8 ms·
no that means that like any ISP they have full access to unencrypted traffic, including login POST requests
by piramida 16y ago
no that means that like any ISP they have full access to unencrypted traffic, including login POST requests
- rhc2104 16y agoBut login requests on Facebook do use SSL- if you use firebug on the Facebook homepage, the login form points to " https://login.facebook.com/login.php?login_attempt=1 https://login.facebook.com/login.php?login_attempt=1 ". The issue seems to be that code is injected in pages that merely contained a login form: http://blog.rootshell.be/2011/01/13/tunisia-tracks-users-with-javascript-injection/ http://blog.rootshell.be/2011/01/13/tunisia-tracks-users-wit...
- getsat 16y agoThis is why any page that lets you login to a site must also be accessible over HTTPS-only.
- staktrace 16y agoOr any page that points to a page that lets you log in to a site must be accessible over HTTPS-only. Or any page that points to a page that points to a page... you get the idea. SSL everything, or you lose.
- jawher 16y agoEven of the login form was submitted to a HTTPS url (which is the case), the fact that the login page was served over HTTP allows the government to inject the JS code, which will execute locally and retrieve the login and password inputs and send them via Ajax to another URL.
- wahnfrieden 16y agoActually no, they do inject code into the login pages. Here is the code injected into the FB login: http://www.hackerzvoice.net/node/105 http://www.hackerzvoice.net/node/105 It is not simply a case of sniffing traffic. They log what users input into the login form, via Javascript injection.