3 ms·

Not only that, Facebook serves it's JavaScript from a static content server that is not secured using SSL, or when it is, it's a bad certificate. Combined with

Not only that, Facebook serves it's JavaScript from a static content server that is not secured using SSL, or when it is, it's a bad certificate. Combined with Chrome's aggressive insecure script blocking, Facebook is a nightmare to use. tl;dr: If you think you're secure because Facebook says HTTPS, you're completely wrong. If I'm on your network, I can inject javascript just as happily as if facebook were loading over http. This has been reported and ignored, as one might guess.

mkjones 15y ago
Hey, I work on security at Facebook, and when you've turned on HTTPS mode you definitely should not be pulling javascript from anywhere over HTTP (and of course our CDNs should all have valid certificates!). You're correct that this breaks a lot of the security that HTTPS offers. Do you have an example packet capture or list of HTTP CDN URLs that were referenced when you were in HTTPS mode? Or of the domain with an invalid certificate? I'll try to get that fixed ASAP. I'd also love to debug your report getting ignored - do you know where you submitted it? We take white hat reports pretty seriously and I know I've seen a number of them resolved in less than a day after being reported. Check out https://www.facebook.com/whitehat https://www.facebook.com/whitehat to report stuff in the future (we'll even pay a bounty of $500 for most properly-disclosed security bugs: https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/).
- drivebyacct2 15y ago
  I'll take a capture next time and grab the <head> tag from the body. The biggest problem is that it's very sporadic. Some days it will work perfectly with no warnings and exceptions. Earlier today though, I got the "Security Warning" from Google and improper certificate (not even on the static assets) on a network that I trust to a high degree.
  - mkjones 15y ago
    Cool, thanks for the follow-up. Was the "Security Warning" you're talking about from google.com, or from facebook.com? If facebook, do you know what the specific domain was that caused the error (and the reason for the error)? Also, I'm curious where you reported this before? If there's an issue causing security bug reports to get dropped, that's something I want to fix ASAP. Thanks!
    - drivebyacct2 15y ago
      The security warning was the alarming red one generated by Chrome, but for the Facebook site and domain. I can't tell you if it was for the root domain or www, and I'm afraid I do not recall the error. I get a bit confused with Chrome (because it has various levels of warnings for various types of things (the page itself, scripts, stylesheets, etc) and it doesn't help that I'm on the dev channel, but sometimes I get the full blown red warning, sometimes I get the red X through the https in the url bar and sometimes I get "Insecure Script was Blocked" which occurs strangely, when I receive notifications. I honestly don't remember where I reported this before, it was not at the link you've offered above. I've got that bookmarked now. Like I said, if I have someone to contact or the whitehat link you mentioned, I will be sure to get a more detailed list of what happens when it occurs again. Thanks.
nbm 15y ago
Are you sure this is still happening? I loaded a few pages, and every resource on those pages was served over HTTPS (and I got no errors, and I'm using Chrome). If you can either reproduce it still, or have any further information, I know a few people here who would like to hear about it.

mkjones 15y ago

Hey, I work on security at Facebook, and when you've turned on HTTPS mode you definitely should not be pulling javascript from anywhere over HTTP (and of course our CDNs should all have valid certificates!). You're correct that this breaks a lot of the security that HTTPS offers. Do you have an example packet capture or list of HTTP CDN URLs that were referenced when you were in HTTPS mode? Or of the domain with an invalid certificate? I'll try to get that fixed ASAP. I'd also love to debug your report getting ignored - do you know where you submitted it? We take white hat reports pretty seriously and I know I've seen a number of them resolved in less than a day after being reported. Check out https://www.facebook.com/whitehat https://www.facebook.com/whitehat to report stuff in the future (we'll even pay a bounty of $500 for most properly-disclosed security bugs: https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/).

drivebyacct2 15y ago
I'll take a capture next time and grab the <head> tag from the body. The biggest problem is that it's very sporadic. Some days it will work perfectly with no warnings and exceptions. Earlier today though, I got the "Security Warning" from Google and improper certificate (not even on the static assets) on a network that I trust to a high degree.
- mkjones 15y ago
  Cool, thanks for the follow-up. Was the "Security Warning" you're talking about from google.com, or from facebook.com? If facebook, do you know what the specific domain was that caused the error (and the reason for the error)? Also, I'm curious where you reported this before? If there's an issue causing security bug reports to get dropped, that's something I want to fix ASAP. Thanks!
  - drivebyacct2 15y ago
    The security warning was the alarming red one generated by Chrome, but for the Facebook site and domain. I can't tell you if it was for the root domain or www, and I'm afraid I do not recall the error. I get a bit confused with Chrome (because it has various levels of warnings for various types of things (the page itself, scripts, stylesheets, etc) and it doesn't help that I'm on the dev channel, but sometimes I get the full blown red warning, sometimes I get the red X through the https in the url bar and sometimes I get "Insecure Script was Blocked" which occurs strangely, when I receive notifications. I honestly don't remember where I reported this before, it was not at the link you've offered above. I've got that bookmarked now. Like I said, if I have someone to contact or the whitehat link you mentioned, I will be sure to get a more detailed list of what happens when it occurs again. Thanks.

nbm 15y ago

Are you sure this is still happening? I loaded a few pages, and every resource on those pages was served over HTTPS (and I got no errors, and I'm using Chrome). If you can either reproduce it still, or have any further information, I know a few people here who would like to hear about it.