12

(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.)

To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP version), HSTS (HTTP Strict Transport Security) can be used.

To tell the browser that a website should always be visited using HTTPS a, 'Strict-Transport-Security' header can be sent in the HTTP response. From that moment on, the website will exist in the browser's HSTS list, and when someone types the site name (e.g. example.com) in the URL bar, they will be sent to https://example.com/ rather than http://example.com.

Google, Gmail, Twitter and Paypal are examples of major websites that make use of this functionality. Facebook, however, does not seem to send a 'Strict-Transport-Security' header in its responses. Can anyone give me a good reason why they have chosen not to use HSTS?

  • 15
    Why would they bother to protect our information when their primary goal is to share it with others? – AJ Henderson Feb 18 '14 at 15:21
  • 11
    @AJHenderson Because they want to sell it, not share it for free. – CodesInChaos Feb 18 '14 at 15:28
  • 2
    In July 2013, Facebook wrote "Some mobile phones and mobile carrier gateways don't fully support https. While we're working with the vendors of these products, we didn't want to leave https off entirely for affected users." – Colonel Panic Dec 23 '14 at 16:42
  • 5
    I'm voting to close this question as off-topic because the question is now invalid - Facebook now uses HSTS. – paj28 May 21 '15 at 9:45
  • 9
    I'm going to wedge this question back open. The historical reasons for a major site to have issues can be the present issues for much of the world. They can also provide a lesson that people can effectively learn from as we steer towards using HTTPS as a default over HTTP. – Jeff Ferland May 21 '15 at 18:59
13

Edit: Facebook now use HSTS, so both question and answer are now incorrect.

Because using HTTPS for Facebook is optional.

If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off.

If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some fairly funky workaround.

I can't think of any practical reason to disable secure browsing. Certainly any such reason would be rare. I think the option is there more due to historical accident than active planning.

  • Yes I thought about that, but even with this 'secure browsing' option on, HSTS is still not used. So the attack vector still exists.. You are right that it would cease to work if you would turn that option off. But why would they even allow that? – Michael Feb 18 '14 at 15:49
  • @user2785338 - I have no idea why they allow it, and I suspect there is no good reason. But given that they do allow it, they can't really use HSTS. – paj28 Feb 18 '14 at 16:27
  • 1
    Performance difference between HTTP and HTTPS is negligible. In other words: Saying that the reason for disabling HTTPS is speed is a fallacy. Advising people to use http instead of https "because you're safe at home anyway" is very unprofessional. – Michał Miszczyszyn Jan 28 '17 at 20:05
  • 1
    @MichałMiszczyszyn: Not true of 2003-era computers I still find working in older homes. – Joshua Apr 20 '17 at 23:29
  • 1
    It's also untrue for Amiga which I find working in older homes. It's also untrue for people without internet access. – Michał Miszczyszyn Apr 21 '17 at 9:04
11

Summary: HSTS is coming, but the site has some hurdles related to protecting user information such as not telling a website who you are when you click on a link. Explanation of that particular issue: https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919

Firefox is the last major holdout. Here's comment 14 (March 15, 2012) from the bug that was filed in 2011: https://bugzilla.mozilla.org/show_bug.cgi?id=704320#c14

For WebKit users, Facebook plans to implement an "origin" policy in the near future. This policy effectively represents how our site behaves today, but without relying on the abuse of existing browser behavior. Background: https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919

The meta-referrer proposal provides two immediate benefits with respect to Facebook users:

  • We currently utilize document.location.replace() through an interstitial endpoint to perform external redirects for Mozilla users. Implementing a native redirect instead of relying upon JavaScript offers a slight performance improvement and enables the redirect to function with JavaScript disabled.

  • We intentionally downgrade the interstitial from HTTPS to HTTP in order to send a referer header. This is obviously undesirable but currently necessary in our context. Support for meta-referrer enables us to maintain an a secure connection and resolves one of the last issues blocking implementation of Strict-Transport-Security

Just throwing a bit of support behind the proposal. We'd love to see support in Firefox.

Followup comment 79 (January 30, 2014), same bug: https://bugzilla.mozilla.org/show_bug.cgi?id=704320#c79

Facebook has been asking for this since 2010, I'm not sure I understand the sudden rush.

Small update to comment #14, This is now the last remaining issue blocking Strict-Transport-Security on facebook.com for Firefox users (it's been enabled for Chrome/Safari users for some time). I wouldn't say that we're rushed, we're happy to wait for your preferred solution, but I would love to see HSTS enabled sooner rather than later.

  • note to mod - someone voted to close, but I think your answers and links are interesting and can be applied to many other sites. Might be a topic for META but can't post now. – goodguys_activate May 21 '15 at 10:17
  • It would be interesting if you could update this answer to explain what made Facebook switch to HSTS. What made the reasons not to switch less compelling? – Gilles 'SO- stop being evil' May 26 '15 at 15:50
  • I'm guessing it's the fact that this last-bug-to-fix issue was cleared a few months ago. – Jeff Ferland May 26 '15 at 16:22
5

Update May 2015: Facebook now uses HSTS. Good work.

$ http -h get https://www.facebook.com
Strict-Transport-Security: max-age=15552000; preload

See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.