4 ms·

What do you mean "risk losing your SSL?" Do you mean the "turn off SSL so I can access this canvas application?" thingy? As long as you don't click that, you

by mkjones 16y ago

What do you mean "risk losing your SSL?" Do you mean the "turn off SSL so I can access this canvas application?" thingy? As long as you don't click that, you shouldn't have to worry - if you've turned on HTTPS browsing, it only sends your auth cookies over HTTPS, so you're not vulnerable to downgrading attacks. If that is what you mean, how do you think it could be less scary? The idea is to strike a balance between security and usability, and if we'd love to do a better job of that where possible! (I work on security at facebook, though not the HTTPS implementation directly.)

X-Istence 16y ago
In Facebook under account settings there is an option for persistent SSL. If you turn on the Facebook platform and use any part of it, on any site (such as clicking a like button, or using Facebook comments, or using an "Facebook app" like Farmville (just an example)) it disables the SSL part of your account, and doesn't re-enable it when it can, instead your account is once again non-SSL enabled. Now, the last time I tested this was when Facebook comments came out on a test account I have, if it no longer disables SSL using Facebook comments that would certainly be a step up. Even then I don't want everything tied to my Facebook account, and it is not exactly easy to switch which Facebook account is used on which website.
- mkjones 16y ago
  Interesting - what do you mean by "your account is non-SSL enabled?" I've got persistent HTTPS turned on (and have not opted out of platform), and clicking a like button or commenting on a comment plugin does not add non-secure authentication cookies (i.e. I can still only use the site over HTTPS). Perhaps you had HTTPS turned off on your test account? As far as not wanting to comment with your FB account, you can sign in with Yahoo...?
  - X-Istence 16y ago
    When the SSL option first came out I tested this, and noticed that using the like button would turn SSL off in my settings, since then I have just used adblock to block all of the like buttons.

by mkjones 16y ago

X-Istence 16y ago

In Facebook under account settings there is an option for persistent SSL. If you turn on the Facebook platform and use any part of it, on any site (such as clicking a like button, or using Facebook comments, or using an "Facebook app" like Farmville (just an example)) it disables the SSL part of your account, and doesn't re-enable it when it can, instead your account is once again non-SSL enabled. Now, the last time I tested this was when Facebook comments came out on a test account I have, if it no longer disables SSL using Facebook comments that would certainly be a step up. Even then I don't want everything tied to my Facebook account, and it is not exactly easy to switch which Facebook account is used on which website.

mkjones 16y ago
Interesting - what do you mean by "your account is non-SSL enabled?" I've got persistent HTTPS turned on (and have not opted out of platform), and clicking a like button or commenting on a comment plugin does not add non-secure authentication cookies (i.e. I can still only use the site over HTTPS). Perhaps you had HTTPS turned off on your test account? As far as not wanting to comment with your FB account, you can sign in with Yahoo...?
- X-Istence 16y ago
  When the SSL option first came out I tested this, and noticed that using the like button would turn SSL off in my settings, since then I have just used adblock to block all of the like buttons.