Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did Facebook intercept their competitor's encrypted mobile app traffic?

doubleagent.net

Post reply on HN
Print view View original

121–130 of 222 posts

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#121

Post by iam-TJ »

dylan604 wrote: post #19
ahazred8ta wrote: post #17

Earlier quoted context omitted.

Try comparing P2P OTR E2EE vs Non-CA TOFU SSH

hell, even I don't know what the "words" you just used mean!

That got me too for a few seconds whilst my brain cogs whirred... but the latter sounds tastier than the former for some reason!

For those wondering:

  P2P OTR E2EE == Peer to Peer, Off The Record, End to End Encryption
  Non-CA TOFU SSH == Non-Certificate Authority, Trust On First Use, Secure SHell

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#122

Post by fastest963 »

afavour wrote: post #82

Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common. The one that I wonder about a lot is this: there are two (non-deprecated) types of webview you can use in iOS: WKWebview and SFSafariViewController. They’re intended for very different uses. When you tap on a link in the Facebook app they should use SFSafariViewController. It’s private (app code has no visibility int…

They definitely inject JS as we had a problem with them breaking certain JS calls with payment autofill before [1].

[1] https://x.com/jameshartig/status/1534886418266431488

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#123

Post by mschuster91 »

jdthedisciple wrote: post #116
b800h wrote: post #104

Earlier quoted context omitted.

More importantly these days, have the same thought every time you write a comment on Slack or Teams.

elaborate? was there some specific case?

Trouble at many orgs regarding the Israel vs Palestine conflict. No matter on which side of that clusterfuck you are - unless you are in a lobbyist group for either side, someone at your org will be offended and raise a stink.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#124

Post by mschuster91 »

dagmx wrote: post #85
xbmcuser wrote: post #81

I don't know why but Facebook is the one tech company that I just can't have a good opinion about. I like and dislike Google, Microsoft, Apple, NvidiA, AMD, Intel and the rest for different things but I just hate Facebook. I closed my facebook account about 10-11 years back put a filter to keep facebook out of my search results. And I have to say it works I rarely see anything about Facebook on my Google news feeds e…

Probably a combination of - they’ve had a long history of trying to undermine privacy to extend profits. From stuff like in the article, to tracking pixels, alleged ghost accounts, and fighting anything that hampers tracking. Of the companies you listed, only Google has any crossover, but doesn’t come anywhere near as close. - they’re irresponsible with the effects of their algorithm to amplify hate speech. None of y…

> - they’re irresponsible with the effects of their algorithm to amplify hate speech. None of your other companies have anything like that.

Twitter is arguably worse - especially after Musk's takeover.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#125

Post by globular-toast »

dylan604 wrote: post #4

The email snippets are impressive on multiple levels, mainly how fucking stupid/arrogant people at FB must be. Openly talking about MITM, and then getting multiple other companies to include this kit in their products as well is just beyond stupid for putting in writing. "Hey Zuck, I have an idea on your proposal. We should get together to discuss in person" would be suspect, but at least it's not incriminating. It's…

So you'd rather they were smarter and able to hide the traces of their malicious behaviour?

The real problem here is the complete absence of any kind of ethics. It sounds like the kind of place where if you consider ethics to be a blocker you'd be laughed out of the room, or fired. Corporate culture is to chase profit above anything else. It's especially bad in software, though, as so many people don't even seem to think about the ethical implications of their actions ever.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#126

Post by croisillon »

afavour wrote: post #82

Not to downplay it but at least this requires users to download the Onavo app, which isn’t so common. The one that I wonder about a lot is this: there are two (non-deprecated) types of webview you can use in iOS: WKWebview and SFSafariViewController. They’re intended for very different uses. When you tap on a link in the Facebook app they should use SFSafariViewController. It’s private (app code has no visibility int…

i don’t have instagram but i have facebook; when people send me links to instagram videos on messenger, the view doesn’t let me watch it unless i login (in fact create an account), i can only watch it loading externally into safari

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#127

Post by pavlov »

xbmcuser wrote: post #81

I don't know why but Facebook is the one tech company that I just can't have a good opinion about. I like and dislike Google, Microsoft, Apple, NvidiA, AMD, Intel and the rest for different things but I just hate Facebook. I closed my facebook account about 10-11 years back put a filter to keep facebook out of my search results. And I have to say it works I rarely see anything about Facebook on my Google news feeds e…

> “And I have to say it works I rarely see anything about Facebook on my Google news feeds etc.”

The company is called Meta nowadays, so that also explains why you don’t see much news about Facebook.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#128

Post by NayamAmarshe »

xbmcuser wrote: post #81

I don't know why but Facebook is the one tech company that I just can't have a good opinion about. I like and dislike Google, Microsoft, Apple, NvidiA, AMD, Intel and the rest for different things but I just hate Facebook. I closed my facebook account about 10-11 years back put a filter to keep facebook out of my search results. And I have to say it works I rarely see anything about Facebook on my Google news feeds e…

> I still use WhatsApp though as that is the biggest communication app outside China in Asia

This is still contributing to their monopoly. WhatsApp's monopoly is growing and they've even blatantly started to copy the competition: Telegram.

Disagreeing publicly does nothing if I'm the one empowering my opposition in the first place.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#129

Post by ben0x539 »

xmprt wrote: post #88
dylan604 wrote: post #4

The email snippets are impressive on multiple levels, mainly how fucking stupid/arrogant people at FB must be. Openly talking about MITM, and then getting multiple other companies to include this kit in their products as well is just beyond stupid for putting in writing. "Hey Zuck, I have an idea on your proposal. We should get together to discuss in person" would be suspect, but at least it's not incriminating. It's…

A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.

Whenever I'm discussing something in person I think about how I would feel if it turned out my employer was breaking the law and me not putting it in writing stopped the injured parties from obtaining just compensation.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#130

Post by meiraleal »

tjpnz wrote: post #22
dylan604 wrote: post #4

The email snippets are impressive on multiple levels, mainly how fucking stupid/arrogant people at FB must be. Openly talking about MITM, and then getting multiple other companies to include this kit in their products as well is just beyond stupid for putting in writing. "Hey Zuck, I have an idea on your proposal. We should get together to discuss in person" would be suspect, but at least it's not incriminating. It's…

If any of these miscreants were looking for a new job I bet the place you work would be getting in line to put them through an interview loop.

Post-COVID big tech ex-employees aren't really what you would expect a decade ago.
Post reply on HN