Well, it's a little more spooky than that.

For your Halloween reading pleasure, here's a bit more elaboration on the actual vulnerability that Firesheep exploits. I'm afraid it's scarier than I intimated below, because it's not so much login pages that aren't encrypted (although they remain just as dangerous), but sites designed to use cookies for session authentication-something I wasn't aware Web designers were still doing-which then stupidly send those cookies back and forth in the clear-even after a secure login on a properly HTTPS-encrypted page.

It's these particular inadvertently unencrypted cookies Firesheep grabs, and as has been pointed out elsewhere, limiting your Wi-Fi use to locked-down routers will only reduce your risk, not eliminate it, since you're of course still vulnerable to such "sidejacking" beyond the router-or even still on the LAN side of it in some cases. The only true solution for sites that still insist on tossing cookies around like this would be to encrypt all their pages that do so-which is precisely what Firesheep's author wants. He merely latched onto open Wi-Fi because it's the easiest venue for demonstrating the vulnerability.

So...will these site owners invest in more SSL certificates and the infrastructure and bandwidth to support them, or better yet leave cookies and the 1990s mindset they represent behind, now that the "cookies are safe" myth has been totally busted?

Stay tuned. And in the meantime I'd limit my use of the affected sites until each of them decides on a course of action and takes it.