Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did Facebook intercept their competitor's encrypted mobile app traffic?

doubleagent.net

Post reply on HN
Print view View original

61–70 of 222 posts

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#61

Post by Aurornis »

dylan604 wrote: post #20
ARandomerDude wrote: post #13

If you or I did this, we would already be in jail for phishing plus whatever add-on charges the Feds could file. Meta has Washington in their pocket so this will never leave civil court. The penalty will be less than the money made, meaning somebody gets a bonus for being creative.

seriously, how does this not violate wire tapping laws? does agreeing to ToS mean you also agree to being spied on in a way that protects them? you are deliberately circumventing encryption for malicious purposes. if people got in trouble for DeCSS for circumventing encryption, how is this okay? pithy "because they have all the monies" replies not wanted.

> seriously, how does this not violate wire tapping laws? does agreeing to ToS mean you also agree to being spied on in a way that protects them?

It’s not really spelled out clearly in the article, but this was a specific program where people had to choose to opt-in in exchange for compensation.

This wasn’t simply Facebook hijacking random people’s traffic because they accepted the ToS or used the Facebook app

Not defending the program, but it’s not what a lot of comments are assuming.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#63

Post by Uvix »

theptip wrote: post #57
safety1st wrote: post #34

Earlier quoted context omitted.

So I mean, just taking a quick look at the contents of /etc/ssl/certs and what Firefox shows me when I hit its View Certificates button, I see among dozens of other actors, Amazon, Microsoft, GoDaddy, and the Beijing Certificate Authority. No software has ever asked me if I want to trust any of these guys, they've been silently trusted during a software install I suppose. Does this mean they can all MITM my TLS traff…

Not in 2020, no. HSTS causes your browser to pin the first cert that it sees (from sites opting in to this scheme), so nobody (even the legitimate operator) can swap it out before it expires. https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Securi... And specifically to the scenario in OP, app clients these days do not use the OS cert store, they will ship a single well-known server cert and only accept that one…

When HSTS is enabled, browsers don't pin the specific cert, just that HTTPS is required. Pinning the cert would mean users would experience outages (because you can't swap the cert early), which would be a terrible experience.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#64

Post by haxrob »

theptip wrote: post #54

So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market research” and install the proxy. The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. (I’d love to get more detail on exactly what the participants were told they were getting paid for, but I’d be surpr…

> from what I can tell FB paid SC users to participate in “market research” and install the proxy.

The app was available on both the Google Play and Apple App stores for anyone to download.

> The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case.

It could be that you are confused with a previous case. From the blog post:

> The wiretapping claim is new and perhaps not to be confused with the prior controversy and litigation: In 2023, two subsidiaries of Facebook was ordered to pay a total of $20M by the Australian Federal Court for "engaging in conduct liable to mislead in breach of the Australian Consumer Law", according to the ACCC ... Facebook had shutdown Onavo in 2019 after an investigation revealed they had been paying teenagers to use the app to track them. Also that year, Apple went as far as to revoke Facebook's developer program certificates, sending a clear message.

> If this is wiretapping, is it also wiretapping for me to use a local SSL proxy to decrypt and analyze traffic to a service’s API

If by "local" on your own network/machine with your own traffic then obviously no.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#65

Post by giancarlostoro »

hypeatei wrote: post #29
dylan604 wrote: post #20

Earlier quoted context omitted.

seriously, how does this not violate wire tapping laws? does agreeing to ToS mean you also agree to being spied on in a way that protects them? you are deliberately circumventing encryption for malicious purposes. if people got in trouble for DeCSS for circumventing encryption, how is this okay? pithy "because they have all the monies" replies not wanted.

Big tech and telecommunications companies are effectively miniature arms of the U.S. government at this point. As seen by the "Protect America Act" of 2007[0], the government will retroactively cover their own ass and your companies' ass if deemed important enough to the intelligence apparatus. There isn't a chance in hell that Meta would be brought criminal charges for wiretapping. 0: https://en.wikipedia.org/wiki/P…

I'm assuming they were doing it for the federal government at this point. There's no reason for them to spy on another app, they can hire almost any developer they want.

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#69

Post by toomuchtodo »

Animats wrote: post #46
ARandomerDude wrote: post #13

If you or I did this, we would already be in jail for phishing plus whatever add-on charges the Feds could file. Meta has Washington in their pocket so this will never leave civil court. The penalty will be less than the money made, meaning somebody gets a bonus for being creative.

> If you or I did this, we would already be in jail for phishing plus whatever add-on charges the Feds could file. Yes. It's a good opportunity for an ambitious state attorney general to prosecute Facebook, of course.

https://www.naag.org/find-my-ag/

https://www.consumerresources.org/file-a-complaint/

Re: How did Facebook intercept their competitor's encrypted mobile app traffic?

#70

Post by haxrob »

eightysixfour wrote: post #58
dilyevsky wrote: post #56

Earlier quoted context omitted.

That’s not sufficient - you also need to intercept traffic somehow which they successfully accomplished by buying this vpn company and using them to proxy victims traffic through their infra

Victims that were being paid to participate? Edit: Not excusing Facebook here, but feel like this whole thing is in a weird grey area. It is like getting paid to have a Nielsen box monitoring your TV and then complaining when you find out it also knew what you watched on your DVD player.

> Victims that were being paid to participate

I believe you might be referring to what happened in 2019? [1] This is a separate issue. [2]

I do clarify this in the blog post, although it might be better to move the relevant text near the introduction rather then in the middle of the post.

EDIT: I have also added a remark to the post that it is not clear if all users were MITM'd or just a subset

[1] https://techcrunch.com/2019/01/29/facebook-project-atlas/

[2] https://techcrunch.com/2024/03/26/facebook-secret-project-sn...

Post reply on HN