[dead]
Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
151–160 of 189 posts
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#152[dead]
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#153Earlier quoted context omitted.
Security SWE here. I have worked with WhatsApp's security engineers, I donate hundreds to the Signal Foundation every year, and I like to think I have a good amount of experience by now in the security industry. > you are a fool if you install WhatsApp [...] meta is balls deep inside the app and watching what you do. WhatsApp uses the same protocols as Signal under the hood. The Signal team even helped WhatsApp imple…
> Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin. thats a freaking lie and you should feel bad for repeating it. it was barely reviewd years ago. before all the shady features that even caused the original founder to leave the company (and a few billions worth of golden handcuffs) with an open letter about how fb destroyed privacy in WhatsApp. EU and all…
> thats a freaking lie and you should feel bad for repeating it.
It's trivial to RE the app. Plenty of 3Ps continually RE the app.
Support your claims of WhatsApp being backdoored with facts, not random assertions you pull out of - where, exactly?
> EU and all sane state actors forbid its use
Because it is E2EE. You don't want government employees to use an E2EE service because it kills transparency.
> some recommends signal
WhatsApp and Signal share the same exact protocol.
> all recent political leaks was from fb (e.g. brazil, italy)
Irrelevant to WhatsApp. They're run by a completely separate team within Meta, have completely different leadership and reporting chains, and has a completely separate codebase and architecture.
Again, support your claims with actual facts instead of incoherent angry rambling. Is it backdoored? Can Meta access your messages? Provide proof.
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#154Earlier quoted context omitted.
Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.
outside of the imperium center, you'd be lucky to have one provider of some product or service. and usually they will only be reachable via whatsapp. because metabook used whatsbook as a backdoor for for their failed oneinternet(?) project. remember the backlash fb got when they offered free internet in india and africa but only for the Facebook app? well, everywhere in the world you get free whatsapp traffic, so eve…
> metabook won on this.
They won on distributing E2EE and the Signal Protocol to 99% of the world, which previously transmitted everything in plain? Sounds like a pretty good win to me.
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#155Earlier quoted context omitted.
I also hope that any ethically minded engineers inside Meta take a stand against this BS. The only way stuff like this happens is because engineers working on these projects decide that they can set aside whatever morals they may have had for the price of a big fat FAANG pay cheque. It's about time our profession adopted a code of ethics, like that of the ACM[1]. To the engineers who _have_ walked away despite the ob…
I was directly involved in this. I am happy to answer any questions you have about questioning or ethics at the time. Assuming that people's reaction to this was wrong, while not knowing what that reaction was, or having less than 5% of the context, isn’t going to help much. Short answer: No, there were strong arguments for it. I reached out for institutional support to answer some questions, groups that I expected t…
I understand that things are often more nuanced than they may appear, and in questions of moral judgement there will always be room for fuzziness. Personally I think the idea of compromising security for everyone in order to make life a little easier for the TLA's is not something I'd feel comfortable doing. I consider an individuals right to privacy paramount, something without which we risk unbounded tyrannical rule. Others will probably feel differently when presented with 'think of the children' style arguments. I'm glad to hear though that you were at least conflicted enough to be asking questions.
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#156Earlier quoted context omitted.
That could be either Mullvad or ProtonVPN. Both are Swiss zero log, Mullvad has a flat 5 euro/month charge that goes back to when they started to (they say) forever - you can send them cash in envolope for the next twenty years with a generated account number and you're away. ProtonVPN has plans - the two year streaming sign up is 4.99 euro/month.
Mullvad is not Swiss, it's Swedish.
Fair point and one that I knew, my bad for typing faster than thought :/
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#157Earlier quoted context omitted.
Real life is full of compromises. If your grandma is on WhatsApp, and you want to talk to her, it might be a good idea to install WhatsApp. (However, if you have time on your hand and principles, you can use WhatsApp on a burner phone, I guess?)
Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.
Sure, if you have time on your hand and principles, you can try convincing your grandma to change her ways.
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#158What do you think Cloudflare is doing with its SSL termination/offloading?
That's different. I have a lot of problems with CF, but when you sign up for a service which requires to see the traffic and you configure it explicitly to see your traffic... what's the complaint here?
Onavo users signed up, consented to their traffic data to be used for market research and were actually compensated for it. What's the complaint here ?
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#159Earlier quoted context omitted.
Here is a quote from Facebook/Meta's legal council to the Judge. In this document "Advertisers" refers to Snapchat, YouTube and Amazon. "... the Wiretap Act provides that an interception is not unlawful if a party to the communication “has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d). Advertisers conspicuously fail to mention—and apparently do not contest—that Meta obtained participants’ prior co…
Lawyer here. No. They have ...'d out an important part of 2511(2)(d). (and they probably meant (c)) First, it starts out with: "It shall not be unlawful under this chapter for a person not acting under color of law " This basically means a state/federal official or someone acting in their capacity as one (the color of law part basically means it applies even when they act beyond their legal authority by accident) Whi…
> If I give consent to participate in collection of my internet data, it doesn't give you authorization to like, have someone live in my house and follow me around 24/7 so they can see what i do on the internet.
TV ratings used to be collected from panelists using a wearable device that literally had an always-on microphone recording you 24/7 : https://en.wikipedia.org/wiki/Portable_People_Meter
How is the situation of Onavo/Meta panelists worse ?
Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic
#160Direct link to PDF: https://s3.documentcloud.org/documents/24520332/merged-fb.pd... Here is Meta's response: https://ia802908.us.archive.org/29/items/gov.uscourts.cand.3... Meta denies that they violated the Wiretap Act but offers no evidence of consent. (They try, but it is a laughable attempt.) Meta is also arguing the documents are not relevant. Meta claims the VPN app intercepting communications with other compan…
I mean, sure, you could also do “market research” by breaking into people’s homes, reading their mail, and listening in on all their phone calls. I hope some actual criminal prosecution results from this disclosure, as it’s very clearly “hacking” and “wiretapping” and “unauthorized access”.
TV ratings used to be collected from panelists using a wearable device that literally had an always-on microphone recording you 24/7 : https://en.wikipedia.org/wiki/Portable_People_Meter
How is Onavo worse ?