Hacker News Reader

Comment by happybuy | Hacker News Reader

This is malware and should have been rejected from the App Store months (if not years ago). Better late than never.

I'm sure if it was a smaller company doing a similar thing they wouldn't have been given such leeway as Facebook was for so long.

View on HN

Eh, I dunno. My Data Manager [1] (owned by Mobidia / App Annie) is still going strong. It along with other VPN-based apps are a major source of user-level app usage and engagement data being sold to large corporations and investors. In-app analytics libraries are another source (which are heavily fragmented since they only can track apps they're packaged with) but it's going to be a lot more difficult for Apple to regulate those.

Until Apple starts banning all of these types of apps and libraries (which their recently updated policies indicate they just might [2]), I view this as more of a strategic play against Facebook as opposed to in the best interest of users.

[1] https://itunes.apple.com/us/app/my-data-manager-track-your/i...

[2] http://www.integrity-research.com/new-apple-policies-threate...

Apple quickly and efficiently banned all VPN-based ad blocking apps as they do not follow allowed uses of the VPN apis as per App Store guidelines.

VPN-based data collection apps could just as easily be cleaned up if there was the will to do so.

FYI, it was a smaller company doing this in the first place. Facebook didn't change what the app was fundamentally doing after they acquired the company.

And why do you think they acquired them?

For the data. It was like their own private App Annie, only available to themselves, with different strengths and weaknesses compared to App Annie data. And pretty much the same individual privacy implications as App Annie.

"Malware: software that is intended to damage or disable computers and computer systems."

It's hardly malware. Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not.

Perhaps spyware is the more accurate term.

Even if it is clear in the app description that it is collecting data from users, I don't believe that the extent or consequences of such data collection would be considered or understood by the majority of its users.

It's a spyware product, wrapped up as a VPN, relying upon lack of attention from users to succeed.

The first problem with this claim is that no users exercised any right to trade access to their data for free compression. This was a trojan horse. That's malware.

Where is this definition coming from?

Merriam-Webster says "software designed to interfere with a computer's normal functioning". Wiktionary: "Software which has been designed to operate in a malicious, undesirable manner". Etymologically, it means software that is malevolent.

This app collects data in a malevolent/undesirable way. It clearly tries to interfere with the personal data of the user and hence the intended functioning of the computer. Hence a malware.

> Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not.

This is utter nonsense. How many users are making an informed decision here? How many understand what their data may be used for or how it may affect their insurance, employment, or housing prospects in the future?

There's a reason some contracts are not legal/enforceable (slavery for example).

I used this app before, how is this a malware ?

It sends anonymized data of every website on the internet, when you access it, and it also monitors the apps you use (probably because it intercepts their web traffic.) So basically Facebook knows what you do.

Yes its writen in the app description. Its free in return for data collection. How is this damaging my device?

If I've mistaken your question for pedantry, please forgive me.

You can narrowly define malware by a quick dictionary definition[1]:

> software that is intended to damage or disable computers and computer systems.

However, malware also has a much looser definition[2] if we don't restrict ourselves to a one sentence Google result:

> Programs officially supplied by companies can be considered malware if they secretly act against the interests of the computer user. For example, Sony sold the Sony rootkit, which contained a Trojan horse embedded into CDs that silently installed and concealed itself on purchasers' computers with the intention of preventing illicit copying. It also reported on users' listening habits, and unintentionally created vulnerabilities that were then exploited by unrelated malware.

[1] https://www.google.com/search?q=define%3Amalware

[2] https://en.wikipedia.org/wiki/Malware

It's shocking how far the overton window on privacy has shifted in just 10 years. Bonzi Buddy and it's ilk were generally considered malware and frequently chided on the internet at the time.

Now people defend almost the same practices (in a nicer package) on Hacker News.

We are truly fucked.

Shocking right ? that the world always changing. I personally welcome this change. This one is different than pop up ads in the past where it actually annoy me.

In all seriousness, that's not malware though. Facebook is a big company competing directly with Google: it makes sense that they want a similar level of access to market insights as their competitor has.

Google collects a lot of data [3], including app and website usage [2] too. They have full access all the analytics a phone OS can provide, after all.

I'm not saying this is ok, but if we claim this is malware then Android is malware too. I rather reserve the malware label to software that is directly designed to harm.

PS: Apple collects app usage too [1], but IMO they're at least more clear about it.

[1] https://support.apple.com/en-us/HT202100

[2] https://myaccount.google.com/activitycontrols

[3] https://privacy.google.com/your-data.html

EDIT: Why the downvote? Rather than downvoting, some constructive discussion on spyware and business practices would be IMO more welcome.

> I'm not saying this is ok, but if we claim this is malware then Android is malware too.

Sure, it is. Or spyware, at least. So is Windows.

> I rather reserve the malware label to software that is directly designed to harm.

Stealing data is harmful. I mean, consider the OpenSSH user enumeration vulnerability.

I agree with this sentiment. This is no more harmful than a web mail client that collections personal information for targeted ads, or a mobile operating system by an ads company. The best thing Google has is their marketing department.

> but if we claim this is malware then Android is malware too.

It is? Android is completely ridden with dark patterns[1].

[1] https://en.wikipedia.org/wiki/Dark_pattern

I understand people say things like this because they're the edgy, hot take - but the Onavo VPN software is absolutely not malware. It's a performant, free VPN that people use in exchange for some anonymized data. There have been no known leaks or breaches.

It's obviously in exchange for data, but I'm skeptical of how anonymised it is, given that FB has made a business of tracking everyone on the web as much as possible.

The data is not anonymized, they say they may share anonymized data with partners. Malware is too strong but if you read the product description and FAQ, it's deliberately deceptive. Lieware? Slimeware?

"Spyware" is perfectly sufficient.

From Apple's App Store Review Guidelines:[0]

> 2.5.14 Apps must request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity. This includes any use of the device camera, microphone, or other user inputs.

So did Onavo "provide a clear visual indication" whenever collecting data? Somehow I doubt that, because it would have been a constant warning.

0) https://developer.apple.com/app-store/review/guidelines/

There is a constantly visible indicator that you're using a vpn on everything but the iPhone X. It's a stretch admittedly, but there's an argument to be made.

An indicator that you are using a VPN does not fit the above requirement in any way.

That is definitey not an argument.

> anonymized

Do you have any proof of this?

Reply on news.ycombinator.com