Thread by @ErrataRob

I used "sidejacking" for 10 years before I got tired of it, wrote a tool to make it obvious, and released it at BlackHat 2007.

https://twitter.com/WeldPond/status/1458920440651526150

"Sidejacking" was a variant of cookie hijacking, grabbing them by sniffing the network instead of by tricks within a webpage. Back then, websites would protect your login with SSL, but the rest of the session would not use SSL, and cookies would be sent in the clear.

It meant I could walk by any Starbucks with public WiFi and instantly access their Gmail, Yahoo Mail, or other webmail sessions. Or any active website connection, really.

Also, worked well with corporate WEP encrypted networks before WPA2.

Poor @dave_maynor got REALLY paranoid around me, knowing that I could access his Gmail at any time. The thing is that I wouldn't, and never did (without his permission and presence), but that didn't solve the paranoia.

Moments after getting email confirmation for Wayne Brady tickets, I mention to him that Wayne Brady is "a triple threat". It was actually @LawyerLiz who told me shortly before, but the timing with the email was so close it was hard to not think I was reading his email in realtime

Pfft. His email wasn't even worth reading anyway, full of Mandalorian slashfic.

This is the sort of joke I'd avoid making. Because what if his recent email exchanges were actually about the Mandalorian? Then I'd be in REAL trouble.