Facebook login on HTTP? [duplicate]

Question

Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?

If you access http://www.facebook.com/, in the top right side there is the login section. You can enter your credentials there and click "Log In".

My URL is on http:// though (!?). Is the login safe?

Answer 1

the details of the form is:

<form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input name="charset_test" value="€,´,€,´,水,Д,Є" type="hidden">

note the https in the action this means that the submit will happen over https regardless if the current page is http or https

however this does not mean that the original page wasn't modified in transit to add a script that might hijack the credentials and send it to a attacker

Answer 2

The real answer is 'it depends'

Using http means your login could be picked up by an attacker, so the recommendation is to ALWAYS use https.

Answer 3

Your login is as safe as HTTP ever is, which is to say your login information can be intercepted unencrypted.

The solution is to use facebook's HTTPS login. This article explains more about the HTTPS login for facebook and how to set your facebook account to always use HTTPS.