Is Stack Overflow “secure”? Kind of...

http://www.troyhunt.com/2012/08/is-stack-overflow-secure-kind-of.html

by troyhunt • 14 years ago

71 19 14 years ago

bigiain• 14 years ago

The only clarification I'd make here is the distinction between "public wifi" and "unencrypted wifi". Some cafes I frequent have WPA2 secured networks with the SSID and password made freely available. I'm pretty sure that solves the Firesheep problem (I don't know for sure, but I'm reasonably confident that other people on the WPA2 network still can read my connection).

troyhunt• 14 years ago

That's a bit of an "it depends" situation though. There's a good answer on Super User about this: http://superuser.com/a/156969/4682

antihero• 14 years ago

You could still probably do a MITM attack using ARP poisoning or something of the like (IE redirect all traffic through one machine), if there is the ability to access other machines on the network.

omh• 14 years ago

I'm pretty sure that solves the Firesheep problem

With most WiFi encryption (basically except WPA2 Enterprise, which won't be in use in cafés) you can still receive the traffic as long as you see the initial handshake for the device connecting to the network. Sniffing software like Wireshark or Aircrack-NG can handle the decryption transparently.

Once you can see the traffic Firesheep or something like it will work in the same way as on an unencrypted network.

jessedhillon• 14 years ago

If this is a WPA2 shared-password setup then your traffic can be captured, dumped and decrypted with aircrack-ng. Firesheep may not work, but it's trivial to present cookies which match captured values.

rjzzleep2• 14 years ago

wow, it stuns me how people can write so much text for something so trivial. what's your point?

"i don't really care that the stackoverflow guys don't care because it doesn't really matter"

"i'll just post it here knowing that it won't help the average joe either, because he will never read or understand what i wrote"

who's the target audience for that post? if you're just explaining cookie theft ssl and openid to unknown audience by the example of stackoverflow. by all means write it in the first paragraph.

have some respect man

jaynate• 14 years ago

A little harsh. I think it's a good reminder for all of those new products and services being developed as we speak who can make this a priority now instead of having to layer it on later.

Would that fit your definition of a "call to action?"

I'm working on a side project now which uses a similar approach for security (delegate it). While I had already planned on making sure the app would be available over SSL, this was a good reminder of why.

The beautiful thing about the Internet and, indeed, free choice is that you could have stopped reading this article and moved on at any time.

rjzzleep2• 14 years ago

but it's not. the way i see it, op seems to have a rather big audience. but it rather reads like a highschool it essay. see if he had been in any way related to stackoverflow the message would've been ok, but too long.

"A little harsh. I think it's a good reminder for all of those new products and services being developed as we speak who can make this a priority now instead of having to layer it on later."

i hope you see the irony. you're right with what you say. but it would be even better of a place if people would actually try to create something of value, both positive or negative. but this is somewhere in between.

something with more value and much more precise is the stackoverflow link someone posted in this thread

http://meta.stackoverflow.com/questions/69171/why-doesnt-the...

sams99• 14 years ago

You can track the latest on this issue at: http://meta.stackoverflow.com/questions/69171/why-doesnt-the...

PakG12• 14 years ago

Via that link, I found this answer. http://meta.stackoverflow.com/a/69177

Out of curiosity, does anyone know how much traffic I'd have to hit before my "$20 SSL certificate" started being a chokepoint and bottleneck? If I were able to hit stackoverflow levels of traffic, I'm sure I'd be able to figure out a way to afford it (although maybe even they haven't yet), but I'm curious at lower levels of traffic if I should still worry.

michaelmior2• 14 years ago

The price of the certificate is irrelevant. The issue is that encryption and decryption eats CPU cycles, so running all traffic via HTTPS on a busy site is going to require significantly more processing power.

EvanAnderson2• 14 years ago

I'm a little disappointed with the answers from Zypher (one of the Stack Exchange sysadmins) and Jeff Atwood. Particularly troublesome is Jeff's statement "If you have a 'man in the middle' then there are deeper problems, like, you're using a compromised network." I'd argue that it's appropriate, from a security architecture perspective, to treat the entire Internet as a "compromised network".

Admittedly, my use-case for the Stack Exchange sites (specifically Server Fault) is a little different than most people's and I'm a lot more worried about "theft" of my "identity" there than most people would be. Still, though, I'd like to see the answer revisited in light of mid-2012 technology / costs. I suppose I should go post something over there...

kijin• 14 years ago

> The only instance in which I’d really urge caution is that public Wi-Fi scenario, particularly when you’re in an environment surrounded by other people with technical know-how.

The first condition is satisfied whenever you're in a coffee shop, airport, hotel, university campus, wifi-enabled public transportation ... i.e. pretty much everywhere except your own home and possibly your workplace. Some of these places use WPA, but most I've seen don't use any encryption. The second condition shouldn't be too easy to satisfy, either, particularly when you're in a place like the Bay Area.

Blacklisting isn't good enough when it comes to security, we all know that. So the advice should rather be: Anyone can steal your Stack Overflow session at any time whatsoever, unless you're using an Ethernet cable or your own secure Wi-Fi. (Even then, your ISP or a three-letter government agency could see your traffic, but they're probably more interested in watching you than impersonating you.)

EvanAnderson2• 14 years ago

I don't think it's a safe assumption that the only parties upstream from you are ISPs and TLA government agencies. If script kiddies are hacking major corporations I think it's a safe bet that ISPs are vulnerable, too. Your Stack Overflow "identity" may not be of great value, but it's worth keeping in mind that any cleartext traffic is vulnerable. Being cognizant of sending data over the Internet in cleartext is a good thing, to me.

mcgwiz• 14 years ago

Not sure why the author goes through pains not to call out the fact that SO is not secure in the layman sense. In general, if a service requires users to understand the lack of SSL and to take security into their own hands, the service is not secure. Worse than that, SO does not even explicitly communicate this to users.

Also, the author omits a crucial workaround. When on a public network, communication can be made secure if routed through an encrypted tunnel to a known-secure network, such as with a properly configured VPN.

Is Stack Overflow “secure”? Kind of...

Related Stories