I observed that sometimes my facebook
https connection changes to
http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? Or, how such a thing is possible ? I thought facebook, like google, is always
https. Also, this happened when I have installed
https everywhere plugin for mozilla.
I observed that sometimes my facebook
Not all apps in Facebook support HTTPS, so if you're playing games on Facebook or use other third party apps you will get a notification that these apps are only accessible via HTTP. When you proceed your connection will degrade to HTTP.
Facebook uses HTTP Strict Transport Security (HSTS) (see the screenshot below). It simply means your browser would never make HTTP connection to Facebook even if someone is trying to downgrade your connection to HTTP. Most browsers (Chrome, Firefox, IE) are now supporting this feature. The caveat is in the first time you need to make a 'secure' connection to Facebook. This way the browser will see HSTS and remember, for the given number of seconds, that the current domain should only be contacted over HTTPS. Facebook HSTS header directs browser to use HTTPS connection for 180 days.
Alternatively, if you use Chrome, it has a preloaded list of HSTS website. This means your browser will make HTTPS connection to these website out-of-the-box. So the browser does not need to wait for HSTS header. At the time of writing, the list includes all Facebook sub-domains.
So back to your question, I can think of a few possibilities:
- You are using a browser version that does not have a support for HSTS.
- Your browser has not seen and remembered HSTS.
- Each time you visit Facebook, you clean all your local cache, therefore, your browser would never remember to always use HSTS.
- You are using a Facebook App that is not part of Facebook domain and does not have HSTS.
- Malware infection that interfere with Facebook connections.
To validate this, get a latest version of Chrome and try to access Facebook. If the problem still exist, do the same thing using a different computer. This can give you a clue which possible is more likely.
Edit 1: Firefox also supports HSTS preloaded list
Could be quite a bit of things but ... throttling is speed-related, not protocol related.
You indicate yourself you installed something and it started, did you try turning it ( the add-on ) off and on again ?
You should take note this might be part of a MITM ( man-in-the-middle ), someone eavesdropping. If dropping to HTTP also triggers request to renew or re-enter your password you should stop and investigate.
Most likely however, there is a bug in the add-on you installed or a conflict with another add-on.
Network speed bears no relation to this. As saint mentioned, it is likely the add-on.
From an attack perspective, this would be possible by doing "SSL Stripping" during MiTM. SSL Stripping is the principle of the MiTM saying "switch all HTTPS links to HTTP." There's was an interesting defcon talk about this (click here to see it).
In the presentation, the speaker, Moxie Marlinspike, showed that SSL Stripping was effective even on google. Since the talk, I believe google has ramped up their security to make itself only available using SSL; however, that just goes to show that at one point even Google was susceptible to this kind of attack.
Edit: I see two other comments on your question mentioned SSL Strip. It is quite an interesting & effective attack vector for MiTM.
This is likely 3rd party software disabling TLS over HTTP (HTTPS). There's really no good reason to degrade a connection to HTTP from HTTPS. In fact, starting a new session is the heaviest part.
Rather than check browser extensions and applications, installing a plugin like Force-TLS or HTTPS-everywhere will force you to connect over HTTPS instead of HTTP when able. This should resolve your issue.