Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I go to, I am not redirected to If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? How is Facebook managing its login?

share|improve this question

migrated from Oct 8 '11 at 17:38

This question came from our site for software developers, mathematicians and others interested in cryptography.

due to this wrong implementation of SSL, Facebook and several other sites are vulnerable to SSL-stripping ( ) &/or SideJacking ( ) attack – AbhishekKr Oct 11 '11 at 9:41

No, it is not secure to enter your username and password on

The target of the login-form points to an https URL, so a passive attacker cannot read your password:

<form method="POST" action=""

But an attacker, who can modify the data stream, can manipulate html code which contains the login form. He can modify the target url or add some javascript code that sends a copy of the username and password to his own server.

Furthermore after logging in, Facebook sends the session cookie over an http connection. This allows even an passive attacker to act in your name. This is not a theoretical attack, there is a tool called Firesheep that is extremly easy to use.

To prevent the first risk, always use to login. There is a browser extension called https everywhere which does this for you and even stays at https which prevent the Firesheep style attacks, too.

share|improve this answer
Especially as with such a https on POST there is no way to detect a MITM SSL stripping attack until it's too late, even if one knows what to look for. – ewanm89 Oct 8 '11 at 20:08
so how does SSL help in this environment? Is it that the password is encripted or what is the benefit? – Ryan Oct 9 '11 at 0:32
SSL protects you against a passive attacker, that is, someone who can snoop/log your traffic but not redirect, modify, or hijack it. – David Schwartz Oct 9 '11 at 9:30

Only log-in via https:// is secure - and NOT http:// which at this time does not auto-redirect to the secure site.

Because the target of the log-in form is an https URL, as given by the source code, the form data could not be read via passive attack, and in that sense is safe. But an active attack via data stream modification - which could enable a hacker's injection of malicious code to steal the username and password entered - could be easily done.

Subsequent data in the session cookie is additionally sent through an http connection, which enables passive attackers to act in one's name even without having stolen the log-in data from the form on the front page. The proof-of-concept extension Firesheep, written by developer Eric Butler for Firefox, demonstrates how this is possible. Lifehacker has written more about the need for SSL encryption in this regard.

To deter such attacks, in Facebook, one may simply edit one's account settings, select Account Security, and tick the checkbox to enable HTTPS, under the Secure Browsing header. With this option, certain pages - notably, some Facebook applications that have not yet been HTTPS-enabled - may not function properly; however, the sacrifice of that lost functionality could be made for the sake of account security.

Additionally, there are web browser extensions available to automatically enable HTTPS encryption, whenever possible - not only for Facebook, but for all web sites. The Electronic Frontier Foundation (EFF) and the Tor Project have made an extension called HTTPS Everywhere which is available for Firefox and Google Chrome. Other similar extensions may be available for your browser of choice.

share|improve this answer

If you go to you will log in using SSL. Yes it would be good if facebook would redirect, but they don't yet.

You can do it yourself by going directly to the https version of the page, or use HTTPSEverywhere which will help by pushing you to the https page for many common sites, including facebook.

share|improve this answer
I'm wondering why they don't do it automatically. Oo – recluze Dec 20 '12 at 15:15

protected by Jeff Ferland Nov 2 '12 at 21:07

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.