Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Meta's Messenger Certificate Pinning on macOS

texts.blog

Post reply on HN
Print view View original

31–40 of 136 posts

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#31

Post by simonw »

I'm really glad this is possible, because it's important for dispelling conspiracy theories.

Plenty of people are convinced that Facebook's apps spy on them through their microphone and use that to show them targeted ads.

The easiest way to disprove this is to monitor the traffic between the apps and Facebook's servers... but certificate pinning prevents this!

(Not that anyone who believes this can ever be talked out of it, see https://simonwillison.net/2023/Dec/14/ai-trust-crisis/#faceb... - but it's nice to know that we can keep tabs on this kind of thing anyway)

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#33

Post by saagarjha »

simonw wrote: post #31

I'm really glad this is possible, because it's important for dispelling conspiracy theories. Plenty of people are convinced that Facebook's apps spy on them through their microphone and use that to show them targeted ads. The easiest way to disprove this is to monitor the traffic between the apps and Facebook's servers... but certificate pinning prevents this! (Not that anyone who believes this can ever be talked out…

Unfortunately while this thing helps it doesn't actually conclusively stop any speculation. If I wanted to spy on you via app, I would encrypt the data inside the HTTPS stream and only decrypt it on my server.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#34

Post by actionfromafar »

simonw wrote: post #31

I'm really glad this is possible, because it's important for dispelling conspiracy theories. Plenty of people are convinced that Facebook's apps spy on them through their microphone and use that to show them targeted ads. The easiest way to disprove this is to monitor the traffic between the apps and Facebook's servers... but certificate pinning prevents this! (Not that anyone who believes this can ever be talked out…

And if spying works without using the microphone or whatever, the alternative is almost worse - it means Meta et al has such a good virtual “mind reading” Skinner model of you that they have a good hunch of what you will talk and think about. If we are not there yet, it’s only a matter of time with enough machine learning…

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#35

Post by ncann »

saagarjha wrote: post #33
simonw wrote: post #31

I'm really glad this is possible, because it's important for dispelling conspiracy theories. Plenty of people are convinced that Facebook's apps spy on them through their microphone and use that to show them targeted ads. The easiest way to disprove this is to monitor the traffic between the apps and Facebook's servers... but certificate pinning prevents this! (Not that anyone who believes this can ever be talked out…

Unfortunately while this thing helps it doesn't actually conclusively stop any speculation. If I wanted to spy on you via app, I would encrypt the data inside the HTTPS stream and only decrypt it on my server.

Pretty sure anything you encrypt client side can be decrypted client side, as long as you have control over the binary and OS/hardware. It's just a matter of effort.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#38

Post by HaZeust »

actionfromafar wrote: post #34
simonw wrote: post #31

I'm really glad this is possible, because it's important for dispelling conspiracy theories. Plenty of people are convinced that Facebook's apps spy on them through their microphone and use that to show them targeted ads. The easiest way to disprove this is to monitor the traffic between the apps and Facebook's servers... but certificate pinning prevents this! (Not that anyone who believes this can ever be talked out…

And if spying works without using the microphone or whatever, the alternative is almost worse - it means Meta et al has such a good virtual “mind reading” Skinner model of you that they have a good hunch of what you will talk and think about. If we are not there yet, it’s only a matter of time with enough machine learning…

This is always what has screwed with me the most about this AdTech thought experiment: Both likelihoods (listening-in vs astute prediction models) are equally bad; and whoever downplays either as "business as usual" or "humans are predictable", respectively, ought to be called out for it.

It's NOT good when you listen to conversations without explicit (or implied, for that matter) consent, just as it's equally NOT good to exploit human predictive models to such a precise degree for profit. You SHOULDN'T be complicit to these practices, and saying that it's "just what it is" is one more person in the arena that's throwing their hands up to allow it. Attempt for change is ALWAYS better than apathy for complacency - before every interaction exists to become a transaction.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#39

Post by bevekspldnw »

eugenekolo wrote: post #37

There's no point in implementing cert pinning if you don't also have integrity checking... Being able to alter bytes in the physical file and running it should not be possible (without another bypass).

Eh, clearly it raises the barrier to entry significantly. You’re never safe from a truly determined adversary, but you can keep out the riff raff.

Re: Cracking Meta's Messenger Certificate Pinning on macOS

#40

Post by wkat4242 »

Good reminder that no app is truly ever "closed source" after all there is still the compiled machine code. People used to hand code in this language.

Though I'm personally glad we no longer have to :) it's still way more difficult and compilers can really obfuscate the code (if it isn't already by design)

Post reply on HN