HTTPS and Website Security and Facebook

Posted on: Fri, 02/04/2011 - 12:06 — us104_techdish

Most of us that have done any amount of online shopping, webmailing or account creating have probably noticed that on certain pages (like payment, account creation, password changes), a little padlock shows up in your browser's address bar. But do you know what this means?

The little padlock, accompanied by a little green bar (and sometimes more, depending on your browser and browser settings) is a notification to you that the page you are viewing is secure. Secure?

What is a secure website?

On necessary pages, most websites use an SSL certificate to encrypt the data you are sending (like a password, credit card number, or other private information) from your computer to the server the website is hosted on. This prevents anyone from intercepting the data (sniffers) from making any sense of it, as encrypted data is a jumbled mass of gobblygook. A reminder from TechDish: you should always double-check you're on a secure page before you send any sensitive information to a website! Get in the habit of looking for this, just like you check to see that the light is green before you step on the gas.

Why you want to enable https in Facebook

Open Wi-Fi users and coffee shop browsers, this means you! Thanks to Eric Butler and his Firesheep extension he wrote for Firefox, anyone using this while you sip coffee and browse your friends' latest pics can effortlessly hijack your account and cause all sorts of mayhem while doing so. Not to mention, grab your pics off of Flickr, shop for things on your Amazon, and many many more.

But how? I thought my login was secure?. Well, it is. But the rest of the pages of these websites aren't. The only reason you stay logged in is a cookie file that says so. Which is where the vulnerability lies that Firesheep exploits

By simply enabling https in Facebook, or any site (as I'm sure more will follow suit very, very quickly!), you thwart this vulnerability and can continue poking your relatives without intrusion.

How to enable https in Facebook

It may sound complicated, but this will take you less than 2 minutes and is well worth the effort!

Step 1: Log in to Facebook, then go to Account > Account Settings

Step 2: Under Account Security, check the box next to "Browse Facebook on a secure connection (https) whenever possible"

You're done!

Much thanks goes to lifehacker, who put us on this subject with their post this week about Facebook allowing HTTPS access everywhere.