[tor-bugs] #3104 [EFF-HTTPS Everywhere]: Infinite loops in Facebook settings pages

["Tor Bug Tracker & Wiki" <torproject-admin@xxxxxxxxxxxxxx>]

#3104: Infinite loops in Facebook settings pages
----------------------------------+-----------------------------------------
 Reporter:  pde                   |          Owner:  pde
     Type:  defect                |         Status:  new
 Priority:  major                 |      Milestone:     
Component:  EFF-HTTPS Everywhere  |        Version:     
 Keywords:                        |         Parent:     
   Points:                        |   Actualpoints:     
----------------------------------+-----------------------------------------
 Facebook HTTPS support is broken in strange ways for users who haven't
 enabled the optional Facebook HTTPS setting.

 For such users, pages like this one:

 https://www.facebook.com/editaccount.php?networks

 Redirect back to http.  In the past, that was merely a security flaw, but
 recently the redirect changed from an HTTP redirect to a fast JavaScript
 redirect, which means that our loop detection code does not spot it.  The
 redirection script is here:
 http://pastebin.com/SiWYzMug (note the hard-coded "http").

 This is really Facebook's bug, but we should also consider what we can do
 about cases like this.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3104>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs