Edit: SSL does not have to be used on the clone. Most people will not notice/care.
The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do that. Only a few percent would go "wait a minute, this is Facebook. That certificate should be valid." Some people here might reply "no way", but HN generally contains the one percent.
Edit: This is almost correct. You can actually prevent being redirected from http to https when typing in "facebook.com" without https:// in front. My bad.
Still though, the attentive user would notice the missing padlock. I check it 3/4 times, and 4/4 times when using a public network. I also refrain from using http sites where I log in (some forums I visit do that). But again, probably less than one percent of the tech people do that.
In my browser (FF nightly), I see the HSTS header, with the value: "max-age=15552000; preload"
If I do a request with curl, no header... (which is probably what this app sees).
I don't have a clue why they are doing that, though. Not that curl would do something with the HSTS header anyway, but still...
This is not entirely correct. HSTS[0] was designed to protect against such attacks.
It's true, however, that not every browser out there supports it yet, and you must visit the website at least once without MITM for the server to successfully communicate HSTS header. (In Chrome certain domains are included in built-in list[1], though.)
[0] https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_s...
[1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...