Introduction

Storytime

Once again, it’s time for a story. In October 2010, Eric Butler released a Firefox extension named Firesheep to highlight a huge, but under-recognized, problem. Firesheep allowed any user to watch the non-encrypted traffic on their local network, even hijack another user’s session. Firesheep exploited a type of man-in-the-middle attack: sidejacking. Sound scary? It should because it is. Let’s walk through an illustration to make a point.

Firesheep was an extension for the Firefox web browser that used a packet sniffer to intercept unencrypted session cookies ...