So i've noticed something that really bothered me and i was kinda freaked out about how it's even possible. But i didn't want to come here just like "Hey, how is this possible?" so i wanted to make proprer research and i eventually found the answer(almost-that's why i am here). I am also here, because i am deffinitely not the only one, who is wondering how is this possible, so i want to point this problem out a bit.
So i was at my friend's and i wanted to just quickly demonstrate him MitM attack via android app ZAnti. It is really powerful app and i wanted to show him, what an attacker could see when doing (ARP) MItM. So i was showing him many interesting things and i said to him, that if the page is using HTTPS, i can see nothing, but it's still pretty dangerous. Well, he wanted to see so he logged onto his facebook and his password popped up on my phone... And it was at this moment i knew, something isn't right here.
He absolutely freaked out but it blew my mind. At this moment, we started to make theories about how those Chinese devs of Maxthon hacked NSA/FBI, stole their private SSL/TLS keys of facebook and now they are using them and silently stealing peoples' facebook accounts. Well, this is obviously not true.
Anyway, first thing that came to my mind was this site and how i need to post question about this asap. But i wanted to give you enough data to work with so we could collectively figure something out. So i will start posting the """research""" as it is deffinitely worth checking out.
First i needed to replicate the attack. I fired up my Opera browser and tried the same thing. Nothing. Absolutely nothing. I didn't even see that i connected to facebook(because ZAnti filters https requests as they are useless). So i tried hrej.cz(it's just local webpage that i know is http and i use it when i want to make sure my MitM is working) and it was there. So it's working.
So it was really because of Maxthon so i went to download it and try it again. And i saw. It was there.
The app uses SSLstrip by default so i thought that it might be because of that, but facebook uses HSTS so it wouldn't make any sense. But as i checked the URL bar my security brain part died for a second. I was browsing facebook via HTTP.
I am sorry for my localization. It's all in Czech but i will try to translate the most important
The green bar says that the site is "certified by CEAIA".
But facebook uses HSTS! Well, as it turned out, facebook really does, but Maxthon doesn't support it. And this is where i answered my question but it raised another one. Why facebook still process http requests ? I mean, facebook could just block it and not even allow it. Where is the catch ?
By the way, Maxthon was among other browsers recommended for Win10 when my friend installed it for the first time. Kinda scary that it's so insecure.
Where is the catch ?-- pretty simple: compatibility. The more browser range is supported -> more people reach FB -> ??? -> PROFIT. Seriously, plain HTTP support is left for comptibility purposes for older browser versions which might not support HSTS, for instance.