4 ms·

Support everything said except for MITM. They do not intercept anything, just gather the metadata on the frequency of use, amount of traffic sent etc. And users

Support everything said except for MITM. They do not intercept anything, just gather the metadata on the frequency of use, amount of traffic sent etc. And users install those apps to see traffic stats. I am pretty sure they share this info according to the ToS. Just a plain old "if you're not paying for it, you're the product". Edit: they also gather this data even if you don't use their VPN service. But I don't think average users care that much if Facebook knows the distribution of time spent on Twitter by all people using that app.

abalone 9y ago
You have to intercept to gather metadata... but semantics aside, they are deceiving users. First there is the marketing scam reported in the app store reviews, people who installed it because some web site told them they have a virus and they need this thing to fix it. Second, the only mention of their logging practices is buried below the fold in the last line of their description: "Onavo receives and analyzes information about your mobile data and app use." This is just vague enough to deceive a user that believes it is merely to support their user-facing features, i.e. giving you a report on what you use... not Facebook for spying purposes. Of course, most users never even get that far in the description. They're installing this to "secure their phone" because of a scary ad they saw. These guys know exactly what they're doing. Most of their users, not so much. That's where we come in. The App Store exists to help protect users from this kind of exploitation and I hope Apple and our community takes action.
- willstrafach 9y ago
  > First there is the marketing scam reported in the app store reviews, people who installed it because some web site told them they have a virus and they need this thing to fix it. This is common and I am not entirely sure Onavo supports this wittingly. Most times that I have seen it, the ad redirects to the "Norton Wi-Fi Privacy" page on the App Store instead. Agreed on point #2, they should be much more clear on what they do with user data.
- deleted 9y ago
  [deleted]
- albeebe1 9y ago
  some web site told them they have a virus and they need this thing to fix it I did some investigating of one of those sites, and from what i can tell, they are using App Store affiliate links, and rotating amongst a handful of accounts. If they can convince you that you have a virus, and they take you to the $30 Symantec app that has good reviews, they get a nice commission. Symantec doesn't even have to have anything to do with those sites.
  - abalone 9y ago
    Onavo is a free app. There's no commission to link to it. They are the only entity with an incentive to link a scammy ad to their app install.
- smarx007 9y ago
  No, you don't need to: https://stackoverflow.com/questions/12613402/android-statistic-3g-traffic-for-each-app-how https://stackoverflow.com/questions/12613402/android-statist... https://stackoverflow.com/questions/41768642/detect-current-running-application-in-android-nougat-7-version https://stackoverflow.com/questions/41768642/detect-current-... They just want to know how much do you use each app on your phone and not anything related to the TCP exchange. Therefore no MITM has to take place. The rest, I fully agree with you: one deception paves way to another. I think just making users aware that it's Facebook tracking their app usage and not some "Onavo" would be enough for people to think better about their privacy.
  - abalone 9y ago
    Onavo uses a VPN, unlike the techniques you linked to (which are Android only as well). They intercept all web traffic and know every site you visit.

abalone 9y ago

You have to intercept to gather metadata... but semantics aside, they are deceiving users. First there is the marketing scam reported in the app store reviews, people who installed it because some web site told them they have a virus and they need this thing to fix it. Second, the only mention of their logging practices is buried below the fold in the last line of their description: "Onavo receives and analyzes information about your mobile data and app use." This is just vague enough to deceive a user that believes it is merely to support their user-facing features, i.e. giving you a report on what you use... not Facebook for spying purposes. Of course, most users never even get that far in the description. They're installing this to "secure their phone" because of a scary ad they saw. These guys know exactly what they're doing. Most of their users, not so much. That's where we come in. The App Store exists to help protect users from this kind of exploitation and I hope Apple and our community takes action.

willstrafach 9y ago
> First there is the marketing scam reported in the app store reviews, people who installed it because some web site told them they have a virus and they need this thing to fix it. This is common and I am not entirely sure Onavo supports this wittingly. Most times that I have seen it, the ad redirects to the "Norton Wi-Fi Privacy" page on the App Store instead. Agreed on point #2, they should be much more clear on what they do with user data.
deleted 9y ago
[deleted]
albeebe1 9y ago
some web site told them they have a virus and they need this thing to fix it I did some investigating of one of those sites, and from what i can tell, they are using App Store affiliate links, and rotating amongst a handful of accounts. If they can convince you that you have a virus, and they take you to the $30 Symantec app that has good reviews, they get a nice commission. Symantec doesn't even have to have anything to do with those sites.
- abalone 9y ago
  Onavo is a free app. There's no commission to link to it. They are the only entity with an incentive to link a scammy ad to their app install.
smarx007 9y ago
No, you don't need to: https://stackoverflow.com/questions/12613402/android-statistic-3g-traffic-for-each-app-how https://stackoverflow.com/questions/12613402/android-statist... https://stackoverflow.com/questions/41768642/detect-current-running-application-in-android-nougat-7-version https://stackoverflow.com/questions/41768642/detect-current-... They just want to know how much do you use each app on your phone and not anything related to the TCP exchange. Therefore no MITM has to take place. The rest, I fully agree with you: one deception paves way to another. I think just making users aware that it's Facebook tracking their app usage and not some "Onavo" would be enough for people to think better about their privacy.
- abalone 9y ago
  Onavo uses a VPN, unlike the techniques you linked to (which are Android only as well). They intercept all web traffic and know every site you visit.