Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?

If you access http://www.facebook.com/, in the top right side there is the login section. You can enter your credentials there and click "Log In".

My URL is on http:// though (!?). Is the login safe?

share|improve this question
2  
See also: security.stackexchange.com/questions/7974/… –  bstpierre Nov 5 '11 at 23:52
add comment

marked as duplicate by Hendrik Brummermann Nov 6 '11 at 11:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3 Answers

the details of the form is:

<form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input name="charset_test" value="€,´,€,´,水,Д,Є" type="hidden">

note the https in the action this means that the submit will happen over https regardless if the current page is http or https

however this does not mean that the original page wasn't modified in transit to add a script that might hijack the credentials and send it to a attacker

share|improve this answer
add comment

The real answer is 'it depends'

Using http means your login could be picked up by an attacker, so the recommendation is to ALWAYS use https.

share|improve this answer
add comment

Your login is as safe as HTTP ever is, which is to say your login information can be intercepted unencrypted.

The solution is to use facebook's HTTPS login. This article explains more about the HTTPS login for facebook and how to set your facebook account to always use HTTPS.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.