3 ms·
Perhaps the article doesn't have enough detail in it. But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords. It doesn't sound li
by bcx 16y ago
Perhaps the article doesn't have enough detail in it. But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords.
It doesn't sound like a directed attack on facebook, though perhaps it was a session replay attack.
The real question for me, is why didn't facebook already require SSL login.
- jawher 16y ago> But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords Nope, Facebook's login page, if requested over http, was manipulated on the fly to inject a javascript code that is triggered when the login button is clicked. It retrieves the login/password values from the form and sends them to another url, besides Facebook's login url.