If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? How is Facebook managing its login?
migrated from crypto.stackexchange.com Oct 8 '11 at 17:38
No, it is not secure to enter your username and password on http://facebook.com.
The target of the login-form points to an https URL, so a passive attacker cannot read your password:
Furthermore after logging in, Facebook sends the session cookie over an http connection. This allows even an passive attacker to act in your name. This is not a theoretical attack, there is a tool called Firesheep that is extremly easy to use.
To prevent the first risk, always use https://facebook.com to login. There is a browser extension called https everywhere which does this for you and even stays at https which prevent the Firesheep style attacks, too.
If you go to https://facebook.com you will log in using SSL. Yes it would be good if facebook would redirect, but they don't yet.
You can do it yourself by going directly to the https version of the page, or use HTTPSEverywhere which will help by pushing you to the https page for many common sites, including facebook.
Only log-in via https:// facebook.com is secure - and NOT http:// facebook.com which, as you rightly pointed out, at this time does not auto-redirect to the secure site.
As rightly said, because the target of the log-in form is an https URL, as given by the source code, the form data could not be read via passive attack, and in that sense is safe. But an active attack via data stream modification - which could enable a hacker's injection of malicious code to steal the username and password entered - could be easily done.
Subsequent data in the session cookie is additionally sent through an http connection, which enables passive attackers to act in one's name even without having stolen the log-in data from the form on the front page. The proof-of-concept extension Firesheep, written by developer Eric Butler for Firefox, demonstrates how this is possible. Lifehacker has written more about the need for SSL encryption in this regard.
To deter such attacks, in Facebook, one may simply edit one's account settings, select Account Security, and tick the checkbox to enable HTTPS, under the Secure Browsing header. With this option, certain pages - notably, some Facebook applications that have not yet been HTTPS-enabled - may not function properly; however, the sacrifice of that lost functionality could be made for the sake of account security.
Additionally, there are web browser extensions available to automatically enable HTTPS encryption, whenever possible - not only for Facebook, but for all web sites. The Electronic Frontier Foundation (EFF) and the Tor Project have made a Firefox extension called HTTPS Everywhere. For Chrome, there is an extension called the KB SSL Enforcer. Other similar extensions may be available for your browser of choice.
protected by Jeff Ferland♦ Nov 2 '12 at 21:07
This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.