Notes on Analytics and Tracking in Onavo Protect for iOS | Hacker News Reader

Notes on Analytics and Tracking in Onavo Protect for iOS

medium.com

101 pointsksajadi60 comments

I uninstalled every Facebook product from my phone. Turns out I really didn't need Messenger after all.

As I still concede to using Facebook, I have decided to install a Chrome shortcut to mbasic.facebook.com. It does everything I need without tons of scripting, doesn't optimistically download content, and loads fast when my bandwidth is reduced. It never notifies me, and that's a good thing. Without infinite scrolling, I'm less likely to waste time.

Maybe I'll decide to ditch Facebook entirely, but for now, using mbasic has been a healthier alternative.

My 4g LTE bandwidth seems to last longer, too.

With HTTPS and a mobile connection, I can't see why I would need a VPN for Facebook.

+1 for mbasic.facebook.com I never use the rest of the site, but there are some contacts that I can only reliably reach through messenger

I used to use it for events too, till they broke events pages in mbasic

https://github.com/ZeeRooo/MaterialFBook is a great app for anyone who finds mbasic a bit basic.

+1. If you still want to receive some basic notifications on incoming messages, FaceSlim app is very nice :)

https://f-droid.org/en/packages/org.indywidualni.fblite/

Uninstalled Fb app and messenger long time ago. I can't uninstall whatsapp even if i wanted to and it's hard to uninstall Instagram.

I remember uninstalling Facebook was pretty difficult. I was only able to truly get rid of it by rooting my phone(I didn't do it for that purpose, but that ended up being one benefit). They must pay Samsung a lot of money because there's no good reason why a non-critical app would be so hard to remove.

I can't uninstall whatsapp because my entire family communicates via whatsapp.

I convinced my family to move to Signal. Perhaps try that.

Conversely I found Line messenger works well. :-)

Sure, i can try to convince my immediate family. But cousins and everyone? It's too much to ask

Wouldn't merely disabling the app (in system -> applications) have accomplished the same except for freeing up a couple hundred megs of storage on the system partition? Disabled apps don't have their services run.

Yes, but I also want that space. Nothing changes the fact that it really doesn't have a right to be there. :)

Also, there were other apps that I could only disable. I think YouTube might have been one of them, and I would really prefer to use NewPipe instead. So once I was rooted it was kind of like "Well, might as well delete ALL of that crap."

I recently bought a Samsung Galaxy J7 Prime and was able to uninstall Facebook the same way that you would uninstall any other Facebook app. It's the first Samsung phone I've ever used that was like that.

That would almost make me upgrade my note 3 to another Samsung. If it wasn't for their Geo locking.

Uninstalled all Facebook apps as soon as I got my phone, a few months ago, but only recently discovered there were two remaining hidden apps that didn't show up in the normal app list: https://forum.xda-developers.com/tmobile-lg-v10/help/suspici...

Before I disabled them, one of them was running.

Cool! I didn't know about mbasic.facebook.com

I don't want to use Mesenger but I need to use FB to keep in touch with my family abroad. I always have to make the browser render the non-mobile site.

I've just changed my bookmark and I'm not looking back. :)

This is the app that was instrumental in FB consolidating their monopoly on horizontal markets, using the data pickpocketed from users to analyze potential acquisition targets. We need to explore whether antitrust scrutiny should consider data hoarding as a factor.

I also wonder if this sleaziness is why we can't have ad-blocking faux-VPN apps on iOS anymore (see AdGuard, e.g.). FB weren't the only ones abusing users' trust, but there were legit apps that allowed one to selectively block any device connection (not just DNS lookups) without any data leakage -- all blocking done on-device. But no more as of fall 2017.

Interestingly, Onavo Protect is using the same method (Packet Tunnel Provider) to send analytics data out. I am very curious if Apple is OK with that.

Of course it does, as it explicitly claims to in the App description. What's news here?

Also, that's some of the worst scroll-jacking and browser behavior modification I've come across - you cannot read it zoomed in on Safari because it jumps around instead of scrolling.

It's news because people use VPNs to protect their privacy. If they are under the impression that Onavo will keep their data private, they are wrong. Just trying to inform...

The app description does not even mention privacy.

It does say "take charge of how you use mobile data and protect your personal info."

Protect personal info from what? That implies privacy.

From attackers maybe?

Protection in no way implies privacy.

This is not about your expectations. This is about the expectations of a user who knows that VPN stands for "Virtual Private Network", and that the feature has the word "Protect" in the title.

FB creates the expectation of privacy by using those terms, and they (or you) don't get out from under that expectation by splitting hairs.

It surprises me how much people will defend obvious overreaching behavior from large corporations, for free, on the internet.

The app places the acryonym "VPN" on the phone and instructs users to turn on the virtual private network.

I'd say users aren't totally out of line thinking that an app providing virtual private networking functionality would use a layperson's definition of private (as opposed to a techie's definition involving network protocols).

I'd argue that a VPN app that isn't private should be required to put something like the warning on cigarettes: >

> WARNING: This app monitors and records for all time your every action on your phone and only protects you from 3rd parties who haven't paid us enough money to get access to your data.

I agree that a VPN service implies it's protecting privacy, but let me nit pick a bit: the "private" in virtual private network is not about privacy, it's about a network with a private IP space, the virtual part is that it operates on top of public IP space.

With that said, anyone could make the assumption that private means privacy here, and most common use cases for consumer VPNs are for privacy, so, I guess it really matters that they are explicit what they service does, and I think the description above is pretty clear.

You and I understand this distinction. The general public that has been told public networks are unsafe probably does not.

You are completely right, and I agree fully.

A VPN has nothing to do with privacy. Changing the definition doesn't do anyone any favors. It just blurs the line even further. Private!== privacy. It isn't some magical protocol that all of a sudden makes you untrackable.

Totally agree. The word “protect” is in the title. The p in VPN also stands for “private”. People could be forgiven for being mislead here.

The Onavo Protect app description is below.

-----

Onavo Protect helps keep you and your data safe when you browse and share information on the web. This powerful app helps keep you safe by understanding when you visit potentially malicious or harmful websites and giving you a warning. It also helps keep your details secure when you login to websites or enter personal information such as bank accounts and credit card numbers.

Onavo Protect works to:

• Warn you when you visit potentially malicious or harmful sites

• Help secure your personal information when you're on public Wi-Fi

• Add an extra layer of protection to all of your mobile data traffic by using our VPN

How it works

To provide this layer of protection, Onavo uses a VPN to establish a secure connection to direct all of your network communications through Onavo’s servers. As part of this process, Onavo collects your mobile data traffic. This helps us improve and operate the Onavo service by analyzing your use of websites, apps and data. Because we're part of Facebook, we also use this info to improve Facebook products and services, gain insights into the products and services people value, and build better experiences.

This is not surprising at all... This is why they bought Onavo. Onavo gives them a clear picture of how competing apps like Snapchat are doing and gives them an idea of potential threats to their business.

That is a rehash if old information.

My post includes new information:

- The app will track when your phone screen is on and when it is off, and send that to Facebook

- The app will track your daily Wi-Fi and cellular data usage, even when not connected to the VPN, and send that to Facebook

From the same company who asked their users if it was ok for grown men to ask nude pictures from 14 year old girls.

Source?

https://www.theguardian.com/technology/2018/mar/05/facebook-...

If you want a VPN (P == Private), don't get one from a company that treats "privacy" like a four-letter word. Just as you shouldn't trust an ad blocker put forth by an ad company.

Is there an upcoming product similar to instagram?

I really am over all the main facebook products, but seems like instagram has a monopoly on that specific category of apps.

I heard about Vero ( https://www.vero.co/ ) the other day. Their business model is to allow the first wave of users to join for free, then later charge a subscription to new users. I don't know whether they'll be a contender in the long run, but they've experienced rapid growth recently (unfortunately leading to service scaling issues).

Next up: FBI buys VPN service, promises everything is chill

Maybe you didn't see this: https://news.ycombinator.com/item?id=16501630

Sketchy.

"available free of charge" And that's the point were you become the product.

This is such a bs article. Onavo is a VPN - what are they expecting from it?

Most people would expect a VPN to protect their data from websites, rather than sharing it with Facebook.

Well the app description explicitly says that it collects traffic.

VPNs by definition gather information about browsing behavior. Sharing it with Facebook is where it becomes an issue.

It's not an issue if you care enough to read the description. This is not some underhanded sneaky thing that Facebook's trying to hide. Users can choose not to install the app.

That is a different argument than what the author is making in the article. Don't go on a tangent.

Also, Onavo was acquired by FB in 2013. What were you expecting FB to do with it? It is not even the most popular VPN app.

I made no argument.

I presented factual and new information about what data is collected and asked some questions.

Your point was vpn collected all data sent and received from a device. You could have just tweeted that as that is always true.

Instead, from what it appears, you were trying to prop up views by calling out a facebook specific vpn and how it collected all data - as in you were expecting that to behave differently.

I would recommend you go and read the post, because what you are saying is simply not true.

I never claimed they are collecting all data sent and recieved from the device, nor would I have any ability to credibly make that claim without access to their servers. I only addressed what is observable in the app’s code.

Privacy. At least that has always been my expectation from Virtual Private Networks.

Look, it is 2018, “Facebook” and “collecting data” shouldn’t be any surprise to anyone. Stop using Facebook or submit to your data overlords but please, PLEASE stop posting this stuff. Facebook should never be trusted.

When something is a problem, you should shine more light on it, not avoid talking about it because it "isn't a surprise".

The general public has a short memory for this kind of thing, and no, not everyone is aware of the trade-off they're making with these services, or the true extent of the surveillance and manipulation they're submitting themselves to.

Much of society is just finally beginning to wake up to the dangers these companies present. Now is not the time to go silent about the issue. Quite the opposite.

People come to the mindset of distrust through the publicizing of these incidents/decisions. Don't assume that everyone is at where you are.

> PLEASE stop posting this stuff. Facebook should never be trusted.

Hi. I wrote the post and I disagree. There is a great deal of rhetoric and scaremongering these days when it comes to cyber security coverage in the media. I think it is important to actually look at the available data and ask direct questions derived from it.

I am fully aware that Facebook is not a bastion of privacy by any stretch, but collecting observable facts regarding this matter can allow people to better understand what is happening beyond “Facebook is invading your privacy” and decide how they feel about it.

Reply on news.ycombinator.com