| Nov 16, 2012 at 1:57 | answer | added | makerofthings7 | timeline score: 7 | |
| Nov 10, 2012 at 10:34 | comment | added | aef | I would like to see HTTPS on StackExchange. You can get 2 years of all-you-can-sign universally trusted extended validation certificates including unlimited alternative names and wildcards for about 200$ nowadays. TLS being a resource intensive thing simply isn't true anymore. | |
| Jul 5, 2012 at 16:05 | history | edited | David Fullerton |
edited tags
|
|
| Feb 24, 2012 at 2:01 | answer | added | Chris Frederick | timeline score: 27 | |
| Dec 28, 2011 at 10:13 | history | edited | This_is_NOT_a_forum | CC BY-SA 3.0 |
added 11 characters in body
|
| Dec 28, 2011 at 4:53 | history | edited | John | CC BY-SA 3.0 |
edited body
|
| Dec 28, 2011 at 4:42 | history | edited | Rook | CC BY-SA 3.0 |
added 1073 characters in body
|
| Oct 24, 2011 at 21:18 | history | edited | Rook | CC BY-SA 3.0 |
added 56 characters in body
|
| Oct 15, 2011 at 3:52 | history | notice removed | CommunityBot | ||
| Oct 15, 2011 at 3:52 | history | bounty ended | CommunityBot | ||
| Oct 13, 2011 at 21:54 | comment | added | Flexo - Save the data dump | @DanBeale - even with WPA you can still ARP spoof, ICMP redirect spoof or run a rogue DHCP server to trick users into routing everything via yourself. Coffee shops are typically open too and a "password on the wall" WPA approach would allow you to run a rogue AP with the same SSID... | |
| Oct 11, 2011 at 21:42 | comment | added | DanBeale | Does anyone still use open wifi? Wiresheep doesn't work on WPA protected networks. | |
| Oct 7, 2011 at 2:37 | history | notice added | Zoredache | Draw attention | |
| Oct 7, 2011 at 2:37 | history | bounty started | Zoredache | ||
| Apr 25, 2011 at 9:11 | answer | added | Kaveh | timeline score: 10 | |
| Jan 23, 2011 at 17:37 | comment | added | Rook | @Arjan oooooooah, thats a good point. | |
| Jan 23, 2011 at 17:12 | comment | added | Arjan | (@Rook, I know, but I was merely referring to the SO Über Admin account having been compromised two and a half years ago...) | |
| Jan 23, 2011 at 17:09 | comment | added | Rook | @Arjan We'll 2 things here. For one, httponly cookies does not prevent an attacker from sniffing your HTTP traffic and obtaining the cookie. Further more, httponly cookies can still be exploited by using XHR to "ride" on the session in an attack similar to CSRF. HttpOnly cookies is by no means a complete solution. | |
| Jan 23, 2011 at 14:59 | comment | added | Arjan | Related historical incident: Protecting Your Cookies: HttpOnly (hoping Jeff, a moderator, or maybe even any 10k user will never be fooled into logging in to SO using some wifi on some conference). | |
| Jan 7, 2011 at 19:15 | answer | added | Pollyanna | timeline score: 6 | |
| Jan 7, 2011 at 17:30 | answer | added | nealmcb | timeline score: 9 | |
| Nov 17, 2010 at 17:55 | comment | added | Craig Stuntz | @Rook, I hadn't realized that hyperbole was your first language. Sorry! | |
| Nov 17, 2010 at 17:10 | comment | added | Rook | @Craig Stuntz yes making sure your users don't get hacked is frivolous and decadent. Such a luxury is only enjoyed by twitter, github, gmail... ect. | |
| Nov 17, 2010 at 16:50 | history | edited | This_is_NOT_a_forum | CC BY-SA 2.5 |
Using official name of Stack Overflow -see http://stackoverflow.com/legal/trademark-guidance, "Proper Use of the Stack Overflow and Stack Exchange Name". Interpreted SO as meaning the development team.
|
| Nov 17, 2010 at 15:18 | comment | added | Craig Stuntz | This is a reasonable question, but the hyperbole is unnecessary. | |
| Nov 8, 2010 at 16:18 | answer | added | user153246 | timeline score: 5 | |
| Nov 3, 2010 at 20:05 | comment | added | Zach Johnson | @nevan: +1 Yes, that's what I meant; I should have said stackoverflow accounts. | |
| Nov 3, 2010 at 19:58 | comment | added | nevan king | @Zach I'm definitely not trying to hijack Stack Overflow. Using this plugin you can only hijack one persons account, and only if there happens to be another Stack Overflow user coding in the same Starbucks and using the WiFi. | |
| Nov 3, 2010 at 19:51 | answer | added | nevan king | timeline score: 36 | |
| Nov 3, 2010 at 18:17 | comment | added | Rook | @Zach Johnson very interesting. | |
| Nov 3, 2010 at 17:38 | comment | added | Zach Johnson | Someone is already trying to hijack stackoverflow using firesheep (and asking a question on stackoverflow about it) stackoverflow.com/questions/4089665/… | |
| Nov 1, 2010 at 23:37 | vote | accept | Rook | ||
| Nov 7, 2010 at 22:13 | |||||
| Nov 1, 2010 at 23:33 | comment | added | Rook | @Zypher true story, but my complaint is that i can't even use https everywhere. | |
| Nov 1, 2010 at 23:20 | answer | added | Zypher | timeline score: 87 | |
| Nov 1, 2010 at 22:47 | comment | added | Zypher | For sites the size of SO/SF/SU it is A LOT more than a 20$ certificate | |
| Nov 1, 2010 at 22:47 | answer | added | Jeff Atwood | timeline score: 28 | |
| Nov 1, 2010 at 22:36 | history | asked | Rook | CC BY-SA 2.5 |