Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?

If you access, in the top right side there is the login section. You can enter your credentials there and click "Log In".

My URL is on http:// though (!?). Is the login safe?

share|improve this question

marked as duplicate by Hendrik Brummermann Nov 6 '11 at 11:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

See also:… – bstpierre Nov 5 '11 at 23:52

the details of the form is:

<form method="POST" action="" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input name="charset_test" value="€,´,€,´,水,Д,Є" type="hidden">

note the https in the action this means that the submit will happen over https regardless if the current page is http or https

however this does not mean that the original page wasn't modified in transit to add a script that might hijack the credentials and send it to a attacker

share|improve this answer

The real answer is 'it depends'

Using http means your login could be picked up by an attacker, so the recommendation is to ALWAYS use https.

share|improve this answer

Your login is as safe as HTTP ever is, which is to say your login information can be intercepted unencrypted.

The solution is to use facebook's HTTPS login. This article explains more about the HTTPS login for facebook and how to set your facebook account to always use HTTPS.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.