Live data from Hacker News

Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

wsj.com

61–70 of 102 posts

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#61
post #57
post #54

Earlier quoted context omitted.

Running a DNS service doesn't give you the ability to see which pages someone visited when they navigated a website - just that they resolved that website's host name for some reason.

Many individual things Google does aren't too bad by themselves; the problem is that they are all integrated.

Google isn't misrepresenting what a DNS service does. Zuck is kind of a slimy weasel.

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#62
post #61
post #57

Earlier quoted context omitted.

Many individual things Google does aren't too bad by themselves; the problem is that they are all integrated.

Google isn't misrepresenting what a DNS service does. Zuck is kind of a slimy weasel.

I don't think most users fully appreciate that it exists purely to log your activity on sites that Google doesn't directly track through ads

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#63

"Alphabet Inc., through its Google Android operating system for smartphones, and Apple Inc. also have the ability to monitor how rivals' apps perform on their mobile platforms, but it isn't clear whether they use that information to shape their product road maps." Does anyone have any other sources that can confirm or deny whether Google/Apple use their mobile OSes like Facebook uses Onavo?

I'd imagine that platform companies have greater obligations towards their developers.

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#65
I'm glad WSJ followed up on their previous Onavo-Facebook story[1], but they didn't go far enough. They still didn't investigate the claims in many app store reviews of deceptive marketing that gets people to install this in the first place, i.e. "Your phone is infected by a virus, install this now!!" And yes, probably those ads can't be directly traced to Onavo/Facebook, but it's a free app with no affiliate commissions so they're only one with an incentive.

> A Facebook spokesman said it is clear when people download Onavo what information it collects and how it is used. “Websites and apps have used market-research services for years,” the spokesman said...

This is such a bullshit, disingenuous statement. It is not at all clear how Onavo uses your information. They have just one line in their description: "Onavo receives and analyzes information about your mobile data and app use." Here's why this is deceptive:

1. It is buried. It is the last line, below the "more..." fold so most users don't see it. Something this privacy-invasive should have a prominent, clear disclaimer at the top.

2. It is misleading. Even for the users that see it, they make no mention of using your data for market research. They prominently advertise a feature that reports on your overall data usage -- to you, the user. So this statement is just vague enough to imply that's what they're doing, without setting off alarm that they're spying on your every move for their own purposes.

And then they have the nerve to equate it with "market-research services" that everyone uses.. no big deal.. move along, nothing to see here.. What baloney. Typical market-research services do not involve spyware that you trick people into installing. Participants are supposed to know exactly what they're participating in. That is clearly not the case with this deceptive, exploitive app.

[1] Some previous discussion: https://news.ycombinator.com/item?id=14970877

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#66

This was a bad idea when the app was standalone—a no-name Israeli startup snooping into all your traffic—and now it's spyware. This is one major (if not THE) reason not to trust small startups with unclear privacy policies—they are often bought in order to (ab)use the data they have collected and continue abusing it from unsuspecting users. Terrible.

So, as the first tech hire/partner, what can we do to protect our users? - Expire non-critical data after 30 - 90 days, e.g. activity data, not account data. - When feasible, have the client encrypt the really private user data, only store encrypted blobs on the server (Protonmail does this). - Send out a positively worded, subtle email notice to warn the more savvy users of a pending acquisition, as soon as that new…

SSL with pinned certificates would get you 95% there and is super easy to implement.

And then only keep the data you actually need. And even of what you need you can probably anonymize a large chunk

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#67
post #62
post #61

Earlier quoted context omitted.

Google isn't misrepresenting what a DNS service does. Zuck is kind of a slimy weasel.

I don't think most users fully appreciate that it exists purely to log your activity on sites that Google doesn't directly track through ads

That's a big distinction though. I don't think Google has the obligation to make sure users are educated and informed. The deceptive practice of Facebook with Onavo is what people object to.

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#68
post #4

The same article from alternative source https://outline.com/WnGGRk

If you prepend "facebook.com/l.php?u=" to a wsj link, it will let you read the full article. Like so:

https://facebook.com/l.php?u=https://www.wsj.com/articles/fa...

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#69

Earlier quoted context omitted.

>"Having Xposed and XPrivacy on my old phone," I would be curious to hear your feed back on Xposed oand Xprivacy. Also it sounds like you stopped using them, maybe you could say why? Cheers.

I now have a phone with Nougat, according to the Xposed developers, Xposed doesn't yet work reliably with it. On Marshmallow it worked very well, Xprivacy would show pop-ups when an app tries to do something, you can either allow this, refuse this or allow/refuse for a period of time. Otherwise, Xprivacy's UI is a bit of a pain, but it's usable...

Do you remember what the performance impact of xprivacy was? I'm currently doing something similar with cyanogenmod's privacy guard + xposed app ops which allows statically revoking permissions, but Xprivacy seems to have a better little-snitch like ui

Re: Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

#70
post #61
post #57

Earlier quoted context omitted.

Many individual things Google does aren't too bad by themselves; the problem is that they are all integrated.

Google isn't misrepresenting what a DNS service does. Zuck is kind of a slimy weasel.

True this. I think it was on Ars Technica that I was downvoted to oblivion for raising the privacy implications of Google's DNS service.

There is a huge segment of the semi-tech literate crowd that feel wise for using it. I think it's because it's the only time they get to type in an IP address and it makes them feel l33t.

Post reply on HN