How does Facebook stop a BREACH attack?

Though Facebook has moved to an HTTPS format, that doesn’t mean the site is completely safe. There’s a general attack on HTTPS-friendly sites called BREACH, which interacts with the technology that usually shields against a different attack called cross-site request forgery (CSRF).

CSRF is used against sites with user accounts, such as Facebook. According to Facebook, the attacker convinces the user’s browser to send plausible web requests to the target website. It’s masked as a common request, so it doesn’t raise any red flags within the browser.

If that works, then the attacker can pose as their victim, sending spam or stealing information.

Facebook