I haven’t really had time to look at this properly since Facebook got serious about HTTPS, but I wrote my own rules that both redirect EVERYTHING to https and make ALL cookies secure on ALL subdomains on <a href="http://facebook.com">facebook.com</a> (and <a href="http://facebook.net">facebook.net</a> and <a href="http://fbcdn.net">fbcdn.net</a>) and I haven’t noticed any problems. I don’t understand what the fuss is about now.<br>
<br><div class="gmail_quote">On Fri, May 6, 2011 at 1212 (UTC-7), Peter Eckersley <span dir="ltr"><<a href="mailto:pde@eff.org">pde@eff.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Sounds like we need an update to cover those Facebook subdomains, but the<br>
deeper issue is that the Facebook cookies are not flagged as secure. There<br>
are two things that you can do about this: (1) enable the optional Facebook+<br>
rule (which flags the cookies as secure but may break some things) or (2) turn<br>
on the "always use HTTPS" setting in your Facebook account. Ideally you<br>
should do both.<br>
<br>
As Facebook gradually fixes bugs in their HTTPS deployment, hopefully we can<br>
move towards merging the <securecookie> rules from the Facebook+ ruleset into the<br>
default one.<br>
<br>
On Fri, May 06, 2011 at 09:05:00AM -0700, Rebecca S. Reagan wrote:<br>
><br>
><br>
> Rebecca S. Reagan<br>
> Intake Coordinator<br>
> Electronic Frontier Foundation<br>
> (415)436-9333 Ext. 135<br>
> Become a Member! <a href="https://www.eff.org/support" target="_blank">https://www.eff.org/support</a><br>
><br>
><br>
> -------- Original Message --------<br>
> Subject: URGENT! BROKEN SSL MitM Vulnerability for HTTPS Everywhere ---<br>
> RE: HTTPS Everywhere doesn't cover all Facebook sub domains<br>
> Date: Fri, 6 May 2011 14:42:26 +0000<br>
> From: Decime, Jerry (IT Security) <<a href="mailto:jerry.decime@hp.com">jerry.decime@hp.com</a>><br>
> To: Rebecca Reagan <<a href="mailto:rsreagan@eff.org">rsreagan@eff.org</a>><br>
><br>
><br>
><br>
> Rebecca,<br>
><br>
> In addition to the ongoing issues with HTTPS Everywhere not actually<br>
> providing protection when visiting Facebook, it recently performed an<br>
> update for which I was able to get into the middle and push my own code<br>
> (to my own environment) rather than the actual update code from<br>
> <a href="http://www.eff.org" target="_blank">www.eff.org</a>. This was possible because it made an update request here:<br>
><br>
> <a href="https://www.eff.org/files/https-everywhere-update.rdf" target="_blank">https://www.eff.org/files/https-everywhere-update.rdf</a><br>
><br>
> It was then possible to modify the code location and signature:<br>
><br>
> <RDF:Description RDF:about="rdf:#$ybGCJ1"<br>
> NS1:id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" NS1:minVersion="3.5"<br>
> NS1:maxVersion="4.*"<br>
> NS1:updateLink="<a href="https://www.eff.org/files/https-everywhere-0.9.6.xpi" target="_blank">https://www.eff.org/files/https-everywhere-0.9.6.xpi</a>"<br>
> NS1:updateHash="sha1:31f800d2b1d15e994cdea0fbf0fdd72cf50c03b5"/><br>
><br>
> This was possible because <a href="http://www.eff.org" target="_blank">www.eff.org</a> <<a href="http://www.eff.org" target="_blank">http://www.eff.org</a>> is STILL<br>
> USING the non secure SSLv2 protocol:<br>
><br>
> <a href="https://www.eff.org/files/https-everywhere-update.rdf" target="_blank">https://www.eff.org/files/https-everywhere-update.rdf</a><br>
><br>
> PLEASE! Remove SSLv2 support & get this fixed ASAP!<br>
><br>
> Thanks,<br>
><br>
> Jerry Decime<br>
><br>
> Senior Security Strategist<br>
><br>
> Hewlett-Packard<br>
><br>
> *From:* Rebecca Reagan [mailto:<a href="mailto:rsreagan@eff.org">rsreagan@eff.org</a>]<br>
> *Sent:* Tuesday, November 16, 2010 5:30 PM<br>
> *To:* Decime, Jerry (IT Security)<br>
> *Subject:* Re: HTTPS Everywhere doesn't cover all Facebook sub domains<br>
><br>
> Dear Jerry,<br>
><br>
> Thank you for sending us follow up information. Our technologists are<br>
> aware of the methods you're describing and are considering various ways<br>
> to address the problems.<br>
><br>
> Again, thank you,<br>
><br>
> Rebecca S. Reagan<br>
><br>
><br>
> On 11/16/10 3:35 PM, Decime, Jerry (IT Security) wrote:<br>
><br>
> Release version 0.2.2. Also note that I’ve found that third-parties to<br>
> Facebook sometime fail to protect Facebook OAuth credentials with HTTPS<br>
> so the picture starts to look a bit bleak when it comes to locking down<br>
> the entire Facebook experience. Unfortunately it really does come down<br>
> to architecting applications correctly to begin with.<br>
><br>
> BTW, it’s really easy to test this plug-in by simply having all HTTP<br>
> traffic traverse The Fiddler2 & then watch and inspect any HTTP traffic<br>
> you might see. Optionally, you can also write a Fiddler2 rule to alert<br>
> you if it finds a pre-defined chunk of text. This is helpful for<br>
> automatically finding matches on session info and OAuth tokens.<br>
><br>
> Let me know if you need additional information or help.<br>
><br>
> Thanks,<br>
><br>
> Jerry Decime<br>
> Senior Security Strategist<br>
><br>
> Hewlett-Packard<br>
><br>
> *From:* Rebecca Reagan [mailto:<a href="mailto:rsreagan@eff.org">rsreagan@eff.org</a>]<br>
> *Sent:* Tuesday, November 16, 2010 4:29 PM<br>
> *To:* Decime, Jerry (IT Security)<br>
> *Subject:* Re: HTTPS Everywhere doesn't cover all Facebook sub domains<br>
><br>
> Dear Jerry,<br>
><br>
> Thank you for contacting the Electronic Frontier Foundation (EFF) with<br>
> your concerns. Do you know if you are using the release version of the<br>
> software, or the more aggressive development version? That would be<br>
> helpful information for us. We are working to close the gaps and<br>
> appreciate information of this nature.<br>
><br>
> Should you be interested in more information on HTTPS Everywhere, please<br>
> see the FAQ at <a href="http://www.eff.org/https-everywhere/faq" target="_blank">http://www.eff.org/https-everywhere/faq</a> or consider<br>
> joining the HTTPS Everywhere mailing list<br>
> <a href="https://falcon.eff.org/mailman/listinfo/https-everywhere" target="_blank">https://falcon.eff.org/mailman/listinfo/https-everywhere</a>.<br>
><br>
> Again, thank you for your conscientious work and for sharing the<br>
> information with us.<br>
><br>
> Yours,<br>
><br>
> Rebecca S. Reagan<br>
> Intake Coordinator<br>
><br>
> On 11/16/10 12:43 PM, Decime, Jerry (IT Security) wrote:<br>
><br>
> Attached is an HTTP capture using “The Fiddler2” which shows that your<br>
> HTTPS Everywhere plug-in for Firefox clearly does not guard against the<br>
> capture of session keys on Facebook since it doesn’t enforce HTTPS for<br>
> all sub domains containing sensitive session information. In the capture<br>
> file please reference requests for:<br>
><br>
> _<a href="http://apps.facebook.com_" target="_blank">http://apps.facebook.com_</a><br>
><br>
> _<a href="http://static.ak.connect.facebook.com" target="_blank">http://static.ak.connect.facebook.com</a> _<br>
><br>
> _<a href="http://pixel.facebook.com" target="_blank">http://pixel.facebook.com</a> _<br>
><br>
> I confirmed that the cookies available via these sub domains include<br>
> Facebook session information which could be used to authenticate a<br>
> session as the user:<br>
><br>
> From <a href="http://www.facebook.com" target="_blank">www.facebook.com</a> <<a href="http://www.facebook.com" target="_blank">http://www.facebook.com</a>> which is over HTTPS and<br>
> protected -> Cookie:<br>
> datr=1254513682-574ca117e8bd2a567f4b89716f2001469c25bf54e2afd8912cd3d;<br>
> lu=gg7I-qcyMqBuXz_2ipSNt3bg; c_user=100000117904896; sct=1288715876;<br>
> sid=5; xs=5051d732d54e78705c9075aef52d8eaa; locale=en_US<br>
><br>
> From <a href="http://apps.facebook.com" target="_blank">apps.facebook.com</a> which is over HTTP and not protected & confirms<br>
> the possibility of session hijack -> Cookie:<br>
> datr=1254513682-574ca117e8bd2a567f4b89716f2001469c25bf54e2afd8912cd3d;<br>
> lu=gg7I-qcyMqBuXz_2ipSNt3bg; c_user=100000117904896; sct=1288715876;<br>
> sid=5; xs=5051d732d54e78705c9075aef52d8eaa; locale=en_US<br>
><br>
> I downloaded the plug-in today, just before testing & installed it in a<br>
> browser which has never had the plug-in installed (using Firefox<br>
> 3.6.12). It enforces HTTPS elsewhere on Facebook, but not all sub<br>
> domains as shown in the attached capture.<br>
><br>
> Thanks,<br>
><br>
> Jerry Decime<br>
><br>
> Senior Security Strategist<br>
><br>
> Hewlett-Packard<br>
><br>
> _______________________________________________<br>
> HTTPS-everywhere mailing list<br>
> <a href="mailto:HTTPS-everywhere@mail1.eff.org">HTTPS-everywhere@mail1.eff.org</a><br>
> <a href="https://mail1.eff.org/mailman/listinfo/https-everywhere" target="_blank">https://mail1.eff.org/mailman/listinfo/https-everywhere</a><br>
<font color="#888888"><br>
--<br>
Peter Eckersley <a href="mailto:pde@eff.org">pde@eff.org</a><br>
Senior Staff Technologist Tel +1 415 436 9333 x131<br>
Electronic Frontier Foundation Fax +1 415 436 9993<br>
_______________________________________________<br>
HTTPS-everywhere mailing list<br>
<a href="mailto:HTTPS-everywhere@mail1.eff.org">HTTPS-everywhere@mail1.eff.org</a><br>
<a href="https://mail1.eff.org/mailman/listinfo/https-everywhere" target="_blank">https://mail1.eff.org/mailman/listinfo/https-everywhere</a><br>
</font></blockquote></div><br>--<br>Brian Drake<br><br>Alternate (slightly less secure) e-mail: <a href="mailto:brian@drakefamily.tk" target="_blank">brian@drakefamily.tk</a><br>Alternate (old) e-mail: <a href="mailto:brianriab@gmail.com" target="_blank">brianriab@gmail.com</a><br>
<br>Facebook profile: <a href="https://ssl.facebook.com/profile.php?id=100001669405117" target="_blank">Profile ID 100001669405117</a><br>
Twitter username: <a href="https://twitter.com/BrianJDrake" target="_blank">BrianJDrake</a><br>Wikimedia project username: <a href="https://secure.wikimedia.org/wikipedia/meta/wiki/User:Brianjd" target="_blank">Brianjd</a> (been inactive for a while)<br>
<br>All content created by me <a href="http://www.wipo.int/treaties/en/ip/berne/trtdocs_wo001.html" target="_blank">Copyright</a> © 2010–2011 Brian Drake. All rights reserved.<br>