Since When Are Hacker Tools Covered By Freedom Of Speech?

There’s been an interesting follow-up to the Firesheep incident, in which an attack tool was released which allows “sidejacking” of Firefox sessions.

Eric Butler and Ian Gallagher created the extension to draw attention to the risky practice whereby many sites do not encrypt cookies. With Firesheep installed, a user could potentially capture cookies from other users of an open Wi-Fi network, and use them to hijack their sessions at supposedly secure sites such as Facebook and Twitter.

Sites should just get more secure?

The answer to this is for sites to get secure, and use HTTPS or SSL. This is something that should be happening anyway, but the existence of a sidejacking tool just increased the urgency of the job, and Butler and Gallagher are pleased with themselves.

But they seem to have a strange view of the inherent value of Firesheep.

Microsoft has updated its malware database to label Firesheep as a potential threat, which of course, from the point of view of the system it is installed on, is untrue. Firesheep does not actually harm the system it runs on – but it can be used to harm other systems.

So Microsoft is removing temptation rather than danger – and the Firesheep authors don’t like it.

“Censorship does not offer a solution to these underlying issues,” said Cutler in his blog, “and will only cause further problems. For many people, code is a form of speech, and the freedom of speech must remain protected. If Microsoft wants to improve security with censorship, it would be more appropriate to block the insecure websites that are exposing user information in the first place.”

Code and free speech

Seems to me it’s pretty sensible for Microsoft to offer IT people a way to remove this tool from the systems they look after – as their company might be responsible for any misbehaviour by staff using it.

The right to free speech doesn’t extend to inciting criminal action, or providing tools to help break the law. Cutler claims there are plenty of legitimate uses of Firesheep – though he doesn’t provide an actual list. We know that sidejacking is possible, and it doesn’t need to be checked more than once.

Sophos’ Paul Ducklin pointed out in a blog, the original Firesheep tool somewhat over-achieved if its aim was to increase awareness of a security risk.

“Just because you can write code to prove a point doesn’t mean you have to release it,” said Ducklin. “If you do release it, you don’t have to package it with a one-click install and a use-it-without-understanding-it GUI.”