Facebook And The HTTPS/Security Paradox

The document discusses the security trade-offs as popular sites (especially Facebook) adopt HTTPS-only: encryption reduces risks like session sidejacking (e.g., FireSheep) and enhances user privacy, but it also prevents enterprise network devices (IDS/IPS) from inspecting encrypted content, creating a blindspot that can hide malware or rogue applications (e.g., Koobface). It reviews mitigation approaches — host-based controls, policy enforcement, and SSL-inspection proxies (noting trust and certificate validation challenges) — and recommends organizations weigh these options to balance privacy and security visibility.