- cross-posted to:
- fediverse@lemmy.world
- cross-posted to:
- fediverse@lemmy.world
Meta tried to gain a competitive advantage over its competitors, including Snapchat and later Amazon and YouTube, by analyzing the network traffic of how its users were interacting with Meta’s competitors. Given these apps’ use of encryption, Facebook needed to develop special technology to get around it.
Facebook’s engineers solution was to use Onavo, a VPN-like service that Facebook acquired in 2013. In 2019, Facebook shut down Onavo after a TechCrunch investigation revealed that Facebook had been secretly paying teenagers to use Onavo so the company could access all of their web activity.
After Zuckerberg’s email, the Onavo team took on the project and a month later proposed a solution: so-called kits that can be installed on iOS and Android that intercept traffic for specific subdomains, “allowing us to read what would otherwise be encrypted traffic so we can measure in-app usage,” read an email from July 2016. “This is a ‘man-in-the-middle’ approach.”
A man-in-the-middle attack — nowadays also called adversary-in-the-middle — is an attack where hackers intercept internet traffic flowing from one device to another over a network. When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.
You must log in or # to comment.
Shocked, I tell you
Delete this shit from your phones asap
Zuck Fuckerberg
Can’t delete something that was never there in the first place
I must be way out of the loop, cuz I had no idea this was possible. So does this mean the Facebook app on my phone has permission to view all of my network traffic? Why do Android and iOS allow this? Shouldn’t that be a special permission that can only be granted explicitly?
Nope, because Facebook app is not a VPN service so it cannot intercept traffic.
What it is unclear from the article is how they circumvented the certificate check on the app side. Probably (given this was many years ago, maybe these apps weren’t setupping certificate pinning/HPKP)
Lock that turd up already
Let that parasite rot in prison.
And can somebody split Meta already? Please and thank you.
Yeah, he wont
Why split Meta? The poor mom and pop shop only makes 350 million in revenue… Every day…
What a fucking piece of shit.
Certainly they weren’t planning on actually planning on finding a way to get people to install a VPN to decrypt their traffic just to use Facebook, right?
That’s why they paid teenagers to use the VPN so they could get some “guerrilla market research”.
Even in 2013 apps didn’t have the permission access to install a device level VPN without some unspecified exploit. 0 chance Facebook would literally hack people’s phones, right?
I’m sure corporations like this would give you free Internet if they could collect and sell all your data. I’m also sure people would still do it, regardless of how much they are being monetized as a product.
Since companies like Facebook own legislators, our only real choice is to stop using it. Unpopular opinion, but If you really want fuck Zuck, delete your account, and get all your friends and family to as well. Maybe there’s some alternatives for the people who truly use the service to connect with friends/family?
corporations like this would give you free Internet if they could collect and sell all your data
Facebook Zero is more or less what you described.
shitbook does that in the Philippines
The free Internet if you give use your data is already a thing. I saw an ad in germany where you get unlimited free internet access (can’t remember if it was a data plan for phones or cable / fibre service) if you use their “payment partner” for your usual payments like rent, loans and salary. So they basically can see your daily payments and will use and sell this data im exchange for “free” Internet access.
The company and its investors and corporation lead to a weird network of people and a corp in dubai. It’s all quite shady really.
Wow, that is weird. I honestly just made that up in my head when I wrote it.
The saying is true, if it’s free, you’re the product.
I don’t actually know why I care about that level of privacy. Some of us are quite fine with companies or their government having any information about them. Some are very opposed.
Maybe I dislike the idea that information could be used against me somehow or they’re making even more money than I’m already paying in some hypothetical case. Not sure.
I work in IT so you might think I might be more into the topic and thus more careful with my data. There are a lot of colleagues of mine that don’t care one bit. Some even jokingly call me paranoid.
Sure, I use GrapheneOS, a de-googled Android OS, made the switch from Gmail to Tuta (formerly tutanota), a privacy ans security focused mail provider and use my own domain for mailing.
Then there are some other measurements in place like AdGuard and Pihole to block ads and trackers. I think that’s the bare minimum, especially if you’re working in IT. It doesn’t cost much, the setup is straight forward and the benefits are huge. I haven’t had any ads in my network for years.
I’m currently switching from windows to Linux as daily driver. There are some issues with getting some games to run, but as soon as they do I’m switching for good.
There are some easy thing one can do, even without any expertise in IT. There are even things you can do that aren’t finicky (like linux troubleshooting). People are just way to comfortable.
Maybe they should watch the documentary about Edward Snowden, Citizenfour. That might change their mind.
I’m sure corporations like this would give you free Internet if they could collect and sell all your data.
Already a thing. I see them advertised everywhere for prepaid plans and people go ‘omg Facebook/Whatsapp/Instagram/TikTok for free!!1!’.
The world would be a better place if Mark Zuckerberg accidentally got sucked into a jetski engine somehow
I was thinking of buying a Meta Quest 3, because of a lack of similar devices. I wasn’t really seriously considering it, but I sure as hell am not at all now.
I’ve got one. All I’ll say is don’t buy a VR headset anytime soon.
Every 60 seconds in Africa, a minute passes.
And this fact is more surprising than Meta spying on people
This is the best summary I could come up with:
In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers.
On Tuesday, a federal court in California released new documents discovered as part of the class action lawsuit between consumers and Meta, Facebook’s parent company.
“Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them,” Meta chief executive Mark Zuckerberg wrote in an email dated June 9, 2016, which was published as part of the lawsuit.
When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.
This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet.
“We now have the capability to measure detailed in-app activity” from “parsing snapchat [sic] analytics collected from incentivized participants in Onavo’s research program,” read another email.
The original article contains 671 words, the summary contains 175 words. Saved 74%. I’m a bot and I’m open source!
This is why tiktok shouldn’t be banned it will only benefit zucck
Nah. Ban these companies or don’t, we need user privacy protection laws.
Ban tiktok including meta products?
Learning: VPN services are tracking instruments, not some magic tool.
And its not even new…
Google VPN, anyone?
Roll your own vpn.
Wait, how does a VPN break TLS encryption?
The VPN adds its own root certs to the device, and just terminates TLS at the gateway, then establishes a second TLS tunnel to the device.
It can’t do that silently, the user has to approve installation of root certs. This only works silently with apps which have broken (insecure) cert validation
it doesn’t, what this is suggesting is the vpn was routing traffic through it so they could analyze snapchat traffic. not the contents of it but essentially meta analysis of the traffic. how often it was sending data, how much data, where it was going etc.
this is the answer
