Browser add-on updated to slaughter Firesheep

HTTPS Everywhere: the missing protection


The Electronic Frontier Foundation has updated its popular web browser security tool to guard against attacks waged by the Firesheep script-kiddie snoop kit.

HTTPS Everywhere 0.9.0 has been updated to force websites such as Facebook and Twitter to activate a secure flag in cookies used to authenticate users on those websites, said EFF Senior Staff Technologist Peter Eckersley. By forcing the sites to send the authentication cookies only when a connection is protected by secure sockets layer encryption, man-in-the-middle attacks like the ones launched by cookie-jacking Firesheep are thwarted.

“By forcing cookies to Secure, HTTPS Everywhere adds protection against Firesheep that site operators should have but failed to provide,” said Chris Palmer, an EFF technology director who also worked on the project.

Although the web has been vulnerable to such attacks for more than a decade, many webmasters still don't follow best practices when granting users access to restricted parts of a site. A case in point, the latest version of HTTPS Everywhere breaks parts of Facebook that can only send authentication cookies over unprotected HTTP channels. That means that using the updated tool with Facebook chat and certain apps isn't possible – at least until changes are made to parts of social networking site.

The update also works with several widely used cloud-based services, including Amazon storage service s3.amazonaws.com and twimg.com, reducing the problems when one of those sites is used by Twitter, Facebook or another website. It has also been updated to work with more websites, including Bit.ly, Cisco, Dropbox, Evernote and GitHub.

HTTPS Everywhere is a Firefox plugin that, like NoScript, is a must-have for security-minded users of the open-source browser. It was released in June by the EFF and members of the Tor Project. It has been downloaded more than 500,000 times.

The code behind the add-on is based in part on the Strict Transport Security response header that's under consideration by the Internet Engineering Task Force as a way for websites and browsers to exchange data only when an encrypted connection is being used. Eventually, the technology will probably be widely available. For now, it's available for only a small smattering of websites and browsers. ®

Broader topics


Other stories you might like

  • Never fear, the White House is here to tackle web trolls
    'No one should have to endure abuse just because they are attempting to participate in society'

    A US task force aims to prevent online harassment and abuse, with a specific focus on protecting women, girls and LGBTQI+ individuals.

    In the next 180 days, the White House Task Force to Address Online Harassment and Abuse will, among other things, draft a blueprint on a "whole-of-government approach" to stopping "technology-facilitated, gender-based violence." 

    A year after submitting the blueprint, the group will provide additional recommendations that federal and state agencies, service providers, technology companies, schools and other organisations should take to prevent online harassment, which VP Kamala Harris noted often spills over into physical violence, including self-harm and suicide for victims of cyberstalking as well mass shootings.

    Continue reading
  • Tim Hortons collected location data constantly, without consent, report finds
    Hortons hears a sue

    From May 2019 through August 2020, the mobile app published by multinational restaurant chain Tim Hortons surveilled customers constantly by gathering their location data without valid consent, according to a Canadian government investigation.

    In a report published Wednesday, Office of the Privacy Commissioner (OPC) of Canada and the privacy commissioners from three provinces – Alberta, British Columbia, and Quebec – presented the results of an inquiry that began shortly after the publication of a June 2020 National Post article.

    That article revealed the Tim Hortons app tracked location data every few minutes even when relegated to the background, and the report compiled by Canadian privacy officials confirmed as much.

    Continue reading
  • Abortion rights: US senators seek ban on sale of health location data
    With Supreme Court set to overturn Roe v Wade, privacy is key

    A group of senators wants to make it illegal for data brokers to sell sensitive location and health information of individuals' medical treatment.

    A bill filed this week by five senators, led by Senator Elizabeth Warren (D-MA), comes in anticipation the Supreme Court's upcoming ruling that could overturn the 49-year-old Roe v. Wade ruling legalizing access to abortion for women in the US.

    The worry is that if the Supreme Court strikes down Roe v. Wade – as is anticipated following the leak in May of a majority draft ruling authored by Justice Samuel Alito – such sensitive data can be used against women.

    Continue reading

Biting the hand that feeds IT © 1998–2022