9

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? Or, how such a thing is possible ? I thought facebook, like google, is always https. Also, this happened when I have installed https everywhere plugin for mozilla.

  • 1
    Throttling should not cause this. Blocking the HTTPS channel might cause a fall-back to HTTP I suppose but this would seem unlikely. I would look to monitor the traffic and inspect the page before and after the transition. There may be a bug in FB that means a link is sometimes embedded pointing to the wrong URL though this would be surprising and doesn't explain the failure of https everywhere. – Andy Boura Aug 28 '14 at 10:22
  • 5
    Could you elaborate on the workflow? Where do you see http vs https? Is it when viewing a profile, pictures, apps, etc? – Matthew Peters Aug 28 '14 at 14:45
  • 1
    Somewhere in FB settings there is (or at least used to be) a https setting - try finding it and enabling it. Also check your bookmarks/history - you may be going to old http entries by mistake. I don't know why https everywhere wouldn't rewrite those, though... – HairyFotr Aug 31 '14 at 11:33
  • 3
    Also, FB uses HSTS (if I recall correctly), so your browser should not allow "bare" http connections – joozek Sep 2 '14 at 11:54
  • 2
    SSL Strip can't drop you down from https, it only prevents redirects from http to https. – CodesInChaos Sep 17 '14 at 10:11
3

Not all apps in Facebook support HTTPS, so if you're playing games on Facebook or use other third party apps you will get a notification that these apps are only accessible via HTTP. When you proceed your connection will degrade to HTTP.

1

Facebook uses HTTP Strict Transport Security (HSTS) (see the screenshot below). It simply means your browser would never make HTTP connection to Facebook even if someone is trying to downgrade your connection to HTTP. Most browsers (Chrome, Firefox, IE) are now supporting this feature. The caveat is in the first time you need to make a 'secure' connection to Facebook. This way the browser will see HSTS and remember, for the given number of seconds, that the current domain should only be contacted over HTTPS. Facebook HSTS header directs browser to use HTTPS connection for 180 days.

HSTS header in response from Facebook

Alternatively, if you use Chrome, it has a preloaded list of HSTS website. This means your browser will make HTTPS connection to these website out-of-the-box. So the browser does not need to wait for HSTS header. At the time of writing, the list includes all Facebook sub-domains.

So back to your question, I can think of a few possibilities:

  1. You are using a browser version that does not have a support for HSTS.
  2. Your browser has not seen and remembered HSTS.
  3. Each time you visit Facebook, you clean all your local cache, therefore, your browser would never remember to always use HSTS.
  4. You are using a Facebook App that is not part of Facebook domain and does not have HSTS.
  5. Malware infection that interfere with Facebook connections.

To validate this, get a latest version of Chrome and try to access Facebook. If the problem still exist, do the same thing using a different computer. This can give you a clue which possible is more likely.

Edit 1: Firefox also supports HSTS preloaded list

  • IE 11 also uses HSTS preload. However, bear in mind that lower versions of IE (or IE 11 if you haven't patched it in a few months) don't support HSTS. Also, Facebook doesn't set the includeSubDomains flag, so just because www.facebook is protected doesn't mean all other Facebook web properties are protected. – CBHacking Sep 30 '15 at 4:10
0

Could be quite a bit of things but ... throttling is speed-related, not protocol related.

You indicate yourself you installed something and it started, did you try turning it ( the add-on ) off and on again ?

You should take note this might be part of a MITM ( man-in-the-middle ), someone eavesdropping. If dropping to HTTP also triggers request to renew or re-enter your password you should stop and investigate.

Most likely however, there is a bug in the add-on you installed or a conflict with another add-on.

-1

Network speed bears no relation to this. As saint mentioned, it is likely the add-on.

From an attack perspective, this would be possible by doing "SSL Stripping" during MiTM. SSL Stripping is the principle of the MiTM saying "switch all HTTPS links to HTTP." There's was an interesting defcon talk about this (click here to see it).

In the presentation, the speaker, Moxie Marlinspike, showed that SSL Stripping was effective even on google. Since the talk, I believe google has ramped up their security to make itself only available using SSL; however, that just goes to show that at one point even Google was susceptible to this kind of attack.


Edit: I see two other comments on your question mentioned SSL Strip. It is quite an interesting & effective attack vector for MiTM.

  • 1
    This talk is for 4 years ago and SSL stripping is not effective any longer on top websites including Google and Facebook. – Dr. mattle Sep 29 '15 at 22:44
-1

This is likely 3rd party software disabling TLS over HTTP (HTTPS). There's really no good reason to degrade a connection to HTTP from HTTPS. In fact, starting a new session is the heaviest part.

Rather than check browser extensions and applications, installing a plugin like Force-TLS or HTTPS-everywhere will force you to connect over HTTPS instead of HTTP when able. This should resolve your issue.

  • OP says they have HTTPS everywhere installed. – Neil Smithline Sep 30 '15 at 2:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.