Surprisingly the only change they have done is to change the login form into a popup instead of an IFRAME embedded in the site. Here is the screenshot of how it looks now:
But still no SSL ! I wonder why ? Even the form POST is on non-SSL - means your login credentials are in clear and you are vulnerable to MITM attacks (eavesdropping).
Posts
3 comments:
To be fair, the standard log in page doesn't use https either...
hmm even though their standard login page is displayed on "http", the login form POST w/ user credentials does use "https".
Here is a html code snippet from their login page:
{form method="POST" action="https://login.facebook.com/login.php" name="menubar_login" id="menubar_login"}
I'm an engineer on the Facebook Connect team, and your post is incorrect. Login credentials are indeed posted over SSL.
As Praveen points out, the form itself isn't served https, but the form that receives the credentials is.
We are working on serving the actual form off of SSL as well, but for the time being the user's information is protected.
Post a Comment