Firefox Extension Allows Anyone to Steal Logins over Insecure Networks

Really, you should never visit important web sites that require login or shop online while your computer is connected to an unsecured wifi hot spot.

...I installed a counter Firefox addon for this after hearing about it and it just forced TLS on certain web-sites-- and that produced errors in my browser, as some sites rejected the TLS connection outright.

But I did realize something, if you have the noscript addon installed, you don't need an additional addon to stop this. Simply by going into the options of noscript > Advanced > HTTPS, you can define which web-sites you want to force a SSL connection on and even have Firefox encrypt all the cookies you send over SSL for certain web-sites (in case you drop out of secure mode for some reason.)

It's more like what can these major web-sites do to protect their end users. Not enough sites offer encryption across the board.

Really, this is a new face to a old problem. The network we use now was designed over twenty years ago and it had the goal of open-ness in mind, not security.

SSL, TLS, certificates are nothing but patchwork to try to secure a system that was designed to be completely open and security-less.

The best thing you can do to protect your privacy when using a laptop in a public place is to use a VPN. If you don't want to pay for a VPN service, you can create a VPN server at home or set your home computer up for remote access.

Firesheep isn't even the half of it.. just an example made written by a skilled hacker to demonstrate one aspect of the vulnerabilities of public wifi.

slam said:

Yup, I heard about this, but there's also a counter firefox entension that prevents this. It's generally not a good idea to go on sites that require login through public unsecure networks anyway.

?

How then do you login to an Online Bank via the Internet.

Most Banks have decent security but to reach their sites you still have to use the public internet -- so I'm confused as to what you actually mean here about logging in via public unsecure networks -- after all isn't the Internet just one gigantic public Network.

Cheers
jimbo

So is there an extension you can install to counter this? Can other extension based browsers suffer from this as well?

Firefox is getting more and more insurecure.