Meta's Onavo VPN removed SSL encryption of competitor's analytics traffic

Here’s how I see it. This is akin to opening your USPS mail and reading your correspondence with a friend. When instead they could’ve checked who the mails were addressed.

If Facebook wanted to learn the protocol Snapchat uses, they only needed a single test device. If they only needed to learn usage patterns, they could’ve checked where the traffic is sent to or app usage time etc.

Installing a root certificate is very intrusive and they behavior shows that if they are ever given the opportunity to be become a root certificate authority, they are likely to issue malicious certificates. As far as I know, no website can pin their certificates, so this takes us back to pre-HTTPS days where ISPs and network operators had a lot of fun reading user traffic.

That box on your TV would have been a Nielsen box which sat on your TV and was connected to your landline. It didn’t collect anything automatically: every time you turned the TV on you were contractually obligated to press a button every 20 minutes to have the box call Nielsen and log a datapoint.

Those boxes have been phased out in favour of “Personal People Meters”[0], which are basically a pager with a SIM card that you wear which has a microphone listening 24/7 for TV broadcasts. You must keep it on you, listening at all times.

Nielsen will pay you $250/year (less than a dollar a day) for the data you provide.

[0] https://en.wikipedia.org/wiki/Portable_People_Meter

They would because the communications involve 2 parties. Your consent to someone snooping on my calls with you should not be enough, because for example, you still need my consent to record calls I have with you.

Now, Meta decides to MITM the communications that I intentionally encrypted so that it can gain a competitive advantage…well, remember when meta kicked out researchers what had obtained consent from users to perform research on its platform? That was not even illegal. This is.

Which doc and which link are you referring to? This isn't anywhere in the class action discovery documents as far as I can tell.

TC reported back in 2019 on Facebook using various third-party testing services to distribute their first-party Facebook Research app, so I'm not even convinced that point is new (or that they paid the third parties to do any actual research).

https://techcrunch.com/2019/01/29/facebook-project-atlas/

Facebook would probably have run up against app store policies by trying to install their root cert on existing apps, which seems to be the most likely justification for installing this additional app through third-party channels. It's also a lot easier to avoid suspicion when it's part of a bunch of click-through screens as part of app setup (especially when you're dangling money in front of users, even just $20/month).

They don't see the traffic unless they analyze the memory of your running server, because the SSL termination happens inside the server. Encrypted traffic passes through their network, which they don't have the keys for. Cloudflare, on the other paw, literally offers to do the SSL termination for you, as in they hold the private keys and perform the decryption on their servers that they control. Then they pass the decrypted traffic through their network in order to do things like "optimize" your images, or inject JavaScript into your pages. Website owners consent to this, but I guess the question here is whether users should need to consent to this website's traffic being handled in decrypted form by Cloudflare before that is actually done.

Now obviously my comment is not about "just a CDN provider" right?

The SSL stuff that Cloudflare offers to protect your websites/APIs etc so you don't have to, their DNS products. The fact that iCloud Private Relay uses Cloudflare under the hood (and so all browsing there happens through their gateways etc).

it's almost as if there wasn’t an ethics class in the CS majors’ required courses!

Perhaps we could require a simple "nutrition facts" on each article about the journal's conflicting interests: for example, a ragebait article about big tech? Then the disclosure of the ad revenue conflict between big tech and media industry must be required up front (at the beginning of the article.)

We could also require a list of the journalist's qualifications to be posted clearly at the beginning of each article. If the journalist, for instance, does not have an education in the subject, the article must be prefaced with a "journalist is not experienced or qualified in this field." This would encourage traditional journalism to end, and for journalism to become more of a mandatory consultancy with experts.

Finally, we could strengthen libel and defamation laws rather significantly. For example, in Emily Steel's article[1] about ATC, she should not have named and shamed a particular controller. Furthermore, the ATC group should be able to easily sue her for inaccuracies in her article[2] misrepresenting ATC as a whole. If you can get easily litigated, you're more likely to stick to just the facts.

Ultimately a formulaic approach will not solve this problem, it can only help a little bit by discouraging nonfactual reporting. Unfortunately, this problem fundamentally comes down to journalists as an industry thinking they're paragons of righteousness, and then going on to write horrible things.

[1]: https://www.nytimes.com/2023/12/02/business/air-traffic-cont...

[2]: https://www.reddit.com/r/ATC/comments/175pwim/the_nyt_articl...

Almost all public statements about App Store review security, for example

No. Its written as a set of negatives- it shall be unlawful for someone not x to do y

Here it is saying it’s illegal unless you are an official acting under color of law and there is one party consent

They had explicit consent to do it?

Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.

> Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin.

thats a freaking lie and you should feel bad for repeating it.

it was barely reviewd years ago. before all the shady features that even caused the original founder to leave the company (and a few billions worth of golden handcuffs) with an open letter about how fb destroyed privacy in WhatsApp.

EU and all sane state actors forbid its use (some recommends signal)

all recent political leaks was from fb (e.g. brazil, italy)

Not a law.

> FB did not clearly request to be able to read all traffic (encrypted and nonencrypted) so how could they get consent.

I can't find the consent page/legalese shown to users, do you have a link?

Yes they did. Participants were even compensated for it IIRC

From the inference of the commenter, I think they were referring to an app on a mobile device and not the device itself.

It also sounds like their issue was at the ISP provider level, as well, which takes the business out of the loop of being the data controller/owner (of the collected data) at that point.

Note: I'm not saying that your comment doesn't have merit, I just don't think that the points that you made apply - specifically - in this case?

It's not corporate level it was/is religious group level (of which this particular org I'm guessing largely employed staff from that religion). They are well known within our country to be quite insular.

It certainly seemed for all intents and purposes if you were a member of _____ group (wider than the company) you had the vpn on your device, and it was filtering content. I've found other reports in other countries of that happening with the same group.

So it's not corporate content filtering, it's personal content filtering and our app got caught up in it (and approved).

It certainly made my skin crawl for anyone in that religion. That means the central filtering service could be reading messages. Not sure if they're that sophisticated but certainly they didn't want people to see random images/videos.

This was news … 5 years ago, I think, I don’t know why it blew up again. But context matters:

Onavo provided a compression + VPN service for people traveling; they let users use little or no data while roaming, and still get internet access. I do not know what their original business plan was, but Facebook bought them for the ability to spy on users.

Their MITM was, in fact, the raison d’etre of Onavo. And then, they were bought by Facebook. And then there was just some more analytics added. At no point, as I understand it, was it built explicitly for evil - and I suspect very few employees were in on the real reasons.

Plausible deniability works for many things.

Nah, I've met enough amoral people over the course of my career to know that's not the case. However, the overwhelming majority of people I've worked with are people who do have morals and do care about the outcomes they're creating, and that gives me great hope.

You simply legislate that if a company is building anything that will be used regularly by more than eg. a few thousand people, then the work must be designed and/or signed off by a licensed engineer, who will a) be subject to a code of ethics and b) be professionally liable for any failures causing loss or damage to the public.

We seem to be able to manage this with bridges, planes, electrical & hydro installations etc. No reason it shouldn't be the same for critical software infrastructure.

I understand that things are often more nuanced than they may appear, and in questions of moral judgement there will always be room for fuzziness. Personally I think the idea of compromising security for everyone in order to make life a little easier for the TLA's is not something I'd feel comfortable doing. I consider an individuals right to privacy paramount, something without which we risk unbounded tyrannical rule. Others will probably feel differently when presented with 'think of the children' style arguments. I'm glad to hear though that you were at least conflicted enough to be asking questions.

Imho, the correct way to evaluate corporate potential corporate trust is on self-interest.

In Microsoft, Google, and Apple's cases, they all have substantial enterprise business that would shit a brick if they were caught doing this.

Ergo, it's not in their best interest to do it.

Safer to rely on a company's desire to make money than any sense of "good".

Ah, good 'ole trustworthy Swiss companies! Like Crypto AG![1]

Realistically, all VPNs are compromised. But for most people's threat model, that's irrelevant anyways.

Proton for instance revealed the location of a climate activist leading to his arrest[2], with the inspiring message from the CEO that "privacy protections can be suspended", silently on a per-user basis at any time.

Haven't seen anything like that for Mullvad, but it's probably the same. At least the company takes crypto. But these things are always just surface level obscurity at best.

[1]: https://en.m.wikipedia.org/wiki/Crypto_AG

[2]: https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

Mullvad is not Swiss, it's Swedish.