Twitter goes secure - say goodbye to Firesheep with "Always use HTTPS" option

[Jack]

Good news on the social networking security front is that Twitter has finally got its act together to offer an Always use HTTPS option.

If you turn on this option, all of your personalised interaction with Twitter will be encrypted - not only while you are logging in, but also while you are posting tweets.

A lot of people fail to recognise the value of using HTTPS on Twitter. As long as your username and password are sent over HTTPS, so no-one can sniff them out of the ether, who cares if your tweets go over plain HTTP? After all, a tweet is meant to be public.

The problem is that once you have logged in, Twitter sends your browser a session cookie. This is a one-time secret. It is unique to your account and the current session.

Because your browser retransmits this session cookie in all future requests to the Twitter site, Twitter can see that it's you coming back for more. So you don't need to put in your username and password for every single tweet you send. You login once, and the session cookie identifies you for the rest of the current session.

Unfortunately, if you login to Twitter over unencrypted WiFi - e.g. at a coffee shop or an airport lounge - then anyone who can sniff your session cookie can pretend to be you. That means they can post tweets as you. And you don't want that. (It happened to Mr Demi Moore, a.k.a. Ashton Kutcher, recently, no doubt to his considerable embarrassment.)

More details - link

 

[bogdan]

This is good news.

 

[jamescv7]

Definitely they need to implement it.

 

[Ink]

This is worth mentioning. At least it looks like they are trying to improve upon it. Compared to Facebook, it kept telling me to switch back to normal HTTP. :grrrrrr:

Why wouldn't I check Always use HTTPS?

• We encourage you to enable Always use HTTPS in your Settings.
• Some users may find Twitter over HTTPS slightly slower than plain old HTTP, especially if using an Internet connection that’s already slow. We're working to make Twitter just as fast on HTTPS as it is on HTTP.
• Sometimes, when you are accessing Twitter over HTTPS, opening the details pane to view an image or video will cause a browser warning about mixed content. We're working on reducing the number of these errors as well.

How to Enable HTTPS (via Twitter Help Center)