Note: Simply downloading the APK is usually legal for research; using it on a network without explicit, written permission from the network owner is not.

Since 2015, Facebook has required HTTPS for every single connection. HSTS forces the browser to never downgrade to HTTP. Faceniff cannot decrypt TLS/SSL encrypted cookies. The packets you sniff will look like gibberish.

: FaceNiff was designed for session hijacking on unencrypted (HTTP) connections. Since most websites (Facebook, Twitter, etc.) now use HTTPS/SSL encryption