Blog de Matias Katz Hablamos un poco de seguridad?

I've run into this shocking error message from my browser several times last week:

As a good paranoic person I am, the first thing I thought was:

1. I got into a Rogue Access Point
2. They did a Man-In-The-Middle with a fake certificate
3. I've been surfing for 10 minutes until I saw the error, so there's a big chance somebody has seen my activity
4. FUUUUUUU (for those of you not familiarized with the MEME, see it here)

Desperate, I analyzed the gateway's MAC against my Access Point's MAC (to which I have physical access to and could see the MAC address directly from the device) and everything matched. So I thought "ok, they did their job and ran away". So I started checking connection logs and more, and all indicated that I'd never hooked to any hotspot other than my own Wireless network. I sat and thought WHAT could have happened... Without answer.

Until I thought about checking the browser error in detail:

(The image shows that although an HTTPS session has been established, some of the content is being transferred in plain text)

It turns out that in my false sense of security, given by surfing the social network through HTTPS, there are still some insecure components that escape through the side. This activity is to expect, since webmasters organize the site in order for the content without personal value (such as ADs, generic site images, etc) to be transmitted in plain-text to reduce the overhead caused at the server when establishing a secure channel.

As I was already with my hands in the cookie jar, I decided to analize what specific content was transmitted in plain-text. so I checked the site source code, and big was my surprise when I ran into the following:

External links were transmitted to the user in plain-text. WHY ?? This is not necessary!!

I understand that the user will eventually end up surfing in plain-text through external links (since not every site offers HTTPS services), but at least inside Facebook they could be kept encrypted.

This is how it should be:

Facebook should obtain the insecure content from the original server and embed it inside its SSL channel.

However, this is what's actually happening:

The user is being fooled, by thinking that all his/her content is being transmitted securely. However Facebook, in order to avoid resource consumption in their servers, allows for an important security hole.

So I recommend you to be carefull with the information you manage through Facebook, even if you see HTTPS in the title. And when you see an error message in your browser, read it in detail.

Bye!