Hot answers tagged facebook
Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some ...
Images are available through a CDN. This promotes faster loading and lower system load. It's also rather crucial for anything that's marked as public content. Since users can still copy and reupload images (to Facebook or elsewhere), the value of preventing CDN access to a known URL is very low. The technical complexity to add ACL rules is not immense, but ...
Simply: yes, encrypt it. And don't store the encryption key in the database. The token is tied to your app, so an attacker might not be able to use it alone, but if they can breach your database and get your app secret too they can use the token. You'd have to encrypt the app secret and the user tokens.
Only top voted, non community-wiki answers of a minimum length are eligible