Secure browsing by default
Jul 31, 2013Scott Renfro
Summary
This post details the migration of Facebook to HTTPS by default for all users, a significant security enhancement. It outlines the technical challenges and solutions implemented, including the use of the 'secure' attribute for authentication cookies, an insecure indicator cookie to manage session ambiguity, the upgrade of third-party platform applications to support HTTPS, strategies for controlling referrer headers, and a two-part migration process for existing sessions. Performance considerations, such as leveraging edge networks and abbreviated handshakes, are also discussed, along with future plans for enhanced security measures like 2048-bit RSA keys, Elliptic Curve Cryptography, ECDHE, Certificate Pinning, and HSTS.
More from the Application Security and Permissions trail
- How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees
- Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study
- Labyrinth 1.1: Making End-to-End Encrypted Backups Even More Reliable
- How Meta Is Strengthening End-to-End Encrypted Backups
- Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways