This is why we should be doing dual-server-client TLS certificate exchange before stuffing damaging info over Internet. But, alas, nooooooooo.
You can do certificate pinning.
How did Facebook intercept their competitor's encrypted mobile app traffic?
101–110 of 222 posts
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#102They do this on my work laptop. Zscaler
Big companies do MITM and deep packet inspection on company laptops that is normal - not normal is doing that on private devices.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#103"There is a current class action lawsuit against Meta in which court documents include claims that the company had breached the Wiretap Act."
This is not a wiretapping case. The claims are all for violations of the Sherman Act. Plaintiffs' attorneys _incidentally_ found evidence during discovery that Facebook may have breached the Wiretap Act. There are no wiretapping claims. It is an antitrust case.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#104The email snippets are impressive on multiple levels, mainly how fucking stupid/arrogant people at FB must be. Openly talking about MITM, and then getting multiple other companies to include this kit in their products as well is just beyond stupid for putting in writing. "Hey Zuck, I have an idea on your proposal. We should get together to discuss in person" would be suspect, but at least it's not incriminating. It's…
A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.
More importantly these days, have the same thought every time you write a comment on Slack or Teams.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#105"There is a current class action lawsuit against Meta in which court documents include claims that the company had breached the Wiretap Act." This is not a wiretapping case. The claims are all for violations of the Sherman Act. Plaintiffs' attorneys _incidentally_ found evidence during discovery that Facebook may have breached the Wiretap Act. There are no wiretapping claims. It is an antitrust case.
Thanks, I have modified the wording and also quoted you and linked this HN post on the blog page.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#106Earlier quoted context omitted.
Our apps would be deplatformed on Android and iOS, and our businesses would be prosecuted by the DoJ and FBI.
Looks like this was the real reason Facebook could not comply with China's data sovereignty laws and had to abandon the market. The fact Apple and Microsoft services both work in China shows they are a little more trustworthy.
That's one possible read. The other possible read is that Apple and Microsoft both agreed to let the CCP
decrypt all user data, which makes them less trustworthy in my book. You really gonna believe they couldn't have a similar arrangement with the US TLAs after that?
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#107Earlier quoted context omitted.
> seriously, how does this not violate wire tapping laws? does agreeing to ToS mean you also agree to being spied on in a way that protects them? It’s not really spelled out clearly in the article, but this was a specific program where people had to choose to opt-in in exchange for compensation. This wasn’t simply Facebook hijacking random people’s traffic because they accepted the ToS or used the Facebook app Not de…
> This wasn’t simply Facebook hijacking random people’s traffic because they accepted the ToS or used the Facebook app Do you have further insights or references on what was the "trigger condition"? This is a new case, separate to the previous litigation related to the VPN app.
[deleted]
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#108Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common. The one that I wonder about a lot is this: there are two (non-deprecated) types of webview you can use in iOS: WKWebview and SFSafariViewController. They’re intended for very different uses. When you tap on a link in the Facebook app they should use SFSafariViewController. It’s private (app code has no visibility int…
I wasn’t aware that WKWebView granted the app such power. Is there a way for me as a user to figure out if WKWebView or SFSafariViewController is being used if I have a web page open? Although I don’t use FB, I do use the web view of other apps and don’t want them to be able to do this either.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#109Earlier quoted context omitted.
Not in 2020, no. HSTS causes your browser to pin the first cert that it sees (from sites opting in to this scheme), so nobody (even the legitimate operator) can swap it out before it expires. https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Securi... And specifically to the scenario in OP, app clients these days do not use the OS cert store, they will ship a single well-known server cert and only accept that one…
When HSTS is enabled, browsers don't pin the specific cert, just that HTTPS is required. Pinning the cert would mean users would experience outages (because you can't swap the cert early), which would be a terrible experience.
HSTS is https required and it needs to be a validated cert; issued by a trusted CA and not expired (maybe also not before the not before date). And the usual ignore it and move on button is gone.
Doesn't help if you're worried about a trusted CA issuing a cert for your domain without your approval though. Certificate transparency helps a bit with that; Chrome requires certs issued with a not before after april 30, 2018 to be in CT logs[1], so at least you'll be able to know a certificate was issued for your domain. If that happens, you can ask the CA/Browser forum to investigate and there's a good chance the CA will get kicked out if there's not a good explaination of what happened. That's not perfect but it's better than without CT when you could only know about an unauthorized cert if you managed to see it.
[1] I think max validity was two years back then, so all current certs need logs
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#110Reading this article I'm just thinking that Facebook has wing that's just an NSA front at this point.
or unit 8200 front (since we're talking about Facebook Israel)