Skip to main content
Meta Stack Exchange

Return to Answer

Copy edited. Added some context.
Source Link
This_is_NOT_a_forum
This_is_NOT_a_forum
  • 6.7k
  • 4
  • 37
  • 55

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Because even the high-rep users have rate limits, so if the accounts are broken into, there's very little damage that can be done to StackOverflowStack Overflow at all, and what damage is done is easy to remedy.

It's likely something that will be addressed more completely at a later date, but it would take a concerted effort to pull something like this off.

For instance, go to CESCES with a few friends and set up their notebooks to sniff and report the cookie information to a central server the cookie information. ThatThat server thanthen figures out which accounts it's gathered, and sets up a controller so that a single user can insta-close questions, post questions and insta-vote them up, etc. using several accounts.

However, StackOverflowStack Overflow already has significant monitoring, rate limiting, and firewall blocking for abusers, and chances are good such a simple setup (as above) would be blocked with the current setup.

The biggest danger is if someone gets the cookie from a moderator, at which point they can do some damage that can't be easily be rolled back.

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Because even the high-rep users have rate limits, so if the accounts are broken into, there's very little damage that can be done to StackOverflow at all, and what damage is done is easy to remedy.

It's likely something that will be addressed more completely at a later date, but it would take a concerted effort to pull something like this off.

For instance, go to CES with a few friends and set up their notebooks to sniff and report to a central server the cookie information. That server than figures out which accounts it's gathered, and sets up a controller so that a single user can insta-close questions, post questions and insta-vote them up, etc using several accounts.

However, StackOverflow already has significant monitoring, rate limiting, and firewall blocking for abusers, and chances are good such a simple setup (as above) would be blocked with the current setup.

The biggest danger is if someone gets the cookie from a moderator, at which point they can do some damage that can't be easily rolled back.

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Because even the high-rep users have rate limits, so if the accounts are broken into, there's very little damage that can be done to Stack Overflow at all, and what damage is done is easy to remedy.

It's likely something that will be addressed more completely at a later date, but it would take a concerted effort to pull something like this off.

For instance, go to CES with a few friends and set up their notebooks to sniff and report the cookie information to a central server. That server then figures out which accounts it's gathered, and sets up a controller so that a single user can insta-close questions, post questions and insta-vote them up, etc. using several accounts.

However, Stack Overflow already has significant monitoring, rate limiting, and firewall blocking for abusers, and chances are good such a simple setup (as above) would be blocked with the current setup.

The biggest danger is if someone gets the cookie from a moderator, at which point they can do some damage that can't easily be rolled back.

Source Link
Pollyanna
Pollyanna
  • 76.3k
  • 41
  • 270
  • 480

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Because even the high-rep users have rate limits, so if the accounts are broken into, there's very little damage that can be done to StackOverflow at all, and what damage is done is easy to remedy.

It's likely something that will be addressed more completely at a later date, but it would take a concerted effort to pull something like this off.

For instance, go to CES with a few friends and set up their notebooks to sniff and report to a central server the cookie information. That server than figures out which accounts it's gathered, and sets up a controller so that a single user can insta-close questions, post questions and insta-vote them up, etc using several accounts.

However, StackOverflow already has significant monitoring, rate limiting, and firewall blocking for abusers, and chances are good such a simple setup (as above) would be blocked with the current setup.

The biggest danger is if someone gets the cookie from a moderator, at which point they can do some damage that can't be easily rolled back.