Firesheep was a Firefox extension that demonstrated how an exposed session cookie could let someone impersonate a logged-in web user. It did not magically guess passwords: the attack depended on a service sending the session cookie over unencrypted HTTP and an attacker being able to observe that traffic on the same network.
What Firesheep demonstrated
Released in 2010, Firesheep made HTTP session hijacking visible and easy to demonstrate. Its project described it as a Firefox extension for demonstrating session hijacking; its developers’ Toorcon 12 presentation also called the technique “sidejacking.” The point was not that the extension could break every website, but that sites which protected only the login step could leave the authenticated session exposed afterward.
When a user logs in, a service commonly sends the browser a session cookie. Later requests include that cookie so the service knows which signed-in session is making them. If the cookie is sent without encryption, someone who captures and reuses it may be able to act as that user without knowing the account password. The Canadian Office of the Privacy Commissioner explains the capture-and-reuse risk in its archived explanation of Firesheep.
How the session sidejacking attack worked
- A user signs in. The service authenticates the person and issues a session cookie.
- The browser makes later requests. It sends the cookie to identify the already-authenticated session.
- An attacker observes unencrypted traffic. If the cookie travels over HTTP on a network the attacker can monitor, it may be captured.
- The captured cookie is reused. If the service accepts the token, it can treat the attacker’s request as part of the victim’s session.
Those conditions matter. The attacker needs access to the relevant traffic, the cookie must be exposed without encryption, and the service must accept the captured session token. Firesheep did not mean that everyone using public Wi-Fi was automatically compromised, nor that it defeated a correctly protected HTTPS session.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
Why HTTPS just for login was not enough
A site could encrypt the username and password submission with HTTPS yet switch back to HTTP after login. That left subsequent requests—and potentially the session cookie—exposed. The important protection is HTTPS throughout the authenticated session, not simply a secure sign-in page.
Mozilla’s October 27, 2010 security guidance urged site operators to serve the rest of the site over HTTPS and use the Strict-Transport-Security (HSTS) response header. HSTS tells a browser to use secure connections for the site and helps prevent an insecure HTTP downgrade. Mozilla’s post said HSTS was built into Firefox 4 at that time; that is historical browser guidance, not a statement about current compatibility. Mozilla wrote, “We recommend that website authors make use of this header.” See the Mozilla Security Blog’s 2010 guidance.
Rank #2
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notary Publics' confidential information
- GLBA and HIPAA require non-disclosure policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
What users and website operators should take from it
For users
- Look for HTTPS throughout the signed-in parts of a site, not only on its login page. The Canadian privacy commissioner also advised users to look for HTTPS throughout.
- Remember that a session cookie can function like a temporary key to an already-authenticated account. Protecting a password alone does not protect a session if the service exposes that cookie.
- Do not treat a VPN, router, or browser add-on as a substitute for the service protecting authenticated traffic. The documented mitigation is configuration by the website operator.
For website operators
- Serve all authenticated pages and requests over HTTPS.
- Set HSTS so browsers are instructed to use HTTPS rather than accepting a downgrade to HTTP.
- Do not expose session identifiers in unencrypted traffic.
How services responded in 2010
Mozilla framed Firesheep as evidence that websites needed to configure secure connections. GitHub’s October 27, 2010 post said the service had been susceptible and had taken protective measures; it also warned that users would be prompted to log in again while GitHub moved them to a more secure connection. That is a historical response, not evidence that GitHub remains vulnerable. Read GitHub’s 2010 account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Firesheep’s historical status and requirements
Firesheep is a historical tool, and its original requirements should not be read as current support information. The project page listed Firefox 3.6.12 or newer in 32-bit form, said Firefox 4 beta was unsupported, and listed Mac OS X 10.5 or newer on Intel and Windows XP or newer with WinPcap. It said Linux was not supported at the time. The repository described its development branch as work in progress and pointed to a stable branch for Firefox 3.x. These details describe the 2010-era release, not a currently maintained or compatible extension. See the Firesheep project page and its code repository.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Used Book in Good Condition
Firesheep’s reach was widely discussed at the time, but one commonly repeated figure needs attribution: Zscaler claimed on November 8, 2010, that the extension had been downloaded over 100,000 times in its first 24 hours. That is a company press-release claim, not an independently audited count. See Zscaler’s announcement.
Quick Recap
Rank #4
- 【WIDELY APPLICABLE】Peslv Surface Book magnetic privacy filter designed for Surface laptop, Compatible with 13.5" Microsoft Surface Book 3/2/1, Removable design and comes with a Surface laptop privacy screen protector storage clip that can be taken and used as needed, perfect for various occasions where screen privacy needs to be protected.Like offices, airports, cafes, trains, etc.
- 【NEW 3RD GENERATION】 We have innovated the installation method of the surface Book privacy film, using the bottom magnetic suction and the top nano suction installation method, the installation will become super easy, It's done in a second... The removable, washable design will allow the surface book 13.5 inch privacy screen to be reused and look new every day.
- 【STUNNING PRIVACY PROTECTION】To ensure that only the +-28° angle directly in front of the screen is visible, we have corrected the angle of the Surface book 3 privacy screen more than 5000 times to ensure that other angles of view are not visible. By getting the Peslv magnetic privacy screen Surface book 13.5 inches, you can ensure that your computer data privacy is not peeked.
- 【PROTECT SCREEN ALSO EYES】The high-quality materials imported from Japan and the process imported from Germany have greatly improved the performance of the magnetic privacy screen Surface book 2 High-quality filter layer that can reduce 95% of blue light and 92% of UV light. Matte surface, anti-glare, effectively intercepts 95% of the reflected light. Anti-scratch layer to avoid scratches from daily use. Protect your screen while protecting your eyesight.
- 【HIGH-GRADE MATERIALS AND CRAFTSMANSHIP】Modeled in accordance with the real screen size 1:1 restoration, the size is perfectly matched. The light-transmitting layer with advanced material has a super high light transmission rate. So all this will make you have a super high-definition Surface book 2 privacy screen with unparalleled picture quality close to the original picture.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
