Secure browsing by default

What this post added

This post details the migration of Facebook to using HTTPS by default for all users, a significant step in enhancing application security and data privacy. It outlines the technical challenges and solutions implemented, including the secure attribute for authentication cookies, an insecure indicator cookie, ensuring third-party platform applications support HTTPS, controlling referrer headers, and strategies for in-flight session upgrades. Performance considerations for HTTPS, such as leveraging edge networks and reducing full TLS handshakes through abbreviated handshakes and session resumption, are also discussed. Future plans include adopting 2048-bit RSA keys, Elliptic Curve Cryptography, ECDHE for perfect forward secrecy, certificate pinning, and HSTS.