Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did Facebook intercept their competitor's encrypted mobile app traffic?

doubleagent.net

Post reply on HN
Print view View original

131–140 of 222 posts

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#131

Post by H8crilA »

oefrha wrote: post #112
theptip wrote: post #54

So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market research” and install the proxy. The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. (I’d love to get more detail on exactly what the participants were told they were getting paid for, but I’d be surpr…

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was e…

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#132

Post by smcin »

bschne wrote: post #118

I think a relative of mine once almost signed up for another market research thing that would have done essentially this, redirecting all their phone's internet traffic through a VPN & proxy controlled by the market research company, including installing their Cert. They would have received some small compensation for it, and of course consented to having it installed. I don't recall the company being misleading abou…

Just because some market research companies do informed disclosure, says nothing at all about how Onavo did this (and Onavo didn't advertise themselves to users as "market research company", just as some free neat app that would categorize your internet data usage).

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#133

Post by smcin »

dylan604 wrote: post #8
walrus01 wrote: post #3

tl;dr: If you install and fully trust a root CA on your client device, of course your TLS traffic can be MITMed. edit: the problem, obviously, is that this app tricked the non-technical people into installing/trusting the root CA for malicious purposes. Clearly this was malware.

That's great for someone reading this forum to be aware of, but moms have no idea what any of the words you just wrote means. So if they were told they get a coupon for installing or some other bit of ridiculous things malware devs use, and yes I'm calling FB software malware. All of if it. Messenger, FB.app, everything. If it's from Meta, it's malicious.

"the average parent"

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#134

Post by kotaKat »

H8crilA wrote: post #131
oefrha wrote: post #112

Earlier quoted context omitted.

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was e…

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

It takes the correct morally bankrupt person to be willing to take the job.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#135

Post by reaperman »

H8crilA wrote: post #131
oefrha wrote: post #112

Earlier quoted context omitted.

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was e…

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

Maybe you're on H1B and if you get let go you have to go back to Sri Lanka, whose government collapsed 2 years ago and left the country in political disarray. Some people have better choices than others.

Like I wouldn't work on this project, but I have US citizenship. In college I slept over at some of my Indian friends' apartments and often they had like 8-12 guys sleeping in one bedroom, it was just a bunch of mattresses all laid together with no specific sleeping arrangement. Generally they made a giant pot of stew/daal/whatever once a week and ate the same thing for every meal all week, some even long after graduating with PhD's and getting low-tier visa-mill jobs. This was not a T10 school, our international students rarely came from wealthy families. One of my Saudi classmates came from a poor family in a remote village near the Iraq border and brushed his teeth with a twig from the Salvadora persica tree.

I couldn't really blame them if they didn't have another good option readily available.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#136

Post by dl9999 »

kotaKat wrote: post #134
H8crilA wrote: post #131

Earlier quoted context omitted.

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

It takes the correct morally bankrupt person to be willing to take the job.

Or a person with a sick kid, or who is about to be evicted, or who made some bad financial decisions or for some other reason is about to run out of food money. In those situations it's very easy to rationalize that the good outweighs the bad.

I've only been in a similar situation once. I could barely sleep at night for a week before I finally told them that I couldn't do it. In my situation I would have taken a financial hit if they decided to let me go, but my wife works and I have savings and there was no immediate threat, and it still was a difficult decision.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#137

Post by dagmx »

mschuster91 wrote: post #124
dagmx wrote: post #85

Earlier quoted context omitted.

Probably a combination of - they’ve had a long history of trying to undermine privacy to extend profits. From stuff like in the article, to tracking pixels, alleged ghost accounts, and fighting anything that hampers tracking. Of the companies you listed, only Google has any crossover, but doesn’t come anywhere near as close. - they’re irresponsible with the effects of their algorithm to amplify hate speech. None of y…

> - they’re irresponsible with the effects of their algorithm to amplify hate speech. None of your other companies have anything like that. Twitter is arguably worse - especially after Musk's takeover.

Oh for sure there are worse companies. They just aren’t in the list of companies in the comment I replied to.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#138

Post by echoangle »

H8crilA wrote: post #131
oefrha wrote: post #112

Earlier quoted context omitted.

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was e…

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

You really think the engineers working on this will be personally liable for this? That would honestly surprise me, the worst i can imagine is punishment for the company as an entity.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#139

Post by hiatus »

ben0x539 wrote: post #129
xmprt wrote: post #88

Earlier quoted context omitted.

A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.

Whenever I'm discussing something in person I think about how I would feel if it turned out my employer was breaking the law and me not putting it in writing stopped the injured parties from obtaining just compensation.

So send a follow up email post meeting recapitulating the key points.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#140

Post by Intermernet »

H8crilA wrote: post #131
oefrha wrote: post #112

Earlier quoted context omitted.

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was e…

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

I was talking about this with friends the other night. If you've been in the industry long enough, you've probably been party to creating something horrible. It takes a while for the reality of horribleness to crack the glamour of creation and monetary reward, but once it does, everyone I personally know has quit and lived with the regret.

I know people who have worked for adtech, gambling and HFT industries who now try to convince younger devs to avoid them. I personally worked briefly for a private prison corp, and I feel dirty and remorseful that I had anything to do with that industry.

Post reply on HN