5

I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi.

And I assume, that official app encrypts my login credentials and the content transfered between their servers and my device.

But I googled and found no information if this is true. I found only posts explaining how to use HTTPS for the browser based login, third party encryption apps and how to make your own app work with facebook's encryption.

[update] Thanks for the comments so far. I understand that you need to use tools like wireshark to really ensure for yourself, that apps encrypt the data that they transfer.

But I am flabergast, that it is not widely known or documented if and how the facebook app uses https or similar means to protect its users in public wifis.

| improve this question | |
  • This question has been asked multiple times on here. Search this site, then please delete this question. If you don't find your answer here, (you're using the wrong search terms, but) you can check if the app encrypts it with Wireshark. – KnightOfNi Jan 28 '14 at 20:40
  • 3
    @KnightOfNi: In fairness to the OP, this specific question has NOT been "asked multiple times", ar at least the questions where it has are not publicly visible. I'm not entirely sure the question does belong here, but it's certainly not an easy-to-find duplicate. (I say this after a few minutes with the built-in SE search as well as some time with the Google.) – Jonathan Garber Jan 28 '14 at 20:59
  • @JonathanGarber I personally have answered or commented on almost this exact question at least once, but they might have been closed since then. Sorry I got a little worked up framester. – KnightOfNi Jan 28 '14 at 21:29
1

Short awnser: Yes and No

Explanation:

Facebook Claims they use TLS/SSL everywhere, but after a bit of poking around using Wireshark, i found out that logging in, visiting timeline etc. all go over HTTPS (no port 80 connections detected), when visiting certain elements though, like apps/games, photo's and such, i detected HTTP connections through port 80.

Also note that some optionsmay vary per OS, i think i heard there was an option with certain OS's to manually turn on/off the SSL/TLS function, but i cannot verify this nor find it on google.

Long story short, it seems that the login part is secured, but photo's and clearly 3rd party apps aren't, making it a partially encrypted service.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.