You're still not necessarily safe here from spoofing. If an attacker can gain access to your network (splicing a network cable somewhere, long term hacks again

You're still not necessarily safe here from spoofing. If an attacker can gain access to your network (splicing a network cable somewhere, long term hacks against wifi keys, etc) then they can run DNS or arp poisoning, and redirect all of your traffic through a transparent proxy that can strip off HTTPS and log all cookies and form submission. Many people will then type in 'www.facebook.com' into the address bar, and will see facebook as normal (minus the padlock, which most people wouldn't notice is missing). So: don't just type in 'www.facebook.com' ALWAYS type in 'https://www.facebook.com https://www.facebook.com manually, or make a habbit of checking the padlock on every page view (perhaps there is a chrome addon for this?) EDIT: and if you're being spoofed by a government or syndicate who has the ability to sign global certificates, then there is probably not much you can do.