Facebook finally provided a way to keep any random jerk in the café from hijacking your account. But you have to go out of your way to enable this protection, and you might have to wait. Still: Jump on this. 
 
 Facebook has at long last offered an option to use the encrypted "HTTPS" protocol, a feature it will begin rolling out today but won't finish for a "few weeks." You should check now if it's available, and sign up as soon as it is enabled for your account. The performance overhead is minor—zippy Gmail, for example, uses HTTPS for everything—and it's an important step to keep your Facebook account safe from being hijacked on an open or poorly secured wireless network. 
 
 By default, Facebook sends your access credentials in the clear, with no encryption whatsoever. Switching to HTTPS is important because a browser extension called Firesheep has made it especially easy for anyone sharing your open wireless network—at cafe or conference, for example—to sniff your credentials and freely access your account. One blogger sitting in a random New York Starbucks was able to steal 20-40 Facebook identities in half an hour. HTTPS solves this longstanding problem by encrypting your login cookies and other data; in fact the inventor of Firesheep made the software to encourage companies like Facebook to finally lock down their systems. 
 
 You can sign up for Facebook HTTPS by going to Account Settings and then selecting "Account Security," third from the bottom. Then click under "Secure Browsing" — if it's there. Facebook says everyone should have this by the end of the day, but in the meantime you might be missing the relevant option toggle. 
 
 Facebook is sure taking its sweet time rolling this out. Firesheep has been out for more than three months, and the EFF released a plugin for secure Facebook connections back in June. Even the HTTPS option is half measure. It applies only on the website, not on Facebook's iPhone app. 
 
 And HTTPS should really be automatic for all Facebook users, not an opt-in buried in one of Facebook's famously labyrinthine settings menus. Facebook seems to recognize this, writing, "We hope to offer HTTPS as a default whenever you are using Facebook sometime in the future." Given that Facebook secures not only intimate pictures and chats but people's credentials on other websites, that future really can't come soon enough. But if history is any guide, Facebook's users are in for a long wait for proper security. ||||| This Friday is Data Privacy Day, an international effort by governments, businesses and advocacy groups to raise awareness about the importance of staying in control of personal information. A key part of controlling information has always been protecting it from security threats like viruses, malware and hackers. 
 
 That's why we've developed a number of complex systems that operate behind the scenes to keep you secure on Facebook. In addition, we've created some advanced features you can use to help protect yourself even more, such as remote logout and one-time passwords. These features are especially useful when you're uncertain whether your network or computer is secure. Today, we're announcing two new such features. 
 
 A Secured Connection 
 
 If you've ever done your shopping or banking online, you may have noticed a small "lock" icon appear in your address bar, or that the address bar has turned green. This indicates that your browser is using a secure connection ("HTTPS") to communicate with the website and ensure that the information you send remains private. Facebook currently uses HTTPS whenever your password is sent to us, but today we're expanding its usage in order to help keep your data even more secure. 
 
 Starting today we'll provide you with the ability to experience Facebook entirely over HTTPS. You should consider enabling this option if you frequently use Facebook from public Internet access points found at coffee shops, airports, libraries or schools. The option will exist as part of our advanced security features, which you can find in the "Account Security" section of the Account Settings page. 
 
 There are a few things you should keep in mind before deciding to enable HTTPS. Encrypted pages take longer to load, so you may notice that Facebook is slower using HTTPS. In addition, some Facebook features, including many third-party applications, are not currently supported in HTTPS. We'll be working hard to resolve these remaining issues. We are rolling this out slowly over the next few weeks, but you will be able to turn this feature on in your Account Settings soon. We hope to offer HTTPS as a default whenever you are using Facebook sometime in the future. 
 
 Social Authentication 
 
 At Facebook we strive to put people at the center of all of our products and to design every experience you have on the site to be social. This is obvious in products like photos, where pictures are organized around the people that appear in them. We also want to bring the benefits of social design to experiences where you wouldn't traditionally expect them, like account security. Social authentication is our latest effort toward this goal. 
 
 The vast majority of people who have used Facebook have never experienced a security problem. However, if we detect suspicious activity on your account, like if you logged in from California in the morning and then from Australia a few hours later, we may ask you to verify your identity so we can be sure your account hasn't been compromised. 
 
 Many sites around the web use a type of challenge-response test called a captcha in their registration or purchasing flows. The purpose of this test is to verify that you are a human being and not a computer trying to game the system. Traditional captchas have a number of limitations including being (at times) incredibly hard to decipher and, since they are only meant to defend against attacks by computers, vulnerable to human hackers. 
 
 Instead of showing you a traditional captcha on Facebook, one of the ways we may help verify your identity is through social authentication. We will show you a few pictures of your friends and ask you to name the person in those photos. Hackers halfway across the world might know your password, but they don't know who your friends are. 
 
 We will continue to test social authentication and gather feedback from you and the security community on how to make this and other social features safe and useful. 
 
 <object width=400 height=224><param name=allowfullscreen value=true></param><param name=movie value="http://www.facebook.com/v/10150398154330484"></param><embed src="http://www.facebook.com/v/10150398154330484" type="application/x-shockwave-flash" allowfullscreen=true width=400 height=224></embed></object> 
 
 To learn more about how to keep your information safe on Facebook and across the internet, please visit the Facebook Security Page. 
 
 Alex Rice, a security engineer, is enjoying Facebook from a coffee shop.
– Facebook has begun rolling out an important new protection, and Gawker's Ryan Tate says users should "jump on this" as soon they can. It's an encryption tool called Facebook HTTPS that will "keep any random jerk in the café from hijacking your account." Unfortunately, users have to opt-in to the service, at least for now, and Tate offers a walk-through of how to do it under Account Settings. (Facebook does, too, in its blog post.) You may not be able to make the switch immediately, but keep checking back. "Switching to HTTPS is important because a browser extension called Firesheep has made it especially easy for anyone sharing your open wireless network—at cafe or conference, for example—to sniff your credentials and freely access your account," writes Tate. Also note that this protection doesn't apply to the Facebook iPhone app.