Even Forced SSL is broken for Facebook Google Twitter
Update – See report card for various online services
There’s been a lot of constructive attention on Firesheep this week, which is a simple tool that lets anyone hijack other people’s web accounts with absolutely no skill required. A lot of people are offering the suggestion that running their Firefox or Chrome web browser in forced SSL HTTPS mode, but I cautioned people that this isn’t that simple because many websites don’t fully support SSL. But it’s even worse than this because even if a site supports SSL, it will frequently contain links that redirect to non-SSL portions of the site. And even if all the links are rewritten to direct to an SSL page, there may be javascript code within the page that transmits authentication cookies in clear non-SSL HTTP mode.
This is precisely what happened to Google in 2008 when it was revealed that even full SSL mode for GMail would leak the cookie information that will allow someone to “sidejack” a GMail account. Facebook seems to have recently added support for full HTTPS SSL mode but there are many links that drop back to HTTP even if you run extensions designed to force Facebook to run SSL mode. But even running these force SSL extensions, the links within Facebook will still temporarily redirect to HTTP and then bounce to HTTPS. Even when I manually type HTTPS and never see an HTTP session, Facebook is still leaking the authentication cookies that allow Firesheep to sidejack the session based on my testing.
The same problem affects Twitter even when I manually type in https://twitter.com. Twitter will remain in https mode no matter what part of the site I click, but it will still leak authentication cookies to sidejacking tools like Firesheep. The effect is that anyone can still go into my Twitter account and post any embarrassing message they want. Even https://Google.com leaks my account so that people can see where I searched and where I live on maps.google.com. For that matter, just firing up the Chome browser without launching a single page will leak my Google account! Thanks a lot for caring about our privacy guys.
The force SSL mode also seems to be nearly useless in Google Chrome because it’s so stingy about what it will force into SSL. If it’s the first time you’ve visited the site or there are some additional non-sensitive image icons being loaded from some other non-SSL site, it will not force the site to go SSL.
Conclusion? Browser makers and website operators have a long way to go to secure people’s accounts and identities on the Internet.
http://www.digitalsociety.org/2010/10/firesheep-will-permanently-scare-you-from-hotspots
[...] effective this breaks aspects of some sites such as Facebook’s chat, and Google maps. Also it is not always secure either as Facebook sends a lot of stuff unsecurely even if you force [...]
Check the contents of the cookies more closely. The existence of a cryptic string does not mean something is an authentication cookie (try it). Google’s cookies that are used for auth are secure only. The cookies that can be viewed over HTTP cannot be used for auth, at least since 2008 when it was reported. I haven’t tested with Facebook or Twitter, but have with Google cookies. If you could find one accessible over HTTP that could be used for auth, I would be happy to be wrong.
George – My (recently renamed) extension Fidelio takes care of what you describe in your first paragraph. It will:
* rewrite your cookies (as they are set) so that the secure flag is on (ie. they will only ever be sent back over an https connection)
* will rewrite main requests to https
* capture all doc loads, be it an image, javascript or xmlhttprequest, and either rewrite them to https or drop the request entirely
between these features, your cookies will never be sent in the clear. you can get it here:
http://github.com/nikcub/fidelio
Thanks a lot for the huge information about the Forced SSL in Chrome browser.
Its time for Browser Developers need to take a big step on this issue. Better one should stay away from Public Wi-Fi spot until we get a clearcut solution
[...] sida. Inte ens olika sätt att tvinga fram SSL (alltså HTTPS i det här fallet) hjälper eftersom javascript läcker okrypterad information. Min skepsis inför plugins som HTTPS everywhere inslaget i Radio Metropol besannades alltså. Det [...]
NoScript’s “Force HTTPS” feature covers all the request and the subrequests to the forced domains (no matter if images, scripts, stylesheets or anything else), hence you’re fully covered against this kind of attacks.
[...] [...]
[...] been offering incorrect advice to just use force the website to run SSL, but my testing shows that sidejacking is still possible even when the site runs SSL. Some people have suggested tools that go as far as rewriting the website’s javascript but [...]
[...] [...]
[...] Sites like Facebook that allow you to manually force an SSL connection for everything are still susceptible to cookie theft while sites like Ebay which doesn’t support full time SSL browsing aren’t susceptible. [...]
[...] been offering incorrect advice to just use force the website to run SSL, but my testing shows that sidejacking is still possible even when the site runs SSL. Some people have suggested tools that go as far as rewriting the website’s javascript but [...]
[...] Society: 1 [...]
Leave your response!
Twitter Feed
About Us
Digital Society is a digital think tank that believes culture and commerce are inseparable, that the digital economy flourishes when people are free and rights are secure, and that free markets free people.
Digital Society is an independent 501(c)3 non-profit organization, funded by donations from Jon Henke and from Arts+Labs. We advocate for a pro-culture, pro-commerce digital society through research, analysis and debate on emerging technology issues.
Reply Comments
Transparency and interactivity are trademarks of the Internet era, and we aim to foster them here at Digital Society. It is inevitable that some people will disagree with the technology policy positions we take. We want to have that constructive debate.
The Reply Comments feature gives our critics a chance to respond to our viewpoints and the Digital Society audience convenient access to competing arguments. Any time we directly challenge the views of an individual or a group on this site, the party in question may substantively respond in a guest post.
Please contact executive director Jon Henke by e-mail.
Subscribe
Recent Posts
Recent Posts
Most Commented
Most Viewed