Eric Butler writes about security and mobile software, including Firesheep, Android tools, a transit card reader, and Play Store privacy.
HN cites Firesheep as the tool that pushed the industry to adopt HTTPS, and links his Play Store privacy post on sharing user data.
Not the OP but I think I might be able to help.
>> I think you're claiming that CAs can present your certs to random clients? This might be an indictment against the DNS system, which directs the clients to an IP address of its choosing, but if the client makes it to your server, your server chooses which cert to present to the client.
Here I am fairly confident that he is talking about a situation in which a CA signs a key for your domain and gives it to someone else (NSA/GCHQ) and they preform a MITM attack on a user like this:
Client -> Fake key for yourdomain.com provided by MITM proxy server -> decrypt data then encrypt with real key for yourdomain.com -> Your Server
CA's have been compromised before [0] (and I'd be willing to bet there are quite a few more incidents that they have swept under the rug) and so there has been discussion on what happens when you can sign a certificate for any domain. I believe this is what the OP is referencing.
>> Again with the strained analogy. Who's the dog? What does the mega lock represent?
I agree with you, this one is harder to understand. As I see it the mega lock = CA's private keys, dog = CA's. When he talks about the dog being tempted by a steak he is referencing the rumors that the NSA/GCHQ have back room agreements (steak) with CA's or have simply hacked the CA's and taken what they needed (for this I would say something like "the dog was asleep").
>> No, it doesn't mean what it did yesterday because of a bug in an…
> Why the heck people will continuously give away private information with no safeguard that information will ever remain private in the future, I will never understand
I do understand. People don't evaluate risk correctly. They are fundamentally irrational in all sorts of strange ways. Humans have a strong optimism bias[1] so even if they know something bad might happen to some people they know that will happen to other people, not to them. The benefit, even when it's tiny in comparison, they get right now.
Thanks to the fascinating new neuroscience around cognitive biases you too can go from thinking you'll never understand to despairing for the future of humanity!
At least now someone will probably do a Firesheep-esque [2] "look how creepy you can be" app that will get some attention. And that kind of attention is exactly the antidote to the optimism bias as well as many of the others at play here, it's actually very effective because it plays into other well known biases [3][4]
[1] http://en.wikipedia.org/wiki/Optimism_bias
[2] http://codebutler.com/firesheep/
[3] http://en.wikipedia.org/wiki/Attentional_bias
[4] http://en.wikipedia.org/wiki/Availability_heuristic
The counter-argument here is Popcorn Time (https://en.wikipedia.org/wiki/Popcorn_Time) which brings together search and bittorrent with a nice UI and makes piracy a bit too easy.
Or Firesheep (https://codebutler.com/2010/10/24/firesheep/) which made impersonating someone’s facebook account a breeze by sniffing their credentials which were sent in clear text (eg. on cafe wifi) and showing them in a UI and made stealing credentials a bit too easy, leading to wide calls for broad adoption of https everywhere.
Or Dropbox, which the nerds derided as pointless “because I can build my own”.
It’s fuzzy and individual, but there’s a qualitative difference - a tipping point - where making things too easy can be irresponsible. Your tipping point just happens to be higher than the average.
'Packet-snooping attacks are also "extremely rare"'
I think they're pretty common, even for fun and recreation (http://codebutler.com/firesheep). I know I could start reading people's emails in Starbucks with what's on my laptop now and the knowledge in my head, but if I wanted to mount a MITM attack I would need to do some research.
Latest firefox tells me that site http://codebutler.github.io/firesheep/ is unsecure
got there from official blog https://codebutler.com/2010/10/24/firesheep/
Maybe force https when requesting http ?
https://drive.google.com/file/d/1maSpqYfFoBoCyao14VKzLKPMlm9H9k6w/view?usp=drivesdk
My thoughts on this: http://codebutler.com/2013/02/13/play-store-privacy/
Although there is a legitimate reason for sharing this information (sales taxes), it is not clearly explained to users or developers and goes against reasonable expectations.