Firesheep

Firesheep is a security-focused software tool released in 2010 by developer Eric Butler. It takes the form of an extension for the Firefox web browser and was designed as a demonstration of how session cookies on unsecured networks can be enough to impersonate other users on certain websites. By monitoring traffic on a shared, unencrypted wireless network, Firesheep could identify and steal session cookies from sites that relied on cookie-based authentication, allowing an attacker to access those users’ accounts without needing their passwords.

The project drew significant attention for its accessible interface and the immediacy of its demonstrations, showing how easily account takeover could occur on open Wi‑Fi networks. Its existence highlighted the vulnerability of HTTP-based communications and the insecure handling of session identifiers. In the wake of Firesheep, many online services began to move toward encryption by default, adopting HTTPS for login and session management, and implementing protective cookie attributes such as Secure and HttpOnly, as well as broader measures like HTTP Strict Transport Security to force secure connections.

Impact and legacy include a broader industry shift toward ubiquitous encryption and heightened user awareness of network security on public Wi‑Fi. The release helped catalyze initiatives such as the HTTPS Everywhere project and encouraged browsers and services to default to secured connections. While useful as an educational tool, Firesheep also prompted discussions about ethical disclosure and responsible use of security research, given the potential for misuse on real user accounts.

See also: Session hijacking, HTTPS Everywhere, Network security.