Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

documentcloud.org

Post reply on HN
Print view View original

91–100 of 189 posts

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#91

Post by pixl97 »

FLT8 wrote: post #80
reaperman wrote: post #72

Earlier quoted context omitted.

Wouldn’t Meta simply hire unlicensed “engineers”?

You simply legislate that if a company is building anything that will be used regularly by more than eg. a few thousand people, then the work must be designed and/or signed off by a licensed engineer, who will a) be subject to a code of ethics and b) be professionally liable for any failures causing loss or damage to the public. We seem to be able to manage this with bridges, planes, electrical & hydro installations…

I mean with a thing like a plane you can say "that's not allowed in our state/country", with software that starts to get a whole lot more problematic. Soon you'll see people starting to push laws that say things like "because people are running dangerous software from outside the country we demand that only signed software can run on our phones/computers and that devices here must enforce it" coming out of our politicians that seemingly get a pile of cash from groups like Microsoft and META.

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#92

Post by andsoitis »

xvector wrote: post #65
defrost wrote: post #40

Earlier quoted context omitted.

That could be either Mullvad or ProtonVPN. Both are Swiss zero log, Mullvad has a flat 5 euro/month charge that goes back to when they started to (they say) forever - you can send them cash in envolope for the next twenty years with a generated account number and you're away. ProtonVPN has plans - the two year streaming sign up is 4.99 euro/month.

Ah, good 'ole trustworthy Swiss companies! Like Crypto AG![1] Realistically, all VPNs are compromised. But for most people's threat model, that's irrelevant anyways. Proton for instance revealed the location of a climate activist leading to his arrest[2], with the inspiring message from the CEO that "privacy protections can be suspended", silently on a per-user basis at any time. Haven't seen anything like that for M…

> Proton for instance revealed the location of a climate activist leading to his arrest[2], with the inspiring message from the CEO that "privacy protections can be suspended", silently on a per-user basis at any time.

That person isn't just a climate activist, they (and others who used that email account) broke French laws. Swiss authorities compelled the disclosure.

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#93

Post by kevin_thibedeau »

leononame wrote: post #24
wordhydrogen wrote: post #2

Documents and testimony show that this “man-in-the-middle” approach—which relied on technology known as a server-side SSL bump performed on Facebook’s Onavo servers—was in fact implemented, at scale, between June 2016 and early 2019. Facebook’s SSL bump technology was deployed against Snapchat starting in 2016, then against YouTube in 2017-2018, and eventually against Amazon in 2018. The goal of Facebook’s SSL bump t…

That is insane and I would be inclined to not believe it if someone had told me this. This is such an immense breach of trust that even for me, who has a very low opinion of Meta, it is unexpected. I hope this will blow up as much as it should

It's a criminal CFAA violation.

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#94

Post by justahuman74 »

leononame wrote: post #24
wordhydrogen wrote: post #2

Documents and testimony show that this “man-in-the-middle” approach—which relied on technology known as a server-side SSL bump performed on Facebook’s Onavo servers—was in fact implemented, at scale, between June 2016 and early 2019. Facebook’s SSL bump technology was deployed against Snapchat starting in 2016, then against YouTube in 2017-2018, and eventually against Amazon in 2018. The goal of Facebook’s SSL bump t…

That is insane and I would be inclined to not believe it if someone had told me this. This is such an immense breach of trust that even for me, who has a very low opinion of Meta, it is unexpected. I hope this will blow up as much as it should

I'm somewhat surprised it's taken this long to come out. It was something of a open secret that onavo was spying somehow on snapchat traffic within atleast the infra/release org back in 2016 era

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#95

Post by quitit »

_ink_ wrote: post #61

Isn't this known since 2018? https://mashable.com/article/facebook-used-onavo-vpn-data-to...

Yes it's old news(1) but it has come up again in numerous HN and reddit posts for a few reasons (if you flick through HN you'll see various versions of this story holding lower ranks.)

Also noteworthy is that Google were also doing something similar at the time, both were side-stepping Apple's privacy protections in iOS by using enterprise certificates that allowed the side-loading of apps without Apple's overview. In response Apple more thoroughly restricted how these certificates can be used.

Interestingly I've noticed in the DMA threads people suggesting that a company exploiting side-loading to dodge Apple's privacy protections was nothing more than fear mongering. As if this is a red line developers won't cross.

To me, it's wild to think that people on HN don't know about this relatively recent history and are so naive to think that these protections were just pulled out of the air to frustrate developers, and not a reaction to an on-going arms war against consumer's right to privacy.

(1) https://www.extremetech.com/internet/284770-apple-kills-face...

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#97

Post by byyll »

k8sToGo wrote: post #37
byyll wrote: post #31

Earlier quoted context omitted.

My €5 VPN allows me to use 500 IPs in 50 countries. Give me the VPS that allows me to do that.

Which service do you use? Mullvad?

I am not here to advertise, the point is the same for most commercial VPNs.

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#98

Post by byyll »

defrost wrote: post #40
k8sToGo wrote: post #37

Earlier quoted context omitted.

Which service do you use? Mullvad?

That could be either Mullvad or ProtonVPN. Both are Swiss zero log, Mullvad has a flat 5 euro/month charge that goes back to when they started to (they say) forever - you can send them cash in envolope for the next twenty years with a generated account number and you're away. ProtonVPN has plans - the two year streaming sign up is 4.99 euro/month.

Mullvad is not Swiss, it's Swedish.

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#99

Post by valicord »

DannyBee wrote: post #58
mctt wrote: post #48

Earlier quoted context omitted.

Here is a quote from Facebook/Meta's legal council to the Judge. In this document "Advertisers" refers to Snapchat, YouTube and Amazon. "... the Wiretap Act provides that an interception is not unlawful if a party to the communication “has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d). Advertisers conspicuously fail to mention—and apparently do not contest—that Meta obtained participants’ prior co…

Lawyer here. No. They have ...'d out an important part of 2511(2)(d). (and they probably meant (c)) First, it starts out with: "It shall not be unlawful under this chapter for a person not acting under color of law " This basically means a state/federal official or someone acting in their capacity as one (the color of law part basically means it applies even when they act beyond their legal authority by accident) Whi…

> person *not* acting under color of law

Did you miss the "not" part?

Re: Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

#100

Post by staplers »

neglesaks wrote: post #76

"Meta" is The Evil Online Empire at this point, it's company history is a litany is decidedly immoral if not outright evil actions.

Meta is a known state-actor. They likely have federal immunity to most wrong-doings.

(Source: https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-h...)

Post reply on HN