Reading this article I'm just thinking that Facebook has wing that's just an NSA front at this point.
Pretty much every large tech company collaborated during the Prism leaks.
How did Facebook intercept their competitor's encrypted mobile app traffic?
111–120 of 222 posts
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#112So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market research” and install the proxy. The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. (I’d love to get more detail on exactly what the participants were told they were getting paid for, but I’d be surpr…
No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out.
This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was even more invasive.[2]
So no, this Onavo bullshit isn’t defensible at all.
[1] https://apkpure.com/onavo-protect-from-facebook/com.onavo.sp...
[2] https://techcrunch.com/2019/01/29/facebook-project-atlas/?re...
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#113The email snippets are impressive on multiple levels, mainly how fucking stupid/arrogant people at FB must be. Openly talking about MITM, and then getting multiple other companies to include this kit in their products as well is just beyond stupid for putting in writing. "Hey Zuck, I have an idea on your proposal. We should get together to discuss in person" would be suspect, but at least it's not incriminating. It's…
A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.
When putting down something in writing, you should also remember cardinal Richelieu's quote: "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#114The email snippets are impressive on multiple levels, mainly how fucking stupid/arrogant people at FB must be. Openly talking about MITM, and then getting multiple other companies to include this kit in their products as well is just beyond stupid for putting in writing. "Hey Zuck, I have an idea on your proposal. We should get together to discuss in person" would be suspect, but at least it's not incriminating. It's…
A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.
This is excellent advice. Another thing I will add is if something is not ethical, misleading, or dishonest, just do not do it. The world will be a better place if people behave ethically. Also, I strongly suspect that long term success in business requires ethical conduct.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#115This is why we should be doing dual-server-client TLS certificate exchange before stuffing damaging info over Internet. But, alas, nooooooooo.
How would mutual TLS have helped here?
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#116Earlier quoted context omitted.
A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.
More importantly these days, have the same thought every time you write a comment on Slack or Teams.
elaborate? was there some specific case?
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#117Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common. The one that I wonder about a lot is this: there are two (non-deprecated) types of webview you can use in iOS: WKWebview and SFSafariViewController. They’re intended for very different uses. When you tap on a link in the Facebook app they should use SFSafariViewController. It’s private (app code has no visibility int…
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#118I think a relative of mine once almost signed up for another market research thing that would have done essentially this, redirecting all their phone's internet traffic through a VPN & proxy controlled by the market research company, including installing their Cert. They would have received some small compensation for it, and of course consented to having it installed. I don't recall the company being misleading about anything, exactly. That being said, while I generally am not in favor of overly paternalistic policies, I wonder how meaningful the consent of someone with relatively little technical knowledge for something like this really is. They were not misleading about things, but also didn't fully spell things in a way that would really drive home what was going on for someone unaware.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#119Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common. The one that I wonder about a lot is this: there are two (non-deprecated) types of webview you can use in iOS: WKWebview and SFSafariViewController. They’re intended for very different uses. When you tap on a link in the Facebook app they should use SFSafariViewController. It’s private (app code has no visibility int…
I wasn’t aware that WKWebView granted the app such power. Is there a way for me as a user to figure out if WKWebView or SFSafariViewController is being used if I have a web page open? Although I don’t use FB, I do use the web view of other apps and don’t want them to be able to do this either.
SFSafariViewController is less customizable visually so the standard "sheet coming up within the app" that looks always the same regardless of the app (at least in most apps and of course not Meta's apps) is that one.
Having said that, since WKWebView is just a view that can be customized visually, nothing can stop someone to create a WKWebView-wrapping view controller that looks exactly like the "safe" Safari one anyway.
Re: How did Facebook intercept their competitor's encrypted mobile app traffic?
#120Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common. The one that I wonder about a lot is this: there are two (non-deprecated) types of webview you can use in iOS: WKWebview and SFSafariViewController. They’re intended for very different uses. When you tap on a link in the Facebook app they should use SFSafariViewController. It’s private (app code has no visibility int…
> Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common.
10 million installs on Android, according to AndroidRank[1]. What we don't know (yet) is what % of those installs had the FB competitor traffic MITM'd.
[1] https://www.androidrank.org/application/onavo_protect_from_f...