Facebook Switching To HTTPS By Default 92
Trailrunner7 writes "Facebook this week will begin turning on secure browsing by default for its millions of users in North America. The change will make HTTPS the default connection option for all Facebook sessions for those users, a shift that gives them a good baseline level of security and will help prevent some common attacks. Facebook users have had the option of turning on HTTPS since early 2011 when the company reacted to attention surrounding the Firesheep attacks. However, the technology was not enabled by default and users have had to opt-in and manually make the change in order to get the better protection of HTTPS."
Need password (Score:5, Insightful)
Re: (Score:2)
It's a typo. Remove the trailing apostrophe in the URL.
Re:Need password (Score:5, Informative)
It's a typo. Remove the trailing apostrophe in the URL.
Still not working here. I need to go to;
https://threatpost.com/en_us/blogs/facebook-enabling-https-default-north-american-users-111912
Re: (Score:2, Funny)
Aww, you mad? Did you buy Facebook stock?
How long does it take to get a cert? (Score:1)
I can't believe this would be considered news? Facebook figures out how to do a redirect to a HTTPS page. No wonder their IPO was a flop... It will be amazing if they are here in a year.
Re:How long does it take to get a cert? (Score:5, Insightful)
Re:How long does it take to get a cert? (Score:4, Informative)
Yes, I don't like the use of https where it's not needed. It's more overhead all around and YES it matters on busy servers and slow, high latency links. It can also meant he difference between accessing and not accessing the site with a misconfigured router (e.g. wrong MTU on a PPPoE connection can make SSL not work correctly. There's one ISP here that needs packets no larger than 1454 bytes or there's trouble signing into various services. The default on the routers is 1492 for PPPoE, which is supposed to be correct but gets people every time. The ISP doesn't "support" routers, unless they supply, configure and lock you out of them. So I get service calls over that all the time)
I do not need SSL on Google. Like I give a fuck if people snoop my search phrases. (I'll search for "kiss my ass" just in case the bogey man is listening) I would want SSL for signing in to, say, Gmail or something but I don't need it for all communications. Now that Google has carried the https over to Youtube, some silly browsers (e.g. IE8) prompt on the loading of every damned page because there's a mix of secure and non secure content. Really smart.
Re:How long does it take to get a cert? (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:How long does it take to get a cert? (Score:4, Insightful)
You mean those same governments whose root certs are already in 90% of computer trust chains?
Protip: your computer very likely trusts a root cert from a Chinese company with "strong" ties to their government. Sleep well.
Re: (Score:3)
No, computer. Browsers tend to use the system trusted root cert info. On OSX you install certs to the system certificate chain to get SSL errors to disappear in your browser, email, etc. Ditto on Windows for RDP, email, browsing, and VPNs (SSTP).
Firefox may be the odd man out-- I believe it uses its own internal trusted roots list.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
That's not a problem though, as they will not be able to read it anyway. All they know is what server you connected to and the size, number and time of packets in each direction. [Also read comment below, your attacker may have access to a root CA. I'd mod that up if I had mod points.] One benefit of encrypting unimportant traffic, apart from the actual security benefits like when using open WLANs, is that it makes it much more difficult to block specific pages.
Re: (Score:2)
Now that Google has carried the https over to Youtube, some silly browsers (e.g. IE8) prompt on the loading of every damned page because there's a mix of secure and non secure content. Really smart.
Im glad youre not in charge of making browsers. The reason thats a big deal is because when you request an SSL page that has a valid cert, the assumption is that your connection is secure from MITMs. If some of the content on the page is insecure, the value of SSL is basically nil: someone can inject html / js that overlays the secure content, so instead of putting usernames / passwords into a secure submission form you are putting it into the attackers overlaid insecure submission form. Once you press
Re: (Score:2)
In this case none of that content needs to be encrypted in the first place. This isn't your bank, it's just a video site.
I have noticed the problem only with IE8. I suppose that nobody else except you and it, have a clue?
It is probably erroneous.
Re: (Score:2)
Youtube uses your google account for login. I really dont think you want your gmail credentials out in the open.
And Chrome WILL warn you if there is mixed content-- they just do it with an icon rather than a popup. The popup you noticed originated at least as far back as IE6, and possibly earlier.
Re: (Score:2)
No, I am saying that IE8 is erroneously putting up that message. I know what it means and yes, it's been around much earlier than IE6. I think I remember it in Netscape even.
I don't sign in to youtube. I don't sign in to Google. I opted out of all the social networking tripe. (I forget what they call it, but there's a central site you can use to opt out of Google Everything all at once, and only keep what you want.) I have a disposable Gmail account, with completely false information that I log in to maybe
Re: (Score:2)
Not just intel. Use a modern AMD processor or any Xeon E3 or above, and you can hit in excess of 10gbit/sec of AES traffic thru the processor alone (not even counting accelerators). I understand there are PCIe accelerators out there by Exar that can give a pretty substantial boost as well.
Re: (Score:3, Insightful)
Indeed. The "heavy" part of SSL is doing the connection setup and exchange as it uses asymmetric algorithms like RSA or Diffie-Hellman for key exchange. The actual bulk encrypted transport is relatively lightweight. It never made much sense to me to spend the cycles to setup a secure connection, use it for protecting the login/password, and then dropping back to an insecure page when you could just keep the same connection secure for minimal additional resources.
Link to article has extra character at end (Score:5, Informative)
The proper link is:
https://threatpost.com/en_us/blogs/facebook-enabling-https-default-north-american-users-111912 [threatpost.com]
Re: (Score:2)
Re: (Score:3)
Pick your poison.
Re: (Score:2)
power (Score:3, Interesting)
wonder what the implications are from a power consumption perspective?
Re: (Score:3, Insightful)
I don't know but I'm sure the waste ratio hasn't increased from 100%.
SSL hardware acceleration? (Score:3)
Re:SSL hardware acceleration? (Score:5, Informative)
Crystal Forest is supposed to have SSL acceleration built in. Ivy Bridge (2012) has AES acceleration built in on midrange i5s and up, and I think AES was supported by some processors as early as Sandy Bridge (2011). Crystal Forest is a platform rather than microarchitecture, and I'm not sure exactly when it will be released.
Re: (Score:2)
With modern machines you only spend about 2% of your CPU handling the HTTPS part of the transaction, especially with HTTPS connection re-use handling. Back when they first started enabling HTTPS I calculated that it might take one more rack of machines to handle all the HTTPS needs for facebook in a worst-case situation. One rack is a drop in the bucket for the http front ends these days for service as big as facebook.
Thanks, Facebook. (Score:5, Funny)
Twitter did it a while back. Facebook finally jumped on the bandwagon. Now if only ChatRoulette would follow suit, I could finally bare every detail of my life to strangers without fear of prying eyes.
Re:Thanks, Facebook. (Score:4, Funny)
Re: (Score:2)
Actually, he'd probably get it the wrong way round and redirect that howling infinite void of /dev/null out to the entire populace of Facebook - instantly terminating, unending nothingness piped through smartphones and laptops and desktop computers, straight into the uncomprehending, newly-obliterated minds of the social networking masses.
Still, everyone would find it an improvement over the previous service.
Re: (Score:2)
"[...] I could finally bare every detail of my life to strangers without fear of prying eyes"
Um.... um... where do I begin...
Re: (Score:1)
No big deal (Score:4, Insightful)
Of course, the biggest security vulnerability is on one end of the connection, and the biggest threat to privacy is on the other. HTTPS won't help much for those.
It's not about security but more privacy (Score:2)
Re: (Score:2)
So my Driftnet screen will go black? (Score:4, Interesting)
This is really sad news. My driftnet/webcollage [ex-parrot.com] screen in my living room will get boring if it gets starved of all the neighbours' Facebook activity. https is killing all the fun!
Re: (Score:2)
That's nice (Score:4, Insightful)
They don't like competition (Score:2)
Facebook doesn't want anybody else stealing your data.
Yawn ... (Score:2)
Facebook + Security = WTF? (Score:2)
Latency to https? (Score:2)
Re: (Score:2)
I've opted to use https only on Facebook for a year or so and haven't noticed any discernible difference.
Quicker HTTPS (Score:1)
A few things that may help on Palemoon and Firefox :
Make sure SSL pages gets cached,
browser.cache.disk_cache_ssl;true
Pipeline the SSL too,
network.http.pipelining.ssl;true
TorBrowser uses this,
security.ssl.enable_false_start;true
And as always, reduce some traffic bloat,
dom.storage.enabled;false
gfx.downloadable_fonts.enabled;false
browser.chrome.image_icons.max_size;16
general.useragent.override;Mozilla/5.0 (Windows NT 6.1; rv:9.0) Gecko/20100101 Firefox/9.0
If you want, at
Re: (Score:2)
HTTPS content can be cached in the browser, and why not?
You can expect to lose proxy caching though.
(Unless your corporate proxy is kind enough to decrypt your traffic and then cache it...)
Turning on secure browsing be default? (Score:2)
I have a slight problem with this... (Score:4, Interesting)
Last year I succumbed to Facebook's nagging and I finally opted to raise my security to the HTTPS setting. Largely to shut it the @#$% up.
Nagging was worse than ad-supported software.
However once I did that my troubles began. None of the games I played would run under the HTTPS and instructed me to drop back to the HTTP security. However once I did that, Facebook was nagging me "Did I really want to do that?" and "Are you certain that this is wise? The higher security is better to protect your identity".
After several attempts I gave it up and left it at the HTTPS setting. Haven'y played a Facebook game or ran a Facebook app since.
So my question is...what's going to happen to all the people who are addicted to all the apps and games? Will they *finally* run under the higher security setting? Or are we going to hear the wailing and gnashing of teeth as people start going into withdrawal when they can't check on their farms to see if they got the magical macguffin of the week?
[I didn't notice that my comp was logged off of my account and posted it as an anon-coward]
Re: (Score:2)
Re: (Score:2)
I suppose they'll be forced to finally support their app on HTTPS, like they should have done two years ago.
Such valuable data (Score:1)
Britney Braindead:
"OMG peepz Justin Bieber is on the morning show... switch channels RIGHT NOW!!!"
2 minutes ago
SSL... is it really necessary?