2 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

TL;DR:

Whether or not your Facebook account in particular is vulnerable on an unencrypted Wi-Fi network greatly depends on how your Facebook app connects to the Facebook servers, even if it is using HTTPS.

Stil, there are other concerns to be mindful of on public Wi-Fi networks - encrypted or not. The best advice is to avoid these networks where possible. Use a VPN for your Internet access, if you must connect via public Wi-Fi.


If I connect to a non-password protected wireless signal and use the Facebook app on my mobile phone is it easy to get my Facebook password?

In short, the answer is it depends.

First, are you sure your phone's Facebook app uses HTTPS? If it doesn't, then your credentials and data are being sent in the clear.

Second, does the Facebook app use HTTPS only for login or does it handle all transactions through HTTPS? If the former, your session cookie is probably being sent in the clear - nearly equivalent to your login credentials.

Third, does the Facebook app support and use strong ciphers for its SSL/TLS connections? If not, the data may be as weakly protected (or worse) as if it was in the clear on a WEP network.

Fourth, does the Facebook app perform validation of Facebook's certificate before establishing a connection and will it give an error or refuse the connection if the certificate is invalid? If not, you could fall victim to a man-in-the-middle attack via an SSL proxy.

There are probably more weaknesses to consider that could still expose your Facebook credentials on an open wireless network, but the checklist above should help you avoid most attacks.

However, it should be noted that you are still putting your computer (or phone, tablet, etc.) in a more vulnerable state when connecting to any public network. At home, your first line of defense from untrusted systems is your router. Most routers have built-in firewalls, and their NAT functions also make attacks targeted at your system much more difficult. Once you've connected to a public network though, your system is locally reachable by every other system connected to that network - and, since the owners of these systems are total strangers, those systems are by nature untrusted.

That risk is essentially the same whether the public network is encrypted or not. Lack of encryption and/or authentication on the wireless network just means that the barrier for entry to it is effectively nil. I discuss this issue a little bit more in my answer regarding password-protected free Wi-Fi networksmy answer regarding password-protected free Wi-Fi networks.

It is still worth stating that just because you're on a local network of untrusted systems, it doesn't mean that those systems have unfettered access to yours. Your system's local firewall and other protections still have to be compromised for that to happen. However, it does mean that users of those untrusted systems can break into yours much easier than a random hacker on the Internet.

All of these concerns can be greatly mitigated with a VPN that tunnels all network activity to your trusted provider, and does not allow your system to accept connections from others on the local network.

TL;DR:

Whether or not your Facebook account in particular is vulnerable on an unencrypted Wi-Fi network greatly depends on how your Facebook app connects to the Facebook servers, even if it is using HTTPS.

Stil, there are other concerns to be mindful of on public Wi-Fi networks - encrypted or not. The best advice is to avoid these networks where possible. Use a VPN for your Internet access, if you must connect via public Wi-Fi.


If I connect to a non-password protected wireless signal and use the Facebook app on my mobile phone is it easy to get my Facebook password?

In short, the answer is it depends.

First, are you sure your phone's Facebook app uses HTTPS? If it doesn't, then your credentials and data are being sent in the clear.

Second, does the Facebook app use HTTPS only for login or does it handle all transactions through HTTPS? If the former, your session cookie is probably being sent in the clear - nearly equivalent to your login credentials.

Third, does the Facebook app support and use strong ciphers for its SSL/TLS connections? If not, the data may be as weakly protected (or worse) as if it was in the clear on a WEP network.

Fourth, does the Facebook app perform validation of Facebook's certificate before establishing a connection and will it give an error or refuse the connection if the certificate is invalid? If not, you could fall victim to a man-in-the-middle attack via an SSL proxy.

There are probably more weaknesses to consider that could still expose your Facebook credentials on an open wireless network, but the checklist above should help you avoid most attacks.

However, it should be noted that you are still putting your computer (or phone, tablet, etc.) in a more vulnerable state when connecting to any public network. At home, your first line of defense from untrusted systems is your router. Most routers have built-in firewalls, and their NAT functions also make attacks targeted at your system much more difficult. Once you've connected to a public network though, your system is locally reachable by every other system connected to that network - and, since the owners of these systems are total strangers, those systems are by nature untrusted.

That risk is essentially the same whether the public network is encrypted or not. Lack of encryption and/or authentication on the wireless network just means that the barrier for entry to it is effectively nil. I discuss this issue a little bit more in my answer regarding password-protected free Wi-Fi networks.

It is still worth stating that just because you're on a local network of untrusted systems, it doesn't mean that those systems have unfettered access to yours. Your system's local firewall and other protections still have to be compromised for that to happen. However, it does mean that users of those untrusted systems can break into yours much easier than a random hacker on the Internet.

All of these concerns can be greatly mitigated with a VPN that tunnels all network activity to your trusted provider, and does not allow your system to accept connections from others on the local network.

TL;DR:

Whether or not your Facebook account in particular is vulnerable on an unencrypted Wi-Fi network greatly depends on how your Facebook app connects to the Facebook servers, even if it is using HTTPS.

Stil, there are other concerns to be mindful of on public Wi-Fi networks - encrypted or not. The best advice is to avoid these networks where possible. Use a VPN for your Internet access, if you must connect via public Wi-Fi.


If I connect to a non-password protected wireless signal and use the Facebook app on my mobile phone is it easy to get my Facebook password?

In short, the answer is it depends.

First, are you sure your phone's Facebook app uses HTTPS? If it doesn't, then your credentials and data are being sent in the clear.

Second, does the Facebook app use HTTPS only for login or does it handle all transactions through HTTPS? If the former, your session cookie is probably being sent in the clear - nearly equivalent to your login credentials.

Third, does the Facebook app support and use strong ciphers for its SSL/TLS connections? If not, the data may be as weakly protected (or worse) as if it was in the clear on a WEP network.

Fourth, does the Facebook app perform validation of Facebook's certificate before establishing a connection and will it give an error or refuse the connection if the certificate is invalid? If not, you could fall victim to a man-in-the-middle attack via an SSL proxy.

There are probably more weaknesses to consider that could still expose your Facebook credentials on an open wireless network, but the checklist above should help you avoid most attacks.

However, it should be noted that you are still putting your computer (or phone, tablet, etc.) in a more vulnerable state when connecting to any public network. At home, your first line of defense from untrusted systems is your router. Most routers have built-in firewalls, and their NAT functions also make attacks targeted at your system much more difficult. Once you've connected to a public network though, your system is locally reachable by every other system connected to that network - and, since the owners of these systems are total strangers, those systems are by nature untrusted.

That risk is essentially the same whether the public network is encrypted or not. Lack of encryption and/or authentication on the wireless network just means that the barrier for entry to it is effectively nil. I discuss this issue a little bit more in my answer regarding password-protected free Wi-Fi networks.

It is still worth stating that just because you're on a local network of untrusted systems, it doesn't mean that those systems have unfettered access to yours. Your system's local firewall and other protections still have to be compromised for that to happen. However, it does mean that users of those untrusted systems can break into yours much easier than a random hacker on the Internet.

All of these concerns can be greatly mitigated with a VPN that tunnels all network activity to your trusted provider, and does not allow your system to accept connections from others on the local network.

1
source | link

TL;DR:

Whether or not your Facebook account in particular is vulnerable on an unencrypted Wi-Fi network greatly depends on how your Facebook app connects to the Facebook servers, even if it is using HTTPS.

Stil, there are other concerns to be mindful of on public Wi-Fi networks - encrypted or not. The best advice is to avoid these networks where possible. Use a VPN for your Internet access, if you must connect via public Wi-Fi.


If I connect to a non-password protected wireless signal and use the Facebook app on my mobile phone is it easy to get my Facebook password?

In short, the answer is it depends.

First, are you sure your phone's Facebook app uses HTTPS? If it doesn't, then your credentials and data are being sent in the clear.

Second, does the Facebook app use HTTPS only for login or does it handle all transactions through HTTPS? If the former, your session cookie is probably being sent in the clear - nearly equivalent to your login credentials.

Third, does the Facebook app support and use strong ciphers for its SSL/TLS connections? If not, the data may be as weakly protected (or worse) as if it was in the clear on a WEP network.

Fourth, does the Facebook app perform validation of Facebook's certificate before establishing a connection and will it give an error or refuse the connection if the certificate is invalid? If not, you could fall victim to a man-in-the-middle attack via an SSL proxy.

There are probably more weaknesses to consider that could still expose your Facebook credentials on an open wireless network, but the checklist above should help you avoid most attacks.

However, it should be noted that you are still putting your computer (or phone, tablet, etc.) in a more vulnerable state when connecting to any public network. At home, your first line of defense from untrusted systems is your router. Most routers have built-in firewalls, and their NAT functions also make attacks targeted at your system much more difficult. Once you've connected to a public network though, your system is locally reachable by every other system connected to that network - and, since the owners of these systems are total strangers, those systems are by nature untrusted.

That risk is essentially the same whether the public network is encrypted or not. Lack of encryption and/or authentication on the wireless network just means that the barrier for entry to it is effectively nil. I discuss this issue a little bit more in my answer regarding password-protected free Wi-Fi networks.

It is still worth stating that just because you're on a local network of untrusted systems, it doesn't mean that those systems have unfettered access to yours. Your system's local firewall and other protections still have to be compromised for that to happen. However, it does mean that users of those untrusted systems can break into yours much easier than a random hacker on the Internet.

All of these concerns can be greatly mitigated with a VPN that tunnels all network activity to your trusted provider, and does not allow your system to accept connections from others on the local network.