16

If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? How is Facebook managing its login?

25

No, it is not secure to enter your username and password on http://facebook.com.

The target of the login-form points to an https URL, so a passive attacker cannot read your password:

<form method="POST" action="https://www.facebook.com/login.php?login_attempt=1"

But an attacker, who can modify the data stream, can manipulate html code which contains the login form. He can modify the target url or add some javascript code that sends a copy of the username and password to his own server.

Furthermore after logging in, Facebook sends the session cookie over an http connection. This allows even an passive attacker to act in your name. This is not a theoretical attack, there is a tool called Firesheep that is extremly easy to use.

To prevent the first risk, always use https://facebook.com to login. There is a browser extension called https everywhere which does this for you and even stays at https which prevent the Firesheep style attacks, too.

  • Especially as with such a https on POST there is no way to detect a MITM SSL stripping attack until it's too late, even if one knows what to look for. – ewanm89 Oct 8 '11 at 20:08
  • so how does SSL help in this environment? Is it that the password is encripted or what is the benefit? – Ryan Oct 9 '11 at 0:32
  • SSL protects you against a passive attacker, that is, someone who can snoop/log your traffic but not redirect, modify, or hijack it. – David Schwartz Oct 9 '11 at 9:30
10

Only log-in via https:// facebook.com is secure - and NOT http:// facebook.com which at this time does not auto-redirect to the secure site.

Because the target of the log-in form is an https URL, as given by the source code, the form data could not be read via passive attack, and in that sense is safe. But an active attack via data stream modification - which could enable a hacker's injection of malicious code to steal the username and password entered - could be easily done.

Subsequent data in the session cookie is additionally sent through an http connection, which enables passive attackers to act in one's name even without having stolen the log-in data from the form on the front page. The proof-of-concept extension Firesheep, written by developer Eric Butler for Firefox, demonstrates how this is possible. Lifehacker has written more about the need for SSL encryption in this regard.

To deter such attacks, in Facebook, one may simply edit one's account settings, select Account Security, and tick the checkbox to enable HTTPS, under the Secure Browsing header. With this option, certain pages - notably, some Facebook applications that have not yet been HTTPS-enabled - may not function properly; however, the sacrifice of that lost functionality could be made for the sake of account security.

Additionally, there are web browser extensions available to automatically enable HTTPS encryption, whenever possible - not only for Facebook, but for all web sites. The Electronic Frontier Foundation (EFF) and the Tor Project have made an extension called HTTPS Everywhere which is available for Firefox and Google Chrome. Other similar extensions may be available for your browser of choice.

8

If you go to https://facebook.com you will log in using SSL. Yes it would be good if facebook would redirect, but they don't yet.

You can do it yourself by going directly to the https version of the page, or use HTTPSEverywhere which will help by pushing you to the https page for many common sites, including facebook.

  • 1
    I'm wondering why they don't do it automatically. Oo – recluze Dec 20 '12 at 15:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.