Hide that security I cannot bear to see

Every time it's revealed that a widely used application or service on the Internet doesn't use SSL, there's a wide range of emotions in the security community, from indifference (users just have to use protected networks) to panic (everything should be mega-encrypted everywhere, I'm going to hide in my basement).

Setting aside the weaknesses in SSL (actually, nobody should be using SSL, we should all be on TLS, but oh well…), every service that exchanges information that needs protecting should use SSL. The advantage of SSL is end-to-end encryption, because we only control a small segment of the network and nothing stops a malicious person from tampering with DNS servers or listening in between the client and the server (once the communication leaves the network under our control, anything goes when it comes to manipulating the information).

There is no such thing as a secure network. All sensitive communications must go through an encrypted tunnel between the client and the server. For now, SSL/TLS is the best means at our disposal to protect our communications, despite the weaknesses in the protocol. We also have to consider that information sent over the air (cellular, WiFi or other) can be recorded by anyone close enough to the signal (it's possible to listen to a signal from several hundred meters away and in some cases from several tens of kilometers… so close enough is a relative notion ;-)). Once the recording is made, the person has all the time in the world to break the encryption and get the content. In a context like this, the only defense is encryption that can hold out at least as long as the value of the information being carried. To better protect wireless communications, it's best to use two encrypted tunnels. The first between the wireless device and its base station (WPA2, KASUMI, etc.) and the second between the client and the server. That way, if a communication is recorded, it will be doubly hard to get the content and often not worth it compared to the value of the content. Needless to say, using SSL lets you use a hostile network (the Internet is considered a hostile network, right?) without the information being accessible to some big nosy parker.

The uproar caused by Firesheep was enough for Facebook, Google and Twitter to gradually enable SSL across their services. As security professionals, we should use our knowledge to push providers to put security measures in place and push users to drop services that don't adequately protect their information. Despite all the education we can provide, the convenience of open WiFi will always take precedence over good security practices (at a Blackhat I saw people updating their Facebook profile or checking their email on Gmail, back when SSL wasn't widely deployed on those two services).

Security must be transparent to the user no matter what they do, just as a car's safety components work even if the driver is irresponsible.