13

(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.)

To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP version), HSTS (HTTP Strict Transport Security) can be used.

To tell the browser that a website should always be visited using HTTPS a, 'Strict-Transport-Security' header can be sent in the HTTP response. From that moment on, the website will exist in the browser's HSTS list, and when someone types the site name (e.g. example.com) in the URL bar, they will be sent to https://example.com/ rather than http://example.com.

Google, Gmail, Twitter and Paypal are examples of major websites that make use of this functionality. Facebook, however, does not seem to send a 'Strict-Transport-Security' header in its responses. Can anyone give me a good reason why they have chosen not to use HSTS?

Improve this question
11
  • 15
    Why would they bother to protect our information when their primary goal is to share it with others?
    – AJ Henderson
    Feb 18, 2014 at 15:21
  • 11
    @AJHenderson Because they want to sell it, not share it for free.
    – CodesInChaos
    Feb 18, 2014 at 15:28
  • 2
    In July 2013, Facebook wrote "Some mobile phones and mobile carrier gateways don't fully support https. While we're working with the vendors of these products, we didn't want to leave https off entirely for affected users."
    – Colonel Panic
    Dec 23, 2014 at 16:42
  • 5
    I'm voting to close this question as off-topic because the question is now invalid - Facebook now uses HSTS.
    – paj28
    May 21, 2015 at 9:45
  • 9
    I'm going to wedge this question back open. The historical reasons for a major site to have issues can be the present issues for much of the world. They can also provide a lesson that people can effectively learn from as we steer towards using HTTPS as a default over HTTP.
    – Jeff Ferland ♦
    May 21, 2015 at 18:59

3 Answers 3

Reset to default
13

Edit: Facebook now use HSTS, so both question and answer are now incorrect.

Because using HTTPS for Facebook is optional.

If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off.

If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some fairly funky workaround.

I can't think of any practical reason to disable secure browsing. Certainly any such reason would be rare. I think the option is there more due to historical accident than active planning.

Improve this answer
6
  • Yes I thought about that, but even with this 'secure browsing' option on, HSTS is still not used. So the attack vector still exists.. You are right that it would cease to work if you would turn that option off. But why would they even allow that?
    – Michael
    Feb 18, 2014 at 15:49
  • @user2785338 - I have no idea why they allow it, and I suspect there is no good reason. But given that they do allow it, they can't really use HSTS.
    – paj28
    Feb 18, 2014 at 16:27
  • 1
    Performance difference between HTTP and HTTPS is negligible. In other words: Saying that the reason for disabling HTTPS is speed is a fallacy. Advising people to use http instead of https "because you're safe at home anyway" is very unprofessional.
    – Michał Miszczyszyn
    Jan 28, 2017 at 20:05
  • 1
    @MichałMiszczyszyn: Not true of 2003-era computers I still find working in older homes.
    – Joshua
    Apr 20, 2017 at 23:29
  • 1
    It's also untrue for Amiga which I find working in older homes. It's also untrue for people without internet access.
    – Michał Miszczyszyn
    Apr 21, 2017 at 9:04
11

Summary: HSTS is coming, but the site has some hurdles related to protecting user information such as not telling a website who you are when you click on a link. Explanation of that particular issue: https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919

Firefox is the last major holdout. Here's comment 14 (March 15, 2012) from the bug that was filed in 2011: https://bugzilla.mozilla.org/show_bug.cgi?id=704320#c14

For WebKit users, Facebook plans to implement an "origin" policy in the near future. This policy effectively represents how our site behaves today, but without relying on the abuse of existing browser behavior. Background: https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919

The meta-referrer proposal provides two immediate benefits with respect to Facebook users:

  • We currently utilize document.location.replace() through an interstitial endpoint to perform external redirects for Mozilla users. Implementing a native redirect instead of relying upon JavaScript offers a slight performance improvement and enables the redirect to function with JavaScript disabled.

  • We intentionally downgrade the interstitial from HTTPS to HTTP in order to send a referer header. This is obviously undesirable but currently necessary in our context. Support for meta-referrer enables us to maintain an a secure connection and resolves one of the last issues blocking implementation of Strict-Transport-Security

Just throwing a bit of support behind the proposal. We'd love to see support in Firefox.

Followup comment 79 (January 30, 2014), same bug: https://bugzilla.mozilla.org/show_bug.cgi?id=704320#c79

Facebook has been asking for this since 2010, I'm not sure I understand the sudden rush.

Small update to comment #14, This is now the last remaining issue blocking Strict-Transport-Security on facebook.com for Firefox users (it's been enabled for Chrome/Safari users for some time). I wouldn't say that we're rushed, we're happy to wait for your preferred solution, but I would love to see HSTS enabled sooner rather than later.

Improve this answer
3
  • note to mod - someone voted to close, but I think your answers and links are interesting and can be applied to many other sites. Might be a topic for META but can't post now.
    – makerofthings7
    May 21, 2015 at 10:17
  • It would be interesting if you could update this answer to explain what made Facebook switch to HSTS. What made the reasons not to switch less compelling?
    – Gilles 'SO- stop being evil'
    May 26, 2015 at 15:50
  • I'm guessing it's the fact that this last-bug-to-fix issue was cleared a few months ago.
    – Jeff Ferland ♦
    May 26, 2015 at 16:22
5

Update May 2015: Facebook now uses HSTS. Good work.

$ http -h get https://www.facebook.com
Strict-Transport-Security: max-age=15552000; preload

See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .