Facebook users need to explicitly turn on HTTPS in Facebook’s account settings for the browser to communicate with Facebook over an encrypted channel. Even if a user secures their own connection to Facebook, there is no way to guarantee that the other party in a chat session also has HTTPS turned on.