Any update on this?
While I’m not doing anything with facebook, we do have an iframe’d payment form on one of our pages. The iframe src is https, but the page itself is not, leaving room for a MITM attack to replace the iframe src.
I have been contacted by a number of potential customers notifying me that they would have liked to sign up but will not so long as this is an issue.
Thanks,
Ariel