Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did Facebook intercept their competitor's encrypted mobile app traffic?

doubleagent.net

Post reply on HN
Print view View original

151–160 of 222 posts

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#151

Post by redserk »

reaperman wrote: post #135
H8crilA wrote: post #131

Earlier quoted context omitted.

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

Maybe you're on H1B and if you get let go you have to go back to Sri Lanka, whose government collapsed 2 years ago and left the country in political disarray. Some people have better choices than others. Like I wouldn't work on this project, but I have US citizenship. In college I slept over at some of my Indian friends' apartments and often they had like 8-12 guys sleeping in one bedroom, it was just a bunch of matt…

Or you have a nice bucket of RSUs that have been jumping in value and figure it’s just another project to pass time.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#152

Post by dylan604 »

ben0x539 wrote: post #129
xmprt wrote: post #88

Earlier quoted context omitted.

A piece of advice I've taken to heart is whenever I'm sending something in writing, to think about how I would feel if I needed to repeat the same things in court or if I found those messages in the news. Not that I've ever said anything near that egregious but it still helps.

Whenever I'm discussing something in person I think about how I would feel if it turned out my employer was breaking the law and me not putting it in writing stopped the injured parties from obtaining just compensation.

It sounds like you have a soul and/or morals. The people writing the emails in TFA clearly have neither.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#153

Post by reaperman »

ignoramous wrote: post #149
reaperman wrote: post #135

Earlier quoted context omitted.

Maybe you're on H1B and if you get let go you have to go back to Sri Lanka, whose government collapsed 2 years ago and left the country in political disarray. Some people have better choices than others. Like I wouldn't work on this project, but I have US citizenship. In college I slept over at some of my Indian friends' apartments and often they had like 8-12 guys sleeping in one bedroom, it was just a bunch of matt…

> Why do people work on such projects? >> Maybe you're on H1B and if you get let go you have to go back to Sri Lanka... I mean that's there too, but in this case, the guy who ran this spyware op was a former IDF turned chief of Facebook in Israel, later promoted to CISO for all of Meta.

Yes, I generally blame management. But sometimes I blame the engineers when its obvious they had other good options.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#154

Post by reaperman »

redserk wrote: post #151
reaperman wrote: post #135

Earlier quoted context omitted.

Maybe you're on H1B and if you get let go you have to go back to Sri Lanka, whose government collapsed 2 years ago and left the country in political disarray. Some people have better choices than others. Like I wouldn't work on this project, but I have US citizenship. In college I slept over at some of my Indian friends' apartments and often they had like 8-12 guys sleeping in one bedroom, it was just a bunch of matt…

Or you have a nice bucket of RSUs that have been jumping in value and figure it’s just another project to pass time.

If you have other good options, thats just greed. Sure its painful to turn down $200k in RSU’s but if you can jump ship and still get paid a respectable $160k I don’t have much sympathy for your choice to fuck over millions of people just so you can buy a house two years sooner.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#155

Post by theptip »

oefrha wrote: post #112
theptip wrote: post #54

So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market research” and install the proxy. The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. (I’d love to get more detail on exactly what the participants were told they were getting paid for, but I’d be surpr…

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was e…

This is a bit tangled. I think this is new information but it’s all about Onavo. From OP:

> Note this is different to what TechCrunch had revealed in 2019 in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines. With the new MITM information revealed: what is currently unclear is if all app users had their traffic "intercepted" or just a subset of users.

So this seems to be new information about the Onavo Android app, but it’s not clear to me if the “install cert” button described was exactly the implementation of the previously reported research cert, or a new vector where people other than market research participants were MiTM’d. The analysis is just a bunch of circumstantial observations that _it is possible_ FB was doing more skeezy stuff than was previously known. But nothing here is incompatible with the previously reported stuff being all that happened, AFAICT.

The TechCrunch article clearly states that Onavo was the method they used to get the FB Research cert onto devices. (Presumably they distributed a different build of Onavo with their enterprise distribution channel), it quotes:

> “We now have the capability to measure detailed in-app activity” from “parsing snapchat [sic] analytics collected from incentivized participants in Onavo’s research program,” read another email.

This sounds to me that there was one Onavo research program, but who knows, we have multiple project codenames.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#156

Post by theptip »

vlovich123 wrote: post #95
theptip wrote: post #54

So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market research” and install the proxy. The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. (I’d love to get more detail on exactly what the participants were told they were getting paid for, but I’d be surpr…

From the article: > Note this is a new case, different from the one that TechCrunch also covered in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines.

This has since been edited in OP, and the full quote I think supports my claim more:

> Note this is different to what TechCrunch had revealed in 2019 in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines. With the new MITM information revealed: what is currently unclear is if all app users had their traffic "intercepted" or just a subset of users.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#157

Post by IG_Semmelweiss »

dl9999 wrote: post #136
kotaKat wrote: post #134

Earlier quoted context omitted.

It takes the correct morally bankrupt person to be willing to take the job.

Or a person with a sick kid, or who is about to be evicted, or who made some bad financial decisions or for some other reason is about to run out of food money. In those situations it's very easy to rationalize that the good outweighs the bad. I've only been in a similar situation once. I could barely sleep at night for a week before I finally told them that I couldn't do it. In my situation I would have taken a fina…

Why would you diminish all those silent heroes who do decline the morally bankrupt job despite not making rent , or having to carry bad financial decisions?

The truth is that in the US we do have some very expensive social safety nets, and it always comes back to the morals of the individual. You can rationalize just about anything against all kinds situations, but in the end we are talking about someone morally corrupt, or morally steadfast.

Dont justify the injustifiable.

Instead Judge character in the hard times and use that opportunity elevate the heroes that do the right thing im the face of adversity.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#158

Post by throwaway55717 »

Intermernet wrote: post #140
H8crilA wrote: post #131

Earlier quoted context omitted.

Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.

I was talking about this with friends the other night. If you've been in the industry long enough, you've probably been party to creating something horrible. It takes a while for the reality of horribleness to crack the glamour of creation and monetary reward, but once it does, everyone I personally know has quit and lived with the regret. I know people who have worked for adtech, gambling and HFT industries who now…

Due to an incarcerated family member, I had to deal with privately run prison telecom software, which was as awful and exploitative as you would expect, I could see where someone might feel guilty for working in this area. Evil business model.

But one of the worst things about the software was all the bugs. Silent failures so we couldn't tell what was happening, if it was a software problem or if our loved one was being prevented from communicating with us. The messaging and video call system failed us at some crucial moments and created a lot of emotional stress.

In fact I think this is part of the awful business model -- cut costs even if it hurts people.

Bad software can really make the lives of incarcerated people much worse. So if you were able to do a decent job on that software, whether it was prison telecom or internal tools for a prison contractor, you may have still had a more positive impact than you think, despite the broader business model being totally evil.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#159

Post by [deleted] »

haxrob wrote: post #70
eightysixfour wrote: post #58

Earlier quoted context omitted.

Victims that were being paid to participate? Edit: Not excusing Facebook here, but feel like this whole thing is in a weird grey area. It is like getting paid to have a Nielsen box monitoring your TV and then complaining when you find out it also knew what you watched on your DVD player.

> Victims that were being paid to participate I believe you might be referring to what happened in 2019? [1] This is a separate issue. [2] I do clarify this in the blog post, although it might be better to move the relevant text near the introduction rather then in the middle of the post. EDIT: I have also added a remark to the post that it is not clear if all users were MITM'd or just a subset [1] https://techcrunch…

[deleted]

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#160

Post by spencerflem »

reaperman wrote: post #154
redserk wrote: post #151

Earlier quoted context omitted.

Or you have a nice bucket of RSUs that have been jumping in value and figure it’s just another project to pass time.

If you have other good options, thats just greed. Sure its painful to turn down $200k in RSU’s but if you can jump ship and still get paid a respectable $160k I don’t have much sympathy for your choice to fuck over millions of people just so you can buy a house two years sooner.

I don't either. It seems to me that a lot of CS people don't have the same values as we do unfortunately. A sad mix of computers seeming apolitical - 'I just wanna hack' and as a well paid industry, the same money maximizers that would in previous years been business majors.
Post reply on HN