11

Firesheep was released yesterday, a Firefox extension that makes it very easy to do HTTP session hijacking for users of insecure websites. It looks like Stack Overflow (and company) doesn't use SSL for the whole site (or allow an option to do so). Does that make it vulnerable to session hijacking? Should there be an option for full-site https like Gmail and others have?

Improve this question
8
  • 8
    My first reaction to this is "how secure do you need your SO connection to be?" You're not -- or you shouldn't be, anyways -- storing your credit card numbers or Social Security information here. I can see how it would be bad if someone started using your account to spam, but I'm not sure that problem is so serious that the team needs to implement HTTPS.
    – Pops
    Commented Oct 25, 2010 at 16:46
  • 4
    True, it's not near the risk that it would be on a banking site or even a social networking site. But it's still a vulnerability on SO and many other places... how hard is it to implement HTTPS?
    – jrdioko
    Commented Oct 25, 2010 at 21:44
  • 2
    While the personal info on SO isn't worrisome for financial or identity-theft purposes, leaving users open to session hijacking is just asking for account vandalism. If public wifi is my only option and I don't have a VPN available, I'll stay away from SO.
    – Adam Franco
    Commented Oct 30, 2010 at 4:04
  • 1
    I'm certainly interested on the solution to this. I was reading superuser.com/questions/203816/… and wondered whether the HTTPS version of that exists/works. The superuser.com/questions/203816/… exist but its authentication username/password doesn't seem to work. Or did I do it wrong?
    – sabre23t
    Commented Nov 3, 2010 at 9:26
  • 1
    Bad news. Someone is already trying to hijack stackoverflow using firesheep: stackoverflow.com/questions/4089665/…
    – Zach Johnson
    Commented Nov 3, 2010 at 17:36
  • I'd like to see some solutions to this issue posted in the answers section, so we can vote on them. Increasingly I'm switching all my accounts (gmail, facebook, etc) over to use HTTPS because I'm always on public WiFi. Would love to secure SO too, if it needs to be. My one account is my gateway to 30-odd SE sites, and my reputation is reliant upon nobody pirating it. Not as important as financial info, but SE is popular and growing and increasingly our rep is very important.
    – John K
    Commented Apr 5, 2011 at 3:21
  • @John Is your OpenID provider checked at every page load or do you login with your OpenID and cookies are created?
    – TheLQ
    Commented Apr 5, 2011 at 3:35
  • 1
    @TheLQ. Good tech point/question to (re)start the conversation. I look forward to seeing where the security conversation goes and to learn about the supporting technical details as answers (hopefully) ensue.
    – John K
    Commented Apr 5, 2011 at 3:49

0

Reset to default

Browse other questions tagged .