Firesheep Just Made the Case for HTTPS Everywhere

The most effective security lecture of the year is a free Firefox extension with a sheep logo. Firesheep, released in late October by developer Eric Butler, does something security professionals have described in talks for a decade. Except it does it with a double-click.

Sit on any open Wi-Fi network (the café, the airport, the conference hall) and it lists other users’ logged-in sessions on major websites, each one a button. Click, and you are them. Their account, their access, no password required.

Butler’s stated purpose is exactly this publicity. The vulnerability is ancient, widely known, and unfixed at scale, and his wager is that making it trivially demonstrable will force the fix that responsible disclosure has not. Judging by the coverage, and by the questions arriving from clients with member portals, the wager is paying.

So: what the stunt actually demonstrates, why ‘we encrypt the login page’ is the false comfort it names, and what to do about it on the sites you run.

Session hijacking, in plain terms

The mechanics take one paragraph and no jargon. When you log into a website, it cannot ask for your password on every click. Instead it hands your browser a session cookie, a temporary credential that accompanies every later request, meaning ‘this is still the person who authenticated.’

Most sites encrypt the login itself, so your password travels protected. Then, here is the flaw, they conduct the rest of the session over plain unencrypted HTTP. That session cookie rides along in the clear.

On an open wireless network, ‘in the clear’ means broadcast. Anyone nearby can technically read the traffic, and the cookie within it. Capturing cookies used to require modest tooling and intent. Firesheep packages it as a browser sidebar.

The password was never stolen. It never needed to be. The cookie is the authenticated identity, and it was traveling naked. That is the syllabus: encrypting the front door while broadcasting the keys protects almost nothing.

Who this applies to, which is more of you than assume so

The demonstrations target big social sites, but the vulnerability is architectural, and our readership runs the same architecture. Member portals. Alumni communities. Donor account areas. Intranets, learning systems, comment-enabled sites with author logins. Anything that hands out a session after login.

The sensitivity math is deceptively steep, too. A hijacked association account exposes member data. A hijacked CMS author session exposes your website itself. And the person most likely to be working from café Wi-Fi is precisely your traveling staff and engaged member, not an abstraction.

The fix is not exotic: full-session TLS. Encryption from login through logout, every page, with cookies flagged ‘secure’ so they refuse to travel unencrypted. The engineering is well-understood configuration, not research. The obstacles have always been the objections, so let’s retire them at current prices.

The objections, aging out in real time

• ‘Certificates are expensive.’ They were. They are not. Basic TLS certificates now cost tens of dollars a year, and the industry direction is cheaper still. This objection is running on 2005 pricing.

• ‘Encryption is slow.’ The performance tax is real and small. Measured single-digit percentages on modern hardware, shrinking with every server generation. Gmail’s January move to default-on HTTPS at planetary scale settled the practicability argument in public. For institutional traffic volumes, this is a rounding error hiding behind an anecdote.

• ‘Mixed content is a mess.’ The honest one. Pages served over HTTPS must load their assets over HTTPS too, or browsers complain. Cleanup on an older site (hard-coded HTTP asset links, third-party embeds) is genuine, tedious, finite work. We have now scoped it for several client portals. Days, not months, and the audit doubles as the asset-hygiene pass most sites owe themselves anyway.

This week’s stopgaps, while the migration schedules

Because full-session TLS is a planning-cycle item and Firesheep is in the wild now, the interim measures worth taking this week.

For your organization: brief traveling staff plainly. Open Wi-Fi means assume observation. The office VPN, where one exists, encrypts everything and is the immediate answer for anyone administering the website from a coffee shop. CMS author sessions are exactly the hijacking prize worth the most. Where a VPN does not exist, tethering to a phone’s cellular connection beats café Wi-Fi for anything logged-in.

For your members and users: nothing you can email will fix architecture, so resist the security-theater notice. The fix is yours to ship, and the honest move is to ship it rather than advise around it.

For your own browsing: the HTTPS-forcing browser extensions now circulating do useful work on sites that offer encryption but do not default to it. A personal mitigation worth installing, and a preview of the browser-side pressure we expect to grow.

And one diagnostic worth five minutes. Log into your own site from a laptop while watching for the padlock. If it vanishes after the login page, you have just run the audit that matters, and this post’s remaining sections are your work order.

The migration, and the direction it anticipates

Practical sequencing for site owners. Inventory what runs sessions: every login on the site, the sprawl audit again. Prioritize by sensitivity and audience mobility. Then per property: obtain certificates, configure full-session TLS with secure cookie flags, sweep mixed content, and verify with the browser tools that now make verification visible.

Put it in the next planning cycle deliberately rather than the next incident reactively, because the direction of travel is unambiguous. Gmail went default-encrypted in January. The big social platforms are under public pressure this month to follow. And we would put the trajectory in writing: encrypted-by-default is where the web is heading, for everything, and sites that arrive early will simply skip a future scramble.

For the prediction file: we expect ‘HTTPS everywhere’ to move from activist slogan to mainstream default within a few years, with search engines and browsers eventually adding their own incentives. Check back.

A closing word of appreciation for the genre, uncomfortable as it is. Firesheep joins a lineage of demonstrations that moved industries where advisories could not. Nobody enjoys security-by-embarrassment, and reasonable people are debating the ethics this week. But the vulnerability was fifteen years old, universally known, and priced at zero until a sidebar full of sheep made it legible to every executive with a laptop and a café habit.

Legibility is what actually moves budgets. The assignment is now clear: full-session encryption for anything with a login. The sooner it ships, the cheaper the lesson.