Facebook Enables HTTPS So You Can Share Without Being Hijacked - Wired News

Facebook announced Wednesday it would begin supporting a feature to protect users from having their accounts hijacked over Wi-Fi connections or snooped on by schools and businesses.

Facebook users will now have the option of using Facebook over HTTPS, the encryption protocol used to protect online banking sessions and user logins for services of all kinds on the web.

The announcement comes just a day after Mark Zuckerberg’s own account was seemingly hijacked.

Currently Facebook only uses HTTPS to send a user’s password to the company and the Facebook.com homepage doesn’t use HTTPS. The dangers of that design decision became very clear earlier this month when the Tunisian government, via the country’s largest ISP, inserted rogue JavaScript into the html of Facebook.com’s homepage as users loaded it, in order to steal passwords of activists. It used those passwords to delete accounts and pages critical of the regime.

The change is intended to give users a way to protect themselves from Wi-Fi snoopers, who can sniff packets going over unsecured Wi-Fi. This let’s them watch what a user is doing on Facebook (or any site not using HTTPS) and even log-in to the user’s account and pretend to be them on Facebook temporarily.

It’s not clear if the option would have prevented the hijacking of Zuckerberg’s account, but it almost certainliy would have prevented Tunisia’s snooping on users if they had the protection option turned on.

Computer security researcher Christopher Soghoian notes that move also comes a full year after FTC Commissioner Pamela Jones Harbour called for more sites to start using HTTPS by default.

“Even though that is a decade in internet time, it is still pretty quick in terms of a firm responding to pressure from regulators,” Sogohoian said in an e-mail.

“Of course, I would be even happier if Facebook deployed HTTPS by default, or if it at least provided users with notice when they log in that the option exists,” he added. “Similarly, Facebook could auto-detect when users try to login from a Starbucks Wi-Fi connection, and shift them to HTTPS by default.”

Currently, Google’s Gmail is the only major internet service to set users to default, while Hotmail and Google’s search page can be used with HTTPS, but it’s not the default.

So-called session hijacking was made even easier in October 2010, with the release of a Firefox plugin called Firesheep, that made it simple for anyone to perform this hijacking.

Facebook security engineer Alex Rice warns, however, that speed and third-party applications could be affected.

“Encrypted pages take longer to load, so you may notice that Facebook is slower using HTTPS,” Rice said in a blog post. “In addition, some Facebook features, including many third-party applications, are not currently supported in HTTPS. We’ll be working hard to resolve these remaining issues.”

That trickery is much harder to do with an HTTPS page, since it would require the complicity of a Certificate Authority, which would likely be blackballed by the net at large if it was discovered faking a certificate for a site.

Using HTTPS always may slow the site loading for some, but Google has found with its new default of HTTPS for all users, that the encryption isn’t nearly as server-intensive as many engineers and companies think it is.

Facebook users will need to find the setting on their Facebook page (Account Settings->Account Security) to make it the default for their account. Facebook is rolling it out for all users over the next few weeks.

The option is highly recommended for anyone who uses Facebook over open Wi-Fi or on their school or office connection.

For those who want further protection, try the EFF’s HTTPS Everywhere plug-in for Firefox, which forces many sites to use HTTPS. For total protection, investigate using a VPN such as CryptoCloud.

Photo: Street sign in South Africa. Credit: hmvh

View the original article here

Did Egypt Detain a Top Facebook Activist? [Updated] - Wired News

An Egyptian Facebook activist and leader of the group known as the April 6 Youth has been arrested in Cairo, friends told Wired.com Wednesday in e-mails. But those accounts were contradicted by the activist himself. (See update, below.)

Ahmed Maher, 30, gained prominence in 2008 as one of the co-founders of the April 6 Youth, a solidarity group launched to support protests. Organizing mostly online, especially on Facebook, it is a carefully decentralized network of activists, who have used the tools of social media to broadcast grievances with the Mubarak regime, mobilize support, evade the government’s ubiquitous security forces, and, now, help to bring the Mubarak regime to its knees.

Wired magazine published an article about the group in 2008. Its nascent, tech-fired rebellion helped ignite the revolution and the government backlash that has captured the world’s attention.

Maher and a friend launched a Facebook group to promote a protest planned for April 6, 2008. It became an internet phenomenon, quickly attracting more than 70,000 members. That protest died still-born, but Maher has continued to organize and has played a prominent role in the uprising of the past week aimed at toppling the 30-year rule of Hosni Mubarark.

Word of Maher’s arrest came from two separate sources shortly after protesters began to clash with pro-government groups after Mubarak pledged step down in September. That signaled a major escalation of violence after days of largely peaceful protests. The arrest could not immediately be confirmed.

Sherif Mansour, a senior program officer at Freedom House in Washington, D.C., has been in close contact with Maher and his group for years, and is currently trying to get through to some of Maher’s peers to glean details.

Early Wednesday morning, Wired.com also received its first correspondence in five days from an April 6 group member. “I am so sorry for the delay[ed response] because there’s no internet connection in Egypt since last Friday,” wrote 28-year-old Waleed Rashed in a short message sent on Facebook. “I am OK and my friends also. We will be in the street till Mubarak go. No another way. Just pray to us and we will be in touch.” It remains unclear at this point how Rashed was able to get online.

Update 6:33 pm: Wired.com reached Maher on his mobile phone late on Wednesday night local time. He said that he had not been arrested. When asked whether he had been detained and roughed up by the police — a common practice under the Mubarak regime — Maher was unable to reply.

Photo by Joerg Klaus

See Also:

View the original article here