I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? Or, how such a thing is possible ? I thought facebook, like google, is always https. Also, this happened when I have installed https everywhere plugin for mozilla.
-
1Throttling should not cause this. Blocking the HTTPS channel might cause a fall-back to HTTP I suppose but this would seem unlikely. I would look to monitor the traffic and inspect the page before and after the transition. There may be a bug in FB that means a link is sometimes embedded pointing to the wrong URL though this would be surprising and doesn't explain the failure of https everywhere.– Andy BouraCommented Aug 28, 2014 at 10:22
-
5Could you elaborate on the workflow? Where do you see http vs https? Is it when viewing a profile, pictures, apps, etc?– Matthew PetersCommented Aug 28, 2014 at 14:45
-
1Somewhere in FB settings there is (or at least used to be) a https setting - try finding it and enabling it. Also check your bookmarks/history - you may be going to old http entries by mistake. I don't know why https everywhere wouldn't rewrite those, though...– HairyFotrCommented Aug 31, 2014 at 11:33
-
3Also, FB uses HSTS (if I recall correctly), so your browser should not allow "bare" http connections– joozekCommented Sep 2, 2014 at 11:54
-
2SSL Strip can't drop you down from https, it only prevents redirects from http to https.– CodesInChaosCommented Sep 17, 2014 at 10:11
|
Show 6 more comments
5 Answers
Not all apps in Facebook support HTTPS, so if you're playing games on Facebook or use other third party apps you will get a notification that these apps are only accessible via HTTP. When you proceed your connection will degrade to HTTP.
Facebook uses HTTP Strict Transport Security (HSTS) (see the screenshot below). It simply means your browser would never make HTTP connection to Facebook even if someone is trying to downgrade your connection to HTTP. Most browsers (Chrome, Firefox, IE) are now supporting this feature. The caveat is in the first time you need to make a 'secure' connection to Facebook. This way the browser will see HSTS and remember, for the given number of seconds, that the current domain should only be contacted over HTTPS. Facebook HSTS header directs browser to use HTTPS connection for 180 days.
Alternatively, if you use Chrome, it has a preloaded list of HSTS website. This means your browser will make HTTPS connection to these website out-of-the-box. So the browser does not need to wait for HSTS header. At the time of writing, the list includes all Facebook sub-domains.
So back to your question, I can think of a few possibilities:
- You are using a browser version that does not have a support for HSTS.
- Your browser has not seen and remembered HSTS.
- Each time you visit Facebook, you clean all your local cache, therefore, your browser would never remember to always use HSTS.
- You are using a Facebook App that is not part of Facebook domain and does not have HSTS.
- Malware infection that interfere with Facebook connections.
To validate this, get a latest version of Chrome and try to access Facebook. If the problem still exist, do the same thing using a different computer. This can give you a clue which possible is more likely.
Edit 1: Firefox also supports HSTS preloaded list
-
IE 11 also uses HSTS preload. However, bear in mind that lower versions of IE (or IE 11 if you haven't patched it in a few months) don't support HSTS. Also, Facebook doesn't set the
includeSubDomainsflag, so just because www.facebook is protected doesn't mean all other Facebook web properties are protected. Commented Sep 30, 2015 at 4:10
Could be quite a bit of things but ... throttling is speed-related, not protocol related.
You indicate yourself you installed something and it started, did you try turning it ( the add-on ) off and on again ?
You should take note this might be part of a MITM ( man-in-the-middle ), someone eavesdropping. If dropping to HTTP also triggers request to renew or re-enter your password you should stop and investigate.
Most likely however, there is a bug in the add-on you installed or a conflict with another add-on.
Network speed bears no relation to this. As saint mentioned, it is likely the add-on.
From an attack perspective, this would be possible by doing "SSL Stripping" during MiTM. SSL Stripping is the principle of the MiTM saying "switch all HTTPS links to HTTP." There's was an interesting defcon talk about this (click here to see it).
In the presentation, the speaker, Moxie Marlinspike, showed that SSL Stripping was effective even on google. Since the talk, I believe google has ramped up their security to make itself only available using SSL; however, that just goes to show that at one point even Google was susceptible to this kind of attack.
Edit: I see two other comments on your question mentioned SSL Strip. It is quite an interesting & effective attack vector for MiTM.
-
1This talk is for 4 years ago and SSL stripping is not effective any longer on top websites including Google and Facebook. Commented Sep 29, 2015 at 22:44
This is likely 3rd party software disabling TLS over HTTP (HTTPS). There's really no good reason to degrade a connection to HTTP from HTTPS. In fact, starting a new session is the heaviest part.
Rather than check browser extensions and applications, installing a plugin like Force-TLS or HTTPS-everywhere will force you to connect over HTTPS instead of HTTP when able. This should resolve your issue.
