3 ms·

I think he's arguing that since both twitter and facebook (and other unnamed sites) do not use adsense, but are still vulnerable to firesheep, there must be ano

I think he's arguing that since both twitter and facebook (and other unnamed sites) do not use adsense, but are still vulnerable to firesheep, there must be another reason why developers don't update the security for their website.

BrandonM 16y ago
Facebook has an HTTPS version, but Facebook Chat doesn't work over HTTPS.
- mike-cardwell 16y ago
  Unfortunately, Facebook's XMPP service doesn't utilise SSL either. They hash the password, but everything else is trivally decodable on the wire. Plus there was the hole in Facebook chat which exposed your conversations to your friends earlier this year. Possibly the worse IM system in existence.
- tlrobinson 16y ago
  Facebook's HTTPS site is utterly useless. 1. Go to https://www.facebook.com/ https://www.facebook.com/ 2. Log in. 3. Immediately you get redirected back to http://www.facebook.com http://www.facebook.com WTF?! 4. Click logout. 5. Go back to https://www.facebook.com/ https://www.facebook.com/ 6. This time you get redirected to https://ssl.facebook.com/ https://ssl.facebook.com/ and you're STILL LOGGED IN. Actually now that I try the same thing with the non-SSL version of the site I have the same problem. WTF is going on? The only way I'm able to log out is by deleting the facebook.com cookies. I'm on Safari 5.
  - random42 16y ago
    I would have tested the cases for you, but fortunately, I have deleted my FB account. I dont trust them with anything.
  - BrandonM 16y ago
    I use HTTPS Everywhere to force Facebook to use SSL. I can't comment on the effectiveness of their site under normal conditions.