It is very easy to get someones password if they have checked "remember me" and gone out for a coffee.
By very easy I mean it requires almost no talent.
Long time back (even)I wrote a script to grab password and username using DOM and JavaScript.
By very easy I mean it requires almost no talent.
Long time back (even)I wrote a script to grab password and username using DOM and JavaScript.
But this doesn't should not be true for "remember me" cookies. Those just need some identifier.
At any rate, you still need "talent": to know where the person is, when they're going for coffee, ability to access their machine without bystanders asking questions, etc.
Isn't this rather huge news? Why did they do this sort of downgrading hackery when they could do a more elegant (and slightly more transparent) man in the middle?
B) Probably a lot of users prefer Mozilla, though it may defer to the system store on Windows anyway, I'm not sure.
C) For the same reasons it's a pain for FB to use https everywhere, it's a pain for Tunisia to set up SSL interception on their outbound connections. There are certainly off-the-shelf boxes which can do it though.
If you have access to a Windows machine, visit http://bit.ly/eWYRbA in IE then check your personal cert store for Agence Nationale de Certification Electronique