Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy person quickly) can attacker by man-in-the-middle-attack send me a facebook page in http and see my cookie then use that cookie to use my account?

share|improve this question

2 Answers

up vote 4 down vote accepted

Not speaking for Facebook specifically, but in any decently configured Web server, the cookies sent over HTTPS are marked "secure" and the browser will not send them back to the server if not using HTTPS (from the browser point of view, if the name is the same but not the protocol, then it is not the same server).

Of course, a user who crazily clicks without paying attention... that's the root of all vulnerabilities.

share|improve this answer
but Thomas honestly when you for example surfing on facebook or any site, check address bar for every page ? we are professional and don't check, regular people for sure will not ... the question is if attacker MITM victim and victim have no HTTPSanywhere then why not attacker success ? – pier Oct 19 '12 at 18:08
for example you click on https:facebook.com/credit but i inject you http:blahblah.ws/com which have an inframe of http:facebook.com/profile/goodpicturesofanunimportantperson or just http facebook pages directly to you. then your browser send all data to that server over http – pier Oct 19 '12 at 18:16
1  
@pier: in that situation, my browser sees blahblah.ws and will NOT send the cookies which have been recorded for https://facebook.com/, regardless of how much, as a human user, I am convinced to interact with the true Facebook site or not. – Thomas Pornin Oct 19 '12 at 18:19
well if browser see http:facebook.com/profile/xxx then send data to facebook over http – pier Oct 19 '12 at 19:01
And yet the browser will NOT send to http://facebook.com/ a cookie which has been initially set by https://facebook.com/. The human user may not see the extra 's', but the browser minds it and takes care. – Thomas Pornin Oct 19 '12 at 19:13
show 2 more comments
up vote 1 down vote

No, this is not possible because Facebook uses HTTPS for everything. You can MITM Security.StackExchange.com and StackoverFlow.com and no one cares.

Other than an OWASP a9 violation, there are plenty of other vulnerablites that allow you to access a victom's account. XSS, CSRF, Insecure Direct Object Reference, SQL Injection... The list goes on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.