Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?

If you access http://www.facebook.com/, in the top right side there is the login section. You can enter your credentials there and click "Log In".

My URL is on http:// though (!?). Is the login safe?

marked as duplicate by Hendrik Brummermann Nov 6 '11 at 11:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


the details of the form is:

<form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input name="charset_test" value="€,´,€,´,水,Д,Є" type="hidden">

note the https in the action this means that the submit will happen over https regardless if the current page is http or https

however this does not mean that the original page wasn't modified in transit to add a script that might hijack the credentials and send it to a attacker


The real answer is 'it depends'

Using http means your login could be picked up by an attacker, so the recommendation is to ALWAYS use https.


Your login is as safe as HTTP ever is, which is to say your login information can be intercepted unencrypted.

The solution is to use facebook's HTTPS login. This article explains more about the HTTPS login for facebook and how to set your facebook account to always use HTTPS.

Not the answer you're looking for? Browse other questions tagged or ask your own question.