Firesheep - Sidejack cookies

A Firefox plugin called Firesheep was released this week that makes it easy to capture and exploit other user's HTTP session cookies sent over insecure connections on untrusted networks. This vulnerability makes it possible to login to other people's accounts on a variety of services by spying on network traffic and extracting those cookies. Wikipedia has a decent article on this technique: Session Hijacking.

Basically every user with firefox and firesheep plug-in installed and a laptop can sit on every cafe shop, restaurant or even gas station, connect to the nearest hotspot and grab your credentials for various sites that require login in a non-secure way (hence using http instead of https). Unlike sidejack and similar programs this plug-in allow, in very simple way, to retrieve this information and even to take control on chats and IM programs with a ease of use.

Using Https will solve this issue and prevent from malicious users to capture and exploit this information but unfortunately implementing SSL/TLS in web sites require more CPU and resources from the servers and this without mention the need for signed digital certificates.

One more way to prevent this issue depends on the WiFi/Hotspot provider, a lot of places (hotels, gas stations, cafe shops, lounges etc.) that provide WiFi access or hotspot services relay on a simple WiFi router which they had bought or get through their ISP and by that implement insecure and unmanageable wireless access and this without mention the illegal problem while providing free access to the internet!

Companies which provide in a professional way and Hotspot or WiFi is their main business will probably provide this kind of service in much more responsible way and by that will implement, with their equipment, a feature called PSPF which stands for Public Secure Packet Forwarding which cause Layer-2 isolation between all wireless clients and by that prevent from users to see each other on the same hotspot!

So even to provide a simple service like wireless internet access should be taken more seriously and in much more responsible way then a lot of places doing it today.