11 ms·

Facebook’s Onavo Gives Social-Media Firm Inside Peek at Rivals’ Users

270 points by daenney 9y ago

pdog 9y ago
How is Onavo a "data-security app" if it lets Facebook track everything you do, including encrypted traffic?
- lightbyte 9y ago
  They forgot to mention that the one being secured is Facebook, not the user.
  - jklein11 9y ago
    If you aren't paying for it, you aren't the user. You are the product.
irpapakons 9y ago
It's ethically dubious that the advertised function of the app is a VPN to "keep you and your data safe", while the reason it exists is so that all phone traffic goes to Facebook. This is not clear from the app description -- there is only a generic message about monitored app use, to which users are so used as to not pay any attention. > "The app's privacy policy says it may share information with "affiliates" that include its owner, Facebook. "As part of this process, Onavo receives and analyzes information about your mobile data and app use" > A Facebook spokesman said it is clear when people download Onavo what information it collects and how it is used. "Websites and apps have used market-research services for years," the spokesman said, noting that the company also uses outside services to help it understand the market and improve services. Then Facebook can attack the competition by seeing in real time how usage of competitive apps varies in response to new features and inform acquisition decisions. > Onavo's data paved the way for the purchase of WhatsApp for $22 billion. Onavo showed the messaging app was installed on 99% of all Android phones in Spain -- showing WhatsApp was changing how an entire country communicated, the people said.
- thinkMOAR 9y ago
  "ethically dubious", i consider it criminal; though they probably got some (lawyer written) fine print to say it is not so.
  - jondubois 9y ago
    Yes, it sounds like malware. Had any other company done this, it would have caused outrage but for some reason Facebook just seems to get away with everything. I remember how big a deal the News International phone hacking scandal was; this actually seems much worse.
    - willstrafach 9y ago
      Companies which track app download and engagement metrics also do this via VPN apps. That is how they are able to obtain such data. Not new, but also not discussed much.
  - daenney 9y ago
    I would be interested to hear from people with knowledge of EU and US law how shady this is in their respective jurisdictions. I'm having a hard time imagining what they did is OK, but I'm probably wrong.
    - WhiteSource1 9y ago
      If you can identify personal data (which if they can tie it to the user's Facebook account, that's pretty easy to do) it's likely (note: not a lawyer) a violation of the EU GDPR regulations (http://www.eugdpr.org/ http://www.eugdpr.org/)
      - daenney 9y ago
        Unfortunately GDPR enforcement is about 9 months away. I don't think it applies retroactively.
- 9y ago
daenney 9y ago
Here's the archive.is link if you hit the WSJ paywall: http://archive.is/r7GhC http://archive.is/r7GhC
wisepass 9y ago
The same article from alternative source https://outline.com/WnGGRk https://outline.com/WnGGRk
- subliminalpanda 9y ago
  Thanks.
- dublinben 9y ago
  If you prepend "facebook.com/l.php?u=" to a wsj link, it will let you read the full article. Like so: https://facebook.com/l.php?u=https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm-inside-peek-at-rivals-users-1502622003 https://facebook.com/l.php?u=https://www.wsj.com/articles/fa...
  - ballenf 9y ago
    How meta: a solution to let FB know that you're very motivated to read an article about FB going to great lengths to snoop on user data! Maybe that's the kind of data they need to reconsider their approach to privacy.
  - khc 9y ago
    that isn't working for me anymore :-(
  - edison85 9y ago
    Thanks!
greenwalls 9y ago
App Annie purchased Mobidia in 2015 which has an app called "My Data Manager" that is similar to Onavo. I think it is used in a similar way. https://techcrunch.com/2015/05/06/app-annie-acquires-mobile-measurement-service-mobidia/ https://techcrunch.com/2015/05/06/app-annie-acquires-mobile-... http://www.mydatamanagerapp.com/privacy-policy/ http://www.mydatamanagerapp.com/privacy-policy/ I wonder how many apps like this are out there?
grwthckrmstr 9y ago
It's brilliant in a way. But makes me cringe in a way as well.
rubatuga 9y ago
I was considering using this app about 2 years ago, since I wanted to try out a VPN and this was near the top of the list in the Apple App Store. However, one glance at the fact that it was owned by Facebook made me “nope” out immediately. I’m glad to have made the right decision.
wonder_bread 9y ago
Sounds a lot like Amazon owning Alexa (the website service), Google owning double click, etc.
- mpcovcd 9y ago
  I don't think that's a reasonable comparison. Alexa data is public, most of it can be accessed for free, and the rest at a reasonable price. Doubleclick is an advertising platform, it doesn't give insight into competitors metrics unless those competitors choose to share that information.
  - j_s 9y ago
    Does Google not monitor/monetize Google Fi, Google Fiber, Google Play Services, Google DNS, Google Chrome, Google Safe Browing, and on and on and on... (Google Maps, Google Location Services)
    - mpcovcd 9y ago
      None of those are marketed as a VPN or data security apps.
      - wonder_bread 9y ago
        I would argue most of Alexa's most import features are not free, doubleclick is still a cloak around the entire digital advertising industry that gives them access to actionable metrics of how websites are doing (i.e. maybe why they've pushed into job search recently). One commonality among all of them is being marketed as a service for smaller-scale companies while having the double-edged sword on the backend that is most likely what they are really after EDIT: smaller scale companies and individuals
      - j_s 9y ago
        Sorry, which goalpost am I aiming for? This one seems to be moving... Although not quoting until now (my mistake), my reply was specifically in response to your previous point: I don't think that's a reasonable comparison [...] it doesn't give insight into competitors metrics unless those competitors choose to share that information The lines begin to blur especially when discussing means of accessing the internet (especially most efficiently/safely) and/or core (semi-artificially-required) mobile phone operating system components! If nothing else they offer the path of least resistance. Any best-of-breed solution (GMail, Google Docs, Chrome - all somehwat a matter of opinion) or de facto monopoly-ish position (search, free analytics, Google Play Services?) by Google offers the potential for them to gain info on competitors in much the same way Amazon can take over succesful verticals originally occupied by a third party.
netsharc 9y ago
Having Xposed and XPrivacy on my old phone, it's really interesting what permissions apps request. For example FB Messenger requests the permission to enumerate installed packages: https://wroot.org/posts/enumerating-android-installed-applications-without-special-permissions/ https://wroot.org/posts/enumerating-android-installed-applic... and IIRC also enumerates running tasks. So it's probably simple to do analytics for the whole phone...
- bogomipz 9y ago
  >"Having Xposed and XPrivacy on my old phone," I would be curious to hear your feed back on Xposed oand Xprivacy. Also it sounds like you stopped using them, maybe you could say why? Cheers.
  - netsharc 9y ago
    I now have a phone with Nougat, according to the Xposed developers, Xposed doesn't yet work reliably with it. On Marshmallow it worked very well, Xprivacy would show pop-ups when an app tries to do something, you can either allow this, refuse this or allow/refuse for a period of time. Otherwise, Xprivacy's UI is a bit of a pain, but it's usable...
    - krackers 9y ago
      Do you remember what the performance impact of xprivacy was? I'm currently doing something similar with cyanogenmod's privacy guard + xposed app ops which allows statically revoking permissions, but Xprivacy seems to have a better little-snitch like ui
      - netsharc 9y ago
        I never really compared it with and without Xprivacy.
striking 9y ago
If you can't get by the paywall, Onavo isn't the only thing Facebook will let you get an inside peek at... https://www.facebook.com/l.php?u=https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm-inside-peek-at-rivals-users-1502622003 https://www.facebook.com/l.php?u=https://www.wsj.com/article...
- cbaleanu 9y ago
  Interesting find, by using that link, I gave FB some metrics about me and in return they sponsored my visit to the wsj article.
slackoverflower 9y ago
Facebook is very very evil, much more so than Google. SEC/DOJ/whoever needs to step in and stop Zuckerberg.
- 52-6F-62 9y ago
  I recently tried to log into their mobile, javascript-less site, and in order to let me continue to log in they required a photo of my face and my phone number. I've had to submit photos for online financial services/compliance, but not a social network that is tied into all kinds of other data. And that's what they asked because I wasn't running javascript. It raised my concerns about what they do when I do have javascript enabled on their services. And I work in a company that collects data from its clients -- but nowhere near their scale.
  - ballenf 9y ago
    Is this satire? Holy shit if not. Did you try fooling it? Wonder what their TOS allows them to do with just that data.
    - 52-6F-62 9y ago
      Quite real. Yeah I tried skirting the SMS/phone number feature but I didn't test the photo bit. I was too creeped out. If you can't replicate it through a standard browser, try through a VPN or TOR browser.
- deleted 9y ago
  [deleted]
- 659087 9y ago
  I think you're deluding yourself if you believe Google is far behind Facebook in the evil department. Both need to be put in their place, but I doubt we can count on the US government to make that happen.
- raverbashing 9y ago
  Don't worry, that will change when Zuck becomes president, then there will be "no need" for investigations
Nicholas7900 9y ago
BEWARE OF FAKE HACKERS WHO SCAM: If Truly you Are In Need Of A PROFESSIONAL HACKER Who Will Get Your Job Done Efficiently With Swift Response, You Have Met the Right Person. ANONYMITY: I don't care who you are. The reason why I am hired is to simply get the job done. I engage in"silent" attacks so the target remains unaware of the hack. MY HACKING CAPABILITIES: No job is too small, no job is too difficult. There are series of people who needs to Hack their target email I.D, social media websites/apps or smartphones, for many reasons such as husband cheating on wife, girlfriend cheating on boyfriend or vice versa. Or important information needed to be dumped from the target email address or for whatsoever reason you want to hack your target email address/social media websites, Or As a parent you might need to monitor what your children are doing on social media and on their personal computers so that they don’t get into trouble. Or if you want to hack a private domain email account(business email), Facebook, Twitter, contact me. Frankly speaking, I always give a 100% guarantee on any job I am been asked to do, because I have always been successful in Almost all my jobs for the past 10years and my clients can testify to that . To hack anything needs time though, but I can provide a swift response to your job depending on how fast and urgent you need. Time also depends on what exactly you want to hack and how serious you are. Enough time with social engineering is required for hacking. So if you want to bind me in a short time, then just don't contact me because I can't hack within one hour,sorry. Basically, time depends on your luck. If its good luck, then it is possible to hack within one hour but, if its in the other way round, it would take few hours. I have seen FAKE HACKERS claiming they can hack in 1hr , but there is no REAL HACKER who can say this (AVOID THEM). If your target account is Facebook, MySpace, Twitter, sexual accounts or other social accounts etc, or you want to hack into someones smartphone so you can monitor their calls, read their messages, chats, and social account activities without their notice, feel free to contact me and we would have a nice deal! I will explain to you how I am going to get the job done. HACKING A WEBSITE Perhaps, many people want to hack their target website for their personal reasons. I am enough experienced and skilled in hacking websites and getting access to database and I am providing the web hacking services. It may be for database access, database dump, getting access to a specific information, defacing, you might want me to hack into court database and Erase your criminal records, maybe for political reasons or competitor company etc. I dont care what type of site you will give me to pen test. Is it high profile or low profile or medium profile, I will do my possible best (just be sure that you are not going to make it a real crime otherwise I will ignore you). PAYMENT: PLEASE, think how much you will be paying for your job and don't waste time offering 100$ or 200$ (because we might require higher than that, depending on what you want to hack and the hack tool we are going to use. I accept various secure payment methods that maintains your anonymity. However, bank direct deposits and/or transfers are not accepted due to federal tracking laws. You can contact me for any other type of "hijacking and attacks". I do almost everything. Compositehacks@gmail.com
Nicholas7900 9y ago
BEWARE OF FAKE HACKERS WHO SCAM: If Truly you Are In Need Of A PROFESSIONAL HACKER Who Will Get Your Job Done Efficiently With Swift Response, You Have Met the Right Person. ANONYMITY: I don't care who you are. The reason why I am hired is to simply get the job done. I engage in"silent" attacks so the target remains unaware of the hack. MY HACKING CAPABILITIES: No job is too small, no job is too difficult. There are series of people who needs to Hack their target email I.D, social media websites/apps or smartphones, for many reasons such as husband cheating on wife, girlfriend cheating on boyfriend or vice versa. Or important information needed to be dumped from the target email address or for whatsoever reason you want to hack your target email address/social media websites, Or As a parent you might need to monitor what your children are doing on social media and on their personal computers so that they don’t get into trouble. Or if you want to hack a private domain email account(business email), Facebook, Twitter, contact me. Frankly speaking, I always give a 100% guarantee on any job I am been asked to do, because I have always been successful in Almost all my jobs for the past 10years and my clients can testify to that . To hack anything needs time though, but I can provide a swift response to your job depending on how fast and urgent you need. Time also depends on what exactly you want to hack and how serious you are. Enough time with social engineering is required for hacking. So if you want to bind me in a short time, then just don't contact me because I can't hack within one hour,sorry. Basically, time depends on your luck. If its good luck, then it is possible to hack within one hour but, if its in the other way round, it would take few hours. I have seen FAKE HACKERS claiming they can hack in 1hr , but there is no REAL HACKER who can say this (AVOID THEM). If your target account is Facebook, MySpace, Twitter, sexual accounts or other social accounts etc, or you want to hack into someones smartphone so you can monitor their calls, read their messages, chats, and social account activities without their notice, feel free to contact me and we would have a nice deal! I will explain to you how I am going to get the job done. HACKING A WEBSITE Perhaps, many people want to hack their target website for their personal reasons. I am enough experienced and skilled in hacking websites and getting access to database and I am providing the web hacking services. It may be for database access, database dump, getting access to a specific information, defacing, you might want me to hack into court database and Erase your criminal records, maybe for political reasons or competitor company etc. I dont care what type of site you will give me to pen test. Is it high profile or low profile or medium profile, I will do my possible best (just be sure that you are not going to make it a real crime otherwise I will ignore you). PAYMENT: PLEASE, think how much you will be paying for your job and don't waste time offering 100$ or 200$ (because we might require higher than that, depending on what you want to hack and the hack tool we are going to use. I accept various secure payment methods that maintains your anonymity. However, bank direct deposits and/or transfers are not accepted due to federal tracking laws. You can contact me for any other type of "hijacking and attacks". I do almost everything. Compositehacks@gmail.com
eyeball 9y ago
I really need to get my family to abandon whatsapp. I'm willing to bet facecrook is using that to spy on everything my phone does.
hedgew 9y ago
This is obviously unethical. That it might not be illegal is our failing. They provide false solutions to a fear that they themselves create. What's next? Giving every child a free phone on their 13th birthday? They already "gifted" the world's poorest with free internet. It's easiest to abuse those who have the least power to fight back. "By accepting this gift, you agree to our Terms and Conditions and Privacy Policy."
LeoNatan25 9y ago
This was a bad idea when the app was standalone—a no-name Israeli startup snooping into all your traffic—and now it's spyware. This is one major (if not THE) reason not to trust small startups with unclear privacy policies—they are often bought in order to (ab)use the data they have collected and continue abusing it from unsuspecting users. Terrible.
- devrandomguy 9y ago
  So, as the first tech hire/partner, what can we do to protect our users? - Expire non-critical data after 30 - 90 days, e.g. activity data, not account data. - When feasible, have the client encrypt the really private user data, only store encrypted blobs on the server (Protonmail does this). - Send out a positively worded, subtle email notice to warn the more savvy users of a pending acquisition, as soon as that news is no longer private. Let them disseminate the real sitrep on social media and in the news. We did build a community, after all. - Propose a data architecture update for great efficiency, in which redundant and superfluous data is cleaned and aggregated, before the big handover. Are there any other suggestions? I am particularly curious if the laws of any one user's country could be used to complicate or thwart a bulk handover of private user data to a new owner. Europeans, I'm looking at you for advice.
  - pdkl95 9y ago
    By far the most important protection you can provide is to bind your future abilities with a "Ulysses pact"[1]. Cory Doctorow ave a great talk[2] last year about how important it is to create these limitations when you don't need them, because there is a good chance you won't be strong enough to resist temptation when problems start accumulating. In some situations, it may not even be your choice. [1] https://en.wikipedia.org/wiki/Ulysses_pact https://en.wikipedia.org/wiki/Ulysses_pact [2] https://www.youtube.com/watch?v=D8ukyKQuNmY https://www.youtube.com/watch?v=D8ukyKQuNmY
  - rock_hard 9y ago
    SSL with pinned certificates would get you 95% there and is super easy to implement. And then only keep the data you actually need. And even of what you need you can probably anonymize a large chunk
samsolomon 9y ago
A comment on the WSJ brings up an interesting point—if Zuckerberg were to run for president, would he have access to this information? What else could he have access to? Given the amount of data Facebook has about everybody, I find that possibility worrisome. It seems obvious that a campaign strategist could segment individual states, regions and cities. They could target people based on likes and interests. They could get very granular with messaging—advertisers can do this through Facebook right now. But what other information could be used that advertisers don't have access to? Application usage, website visits, WhatsApp message keywords?
- 659087 9y ago
  > But what other information could be used that advertisers don't have access to? Application usage, website visits, WhatsApp keywords? Don't forget "private" conversations on messenger.
- caseysoftware 9y ago
  When you are active and who you interact with, allowing them to hit you with the "perfect" message at the right time. Having all your Likes - even the things you've unliked - so they know which celebrities to put in front of you. Having all of your browsing history+who you interact with and the language you use gives them near-perfect understanding of your opinions on policies and politicians going back the entire life your account all over the internet. That becomes incredibly simple to manipulate.. as I quoted yesterday: > "We predicted that our manipulation would produce a very small effect, if any, but that’s not what we found. On average, we were able to shift the proportion of people favouring any given candidate by more than 20 per cent overall and more than 60 per cent in some demographic groups. Even more disturbing, 99.5 per cent of our participants showed no awareness that they were viewing biased search rankings – in other words, that they were being manipulated." Ref: https://aeon.co/essays/how-the-internet-flips-elections-and-alters-our-thoughts https://aeon.co/essays/how-the-internet-flips-elections-and-...
- LeoNatan25 9y ago
  One could cynically say that the fake news spreading in this election on Facebook could have been a preliminary test of their algorithm for crowd control. Is such a theory really that far fetched, given news like this?
yohann305 9y ago
Now THIS is a glimpse of what could happen if internet service providers such as AT&T or Comcast are allowed to snoop on traffic. This could happen in large-scale if we don't keep an eye on internet data privacy. Let's stay vigilant. Upvote to spread the words
- deleted 9y ago
  [deleted]
jgalt212 9y ago
Onavo is similar, but more comprehensive than the now "fixed" css history leak. https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/ https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
RSchaeffer 9y ago
"Alphabet Inc., through its Google Android operating system for smartphones, and Apple Inc. also have the ability to monitor how rivals' apps perform on their mobile platforms, but it isn't clear whether they use that information to shape their product road maps." Does anyone have any other sources that can confirm or deny whether Google/Apple use their mobile OSes like Facebook uses Onavo?
- telcodud 9y ago
  I'd imagine that platform companies have greater obligations towards their developers.
marinman 9y ago
From a pure strategy perspective, it's also quite brilliant. Without a real app store of its own, they don't have the directional data that the App Store or Google Play have. It's also incredibly shady.
AznHisoka 9y ago
This type of "spying" has been going on for a long long time [1]. It's just that people have conveniently ignored it, and the companies that use this data have not been outed. See SimilarWeb, Jumpshot and other clickstream companies that buy Google extensions and keep track of every single URL you visit. [1] https://www.howtogeek.com/180175/warning-your-browser-extensions-are-spying-on-you/ https://www.howtogeek.com/180175/warning-your-browser-extens...
- adjkant 9y ago
  I think the reason you see the objection more here is the consolidation of information Facebook is going for.
abalone 9y ago
I'm glad WSJ followed up on their previous Onavo-Facebook story[1], but they didn't go far enough. They still didn't investigate the claims in many app store reviews of deceptive marketing that gets people to install this in the first place, i.e. "Your phone is infected by a virus, install this now!!" And yes, probably those ads can't be directly traced to Onavo/Facebook, but it's a free app with no affiliate commissions so they're only one with an incentive. > A Facebook spokesman said it is clear when people download Onavo what information it collects and how it is used. “Websites and apps have used market-research services for years,” the spokesman said... This is such a bullshit, disingenuous statement. It is not at all clear how Onavo uses your information. They have just one line in their description: "Onavo receives and analyzes information about your mobile data and app use." Here's why this is deceptive: 1. It is buried. It is the last line, below the "more..." fold so most users don't see it. Something this privacy-invasive should have a prominent, clear disclaimer at the top. 2. It is misleading. Even for the users that see it, they make no mention of using your data for market research. They prominently advertise a feature that reports on your overall data usage -- to you, the user. So this statement is just vague enough to imply that's what they're doing, without setting off alarm that they're spying on your every move for their own purposes. And then they have the nerve to equate it with "market-research services" that everyone uses.. no big deal.. move along, nothing to see here.. What baloney. Typical market-research services do not involve spyware that you trick people into installing. Participants are supposed to know exactly what they're participating in. That is clearly not the case with this deceptive, exploitive app. [1] Some previous discussion: https://news.ycombinator.com/item?id=14970877 https://news.ycombinator.com/item?id=14970877
Jimmie_Rustle 9y ago
| Onavo’s data comes from Onavo Protect, a free mobile app that bills itself as a way to “keep you and your data safe” oh what irony
tehlike 9y ago
there is a reason why there are so many battery cleaner & anti virus apps with almost-god permissions.
bhhaskin 9y ago
It's really scary the amount of power we free give companies like Facebook and Google.
pier25 9y ago
Whenever I see stuff like this I wonder if Mark Zuckerberg is even aware of such things. I work in a small company of less than 50 people and different teams/depts. barely know what each other is working on.

270 points by daenney 9y ago

pdog 9y ago

How is Onavo a "data-security app" if it lets Facebook track everything you do, including encrypted traffic?

lightbyte 9y ago
They forgot to mention that the one being secured is Facebook, not the user.
- jklein11 9y ago
  If you aren't paying for it, you aren't the user. You are the product.

irpapakons 9y ago

It's ethically dubious that the advertised function of the app is a VPN to "keep you and your data safe", while the reason it exists is so that all phone traffic goes to Facebook. This is not clear from the app description -- there is only a generic message about monitored app use, to which users are so used as to not pay any attention. > "The app's privacy policy says it may share information with "affiliates" that include its owner, Facebook. "As part of this process, Onavo receives and analyzes information about your mobile data and app use" > A Facebook spokesman said it is clear when people download Onavo what information it collects and how it is used. "Websites and apps have used market-research services for years," the spokesman said, noting that the company also uses outside services to help it understand the market and improve services. Then Facebook can attack the competition by seeing in real time how usage of competitive apps varies in response to new features and inform acquisition decisions. > Onavo's data paved the way for the purchase of WhatsApp for $22 billion. Onavo showed the messaging app was installed on 99% of all Android phones in Spain -- showing WhatsApp was changing how an entire country communicated, the people said.

thinkMOAR 9y ago
"ethically dubious", i consider it criminal; though they probably got some (lawyer written) fine print to say it is not so.
- jondubois 9y ago
  Yes, it sounds like malware. Had any other company done this, it would have caused outrage but for some reason Facebook just seems to get away with everything. I remember how big a deal the News International phone hacking scandal was; this actually seems much worse.
  - willstrafach 9y ago
    Companies which track app download and engagement metrics also do this via VPN apps. That is how they are able to obtain such data. Not new, but also not discussed much.
- daenney 9y ago
  I would be interested to hear from people with knowledge of EU and US law how shady this is in their respective jurisdictions. I'm having a hard time imagining what they did is OK, but I'm probably wrong.
  - WhiteSource1 9y ago
    If you can identify personal data (which if they can tie it to the user's Facebook account, that's pretty easy to do) it's likely (note: not a lawyer) a violation of the EU GDPR regulations (http://www.eugdpr.org/ http://www.eugdpr.org/)
    - daenney 9y ago
      Unfortunately GDPR enforcement is about 9 months away. I don't think it applies retroactively.
9y ago

daenney 9y ago

Here's the archive.is link if you hit the WSJ paywall: http://archive.is/r7GhC http://archive.is/r7GhC

wisepass 9y ago

The same article from alternative source https://outline.com/WnGGRk https://outline.com/WnGGRk

subliminalpanda 9y ago
Thanks.
dublinben 9y ago
If you prepend "facebook.com/l.php?u=" to a wsj link, it will let you read the full article. Like so: https://facebook.com/l.php?u=https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm-inside-peek-at-rivals-users-1502622003 https://facebook.com/l.php?u=https://www.wsj.com/articles/fa...
- ballenf 9y ago
  How meta: a solution to let FB know that you're very motivated to read an article about FB going to great lengths to snoop on user data! Maybe that's the kind of data they need to reconsider their approach to privacy.
- khc 9y ago
  that isn't working for me anymore :-(
- edison85 9y ago
  Thanks!

greenwalls 9y ago

App Annie purchased Mobidia in 2015 which has an app called "My Data Manager" that is similar to Onavo. I think it is used in a similar way. https://techcrunch.com/2015/05/06/app-annie-acquires-mobile-measurement-service-mobidia/ https://techcrunch.com/2015/05/06/app-annie-acquires-mobile-... http://www.mydatamanagerapp.com/privacy-policy/ http://www.mydatamanagerapp.com/privacy-policy/ I wonder how many apps like this are out there?

grwthckrmstr 9y ago

It's brilliant in a way. But makes me cringe in a way as well.

rubatuga 9y ago

I was considering using this app about 2 years ago, since I wanted to try out a VPN and this was near the top of the list in the Apple App Store. However, one glance at the fact that it was owned by Facebook made me “nope” out immediately. I’m glad to have made the right decision.

wonder_bread 9y ago

Sounds a lot like Amazon owning Alexa (the website service), Google owning double click, etc.

mpcovcd 9y ago
I don't think that's a reasonable comparison. Alexa data is public, most of it can be accessed for free, and the rest at a reasonable price. Doubleclick is an advertising platform, it doesn't give insight into competitors metrics unless those competitors choose to share that information.
- j_s 9y ago
  Does Google not monitor/monetize Google Fi, Google Fiber, Google Play Services, Google DNS, Google Chrome, Google Safe Browing, and on and on and on... (Google Maps, Google Location Services)
  - mpcovcd 9y ago
    None of those are marketed as a VPN or data security apps.
    - wonder_bread 9y ago
      I would argue most of Alexa's most import features are not free, doubleclick is still a cloak around the entire digital advertising industry that gives them access to actionable metrics of how websites are doing (i.e. maybe why they've pushed into job search recently). One commonality among all of them is being marketed as a service for smaller-scale companies while having the double-edged sword on the backend that is most likely what they are really after EDIT: smaller scale companies and individuals
    - j_s 9y ago
      Sorry, which goalpost am I aiming for? This one seems to be moving... Although not quoting until now (my mistake), my reply was specifically in response to your previous point: I don't think that's a reasonable comparison [...] it doesn't give insight into competitors metrics unless those competitors choose to share that information The lines begin to blur especially when discussing means of accessing the internet (especially most efficiently/safely) and/or core (semi-artificially-required) mobile phone operating system components! If nothing else they offer the path of least resistance. Any best-of-breed solution (GMail, Google Docs, Chrome - all somehwat a matter of opinion) or de facto monopoly-ish position (search, free analytics, Google Play Services?) by Google offers the potential for them to gain info on competitors in much the same way Amazon can take over succesful verticals originally occupied by a third party.

netsharc 9y ago

Having Xposed and XPrivacy on my old phone, it's really interesting what permissions apps request. For example FB Messenger requests the permission to enumerate installed packages: https://wroot.org/posts/enumerating-android-installed-applications-without-special-permissions/ https://wroot.org/posts/enumerating-android-installed-applic... and IIRC also enumerates running tasks. So it's probably simple to do analytics for the whole phone...

bogomipz 9y ago
>"Having Xposed and XPrivacy on my old phone," I would be curious to hear your feed back on Xposed oand Xprivacy. Also it sounds like you stopped using them, maybe you could say why? Cheers.
- netsharc 9y ago
  I now have a phone with Nougat, according to the Xposed developers, Xposed doesn't yet work reliably with it. On Marshmallow it worked very well, Xprivacy would show pop-ups when an app tries to do something, you can either allow this, refuse this or allow/refuse for a period of time. Otherwise, Xprivacy's UI is a bit of a pain, but it's usable...
  - krackers 9y ago
    Do you remember what the performance impact of xprivacy was? I'm currently doing something similar with cyanogenmod's privacy guard + xposed app ops which allows statically revoking permissions, but Xprivacy seems to have a better little-snitch like ui
    - netsharc 9y ago
      I never really compared it with and without Xprivacy.

striking 9y ago

If you can't get by the paywall, Onavo isn't the only thing Facebook will let you get an inside peek at... https://www.facebook.com/l.php?u=https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm-inside-peek-at-rivals-users-1502622003 https://www.facebook.com/l.php?u=https://www.wsj.com/article...

cbaleanu 9y ago
Interesting find, by using that link, I gave FB some metrics about me and in return they sponsored my visit to the wsj article.

slackoverflower 9y ago

Facebook is very very evil, much more so than Google. SEC/DOJ/whoever needs to step in and stop Zuckerberg.

52-6F-62 9y ago
I recently tried to log into their mobile, javascript-less site, and in order to let me continue to log in they required a photo of my face and my phone number. I've had to submit photos for online financial services/compliance, but not a social network that is tied into all kinds of other data. And that's what they asked because I wasn't running javascript. It raised my concerns about what they do when I do have javascript enabled on their services. And I work in a company that collects data from its clients -- but nowhere near their scale.
- ballenf 9y ago
  Is this satire? Holy shit if not. Did you try fooling it? Wonder what their TOS allows them to do with just that data.
  - 52-6F-62 9y ago
    Quite real. Yeah I tried skirting the SMS/phone number feature but I didn't test the photo bit. I was too creeped out. If you can't replicate it through a standard browser, try through a VPN or TOR browser.
deleted 9y ago
[deleted]
659087 9y ago
I think you're deluding yourself if you believe Google is far behind Facebook in the evil department. Both need to be put in their place, but I doubt we can count on the US government to make that happen.
raverbashing 9y ago
Don't worry, that will change when Zuck becomes president, then there will be "no need" for investigations

Nicholas7900 9y ago

BEWARE OF FAKE HACKERS WHO SCAM: If Truly you Are In Need Of A PROFESSIONAL HACKER Who Will Get Your Job Done Efficiently With Swift Response, You Have Met the Right Person. ANONYMITY: I don't care who you are. The reason why I am hired is to simply get the job done. I engage in"silent" attacks so the target remains unaware of the hack. MY HACKING CAPABILITIES: No job is too small, no job is too difficult. There are series of people who needs to Hack their target email I.D, social media websites/apps or smartphones, for many reasons such as husband cheating on wife, girlfriend cheating on boyfriend or vice versa. Or important information needed to be dumped from the target email address or for whatsoever reason you want to hack your target email address/social media websites, Or As a parent you might need to monitor what your children are doing on social media and on their personal computers so that they don’t get into trouble. Or if you want to hack a private domain email account(business email), Facebook, Twitter, contact me. Frankly speaking, I always give a 100% guarantee on any job I am been asked to do, because I have always been successful in Almost all my jobs for the past 10years and my clients can testify to that . To hack anything needs time though, but I can provide a swift response to your job depending on how fast and urgent you need. Time also depends on what exactly you want to hack and how serious you are. Enough time with social engineering is required for hacking. So if you want to bind me in a short time, then just don't contact me because I can't hack within one hour,sorry. Basically, time depends on your luck. If its good luck, then it is possible to hack within one hour but, if its in the other way round, it would take few hours. I have seen FAKE HACKERS claiming they can hack in 1hr , but there is no REAL HACKER who can say this (AVOID THEM). If your target account is Facebook, MySpace, Twitter, sexual accounts or other social accounts etc, or you want to hack into someones smartphone so you can monitor their calls, read their messages, chats, and social account activities without their notice, feel free to contact me and we would have a nice deal! I will explain to you how I am going to get the job done. HACKING A WEBSITE Perhaps, many people want to hack their target website for their personal reasons. I am enough experienced and skilled in hacking websites and getting access to database and I am providing the web hacking services. It may be for database access, database dump, getting access to a specific information, defacing, you might want me to hack into court database and Erase your criminal records, maybe for political reasons or competitor company etc. I dont care what type of site you will give me to pen test. Is it high profile or low profile or medium profile, I will do my possible best (just be sure that you are not going to make it a real crime otherwise I will ignore you). PAYMENT: PLEASE, think how much you will be paying for your job and don't waste time offering 100$ or 200$ (because we might require higher than that, depending on what you want to hack and the hack tool we are going to use. I accept various secure payment methods that maintains your anonymity. However, bank direct deposits and/or transfers are not accepted due to federal tracking laws. You can contact me for any other type of "hijacking and attacks". I do almost everything. Compositehacks@gmail.com

Nicholas7900 9y ago

eyeball 9y ago

I really need to get my family to abandon whatsapp. I'm willing to bet facecrook is using that to spy on everything my phone does.

hedgew 9y ago

This is obviously unethical. That it might not be illegal is our failing. They provide false solutions to a fear that they themselves create. What's next? Giving every child a free phone on their 13th birthday? They already "gifted" the world's poorest with free internet. It's easiest to abuse those who have the least power to fight back. "By accepting this gift, you agree to our Terms and Conditions and Privacy Policy."

LeoNatan25 9y ago

This was a bad idea when the app was standalone—a no-name Israeli startup snooping into all your traffic—and now it's spyware. This is one major (if not THE) reason not to trust small startups with unclear privacy policies—they are often bought in order to (ab)use the data they have collected and continue abusing it from unsuspecting users. Terrible.

devrandomguy 9y ago
So, as the first tech hire/partner, what can we do to protect our users? - Expire non-critical data after 30 - 90 days, e.g. activity data, not account data. - When feasible, have the client encrypt the really private user data, only store encrypted blobs on the server (Protonmail does this). - Send out a positively worded, subtle email notice to warn the more savvy users of a pending acquisition, as soon as that news is no longer private. Let them disseminate the real sitrep on social media and in the news. We did build a community, after all. - Propose a data architecture update for great efficiency, in which redundant and superfluous data is cleaned and aggregated, before the big handover. Are there any other suggestions? I am particularly curious if the laws of any one user's country could be used to complicate or thwart a bulk handover of private user data to a new owner. Europeans, I'm looking at you for advice.
- pdkl95 9y ago
  By far the most important protection you can provide is to bind your future abilities with a "Ulysses pact"[1]. Cory Doctorow ave a great talk[2] last year about how important it is to create these limitations when you don't need them, because there is a good chance you won't be strong enough to resist temptation when problems start accumulating. In some situations, it may not even be your choice. [1] https://en.wikipedia.org/wiki/Ulysses_pact https://en.wikipedia.org/wiki/Ulysses_pact [2] https://www.youtube.com/watch?v=D8ukyKQuNmY https://www.youtube.com/watch?v=D8ukyKQuNmY
- rock_hard 9y ago
  SSL with pinned certificates would get you 95% there and is super easy to implement. And then only keep the data you actually need. And even of what you need you can probably anonymize a large chunk

samsolomon 9y ago

A comment on the WSJ brings up an interesting point—if Zuckerberg were to run for president, would he have access to this information? What else could he have access to? Given the amount of data Facebook has about everybody, I find that possibility worrisome. It seems obvious that a campaign strategist could segment individual states, regions and cities. They could target people based on likes and interests. They could get very granular with messaging—advertisers can do this through Facebook right now. But what other information could be used that advertisers don't have access to? Application usage, website visits, WhatsApp message keywords?

659087 9y ago
> But what other information could be used that advertisers don't have access to? Application usage, website visits, WhatsApp keywords? Don't forget "private" conversations on messenger.
caseysoftware 9y ago
When you are active and who you interact with, allowing them to hit you with the "perfect" message at the right time. Having all your Likes - even the things you've unliked - so they know which celebrities to put in front of you. Having all of your browsing history+who you interact with and the language you use gives them near-perfect understanding of your opinions on policies and politicians going back the entire life your account all over the internet. That becomes incredibly simple to manipulate.. as I quoted yesterday: > "We predicted that our manipulation would produce a very small effect, if any, but that’s not what we found. On average, we were able to shift the proportion of people favouring any given candidate by more than 20 per cent overall and more than 60 per cent in some demographic groups. Even more disturbing, 99.5 per cent of our participants showed no awareness that they were viewing biased search rankings – in other words, that they were being manipulated." Ref: https://aeon.co/essays/how-the-internet-flips-elections-and-alters-our-thoughts https://aeon.co/essays/how-the-internet-flips-elections-and-...
LeoNatan25 9y ago
One could cynically say that the fake news spreading in this election on Facebook could have been a preliminary test of their algorithm for crowd control. Is such a theory really that far fetched, given news like this?

yohann305 9y ago

Now THIS is a glimpse of what could happen if internet service providers such as AT&T or Comcast are allowed to snoop on traffic. This could happen in large-scale if we don't keep an eye on internet data privacy. Let's stay vigilant. Upvote to spread the words

deleted 9y ago
[deleted]

jgalt212 9y ago

Onavo is similar, but more comprehensive than the now "fixed" css history leak. https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/ https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...

RSchaeffer 9y ago

"Alphabet Inc., through its Google Android operating system for smartphones, and Apple Inc. also have the ability to monitor how rivals' apps perform on their mobile platforms, but it isn't clear whether they use that information to shape their product road maps." Does anyone have any other sources that can confirm or deny whether Google/Apple use their mobile OSes like Facebook uses Onavo?

telcodud 9y ago
I'd imagine that platform companies have greater obligations towards their developers.

marinman 9y ago

From a pure strategy perspective, it's also quite brilliant. Without a real app store of its own, they don't have the directional data that the App Store or Google Play have. It's also incredibly shady.

AznHisoka 9y ago

This type of "spying" has been going on for a long long time [1]. It's just that people have conveniently ignored it, and the companies that use this data have not been outed. See SimilarWeb, Jumpshot and other clickstream companies that buy Google extensions and keep track of every single URL you visit. [1] https://www.howtogeek.com/180175/warning-your-browser-extensions-are-spying-on-you/ https://www.howtogeek.com/180175/warning-your-browser-extens...

adjkant 9y ago
I think the reason you see the objection more here is the consolidation of information Facebook is going for.

abalone 9y ago

I'm glad WSJ followed up on their previous Onavo-Facebook story[1], but they didn't go far enough. They still didn't investigate the claims in many app store reviews of deceptive marketing that gets people to install this in the first place, i.e. "Your phone is infected by a virus, install this now!!" And yes, probably those ads can't be directly traced to Onavo/Facebook, but it's a free app with no affiliate commissions so they're only one with an incentive. > A Facebook spokesman said it is clear when people download Onavo what information it collects and how it is used. “Websites and apps have used market-research services for years,” the spokesman said... This is such a bullshit, disingenuous statement. It is not at all clear how Onavo uses your information. They have just one line in their description: "Onavo receives and analyzes information about your mobile data and app use." Here's why this is deceptive: 1. It is buried. It is the last line, below the "more..." fold so most users don't see it. Something this privacy-invasive should have a prominent, clear disclaimer at the top. 2. It is misleading. Even for the users that see it, they make no mention of using your data for market research. They prominently advertise a feature that reports on your overall data usage -- to you, the user. So this statement is just vague enough to imply that's what they're doing, without setting off alarm that they're spying on your every move for their own purposes. And then they have the nerve to equate it with "market-research services" that everyone uses.. no big deal.. move along, nothing to see here.. What baloney. Typical market-research services do not involve spyware that you trick people into installing. Participants are supposed to know exactly what they're participating in. That is clearly not the case with this deceptive, exploitive app. [1] Some previous discussion: https://news.ycombinator.com/item?id=14970877 https://news.ycombinator.com/item?id=14970877

Jimmie_Rustle 9y ago

| Onavo’s data comes from Onavo Protect, a free mobile app that bills itself as a way to “keep you and your data safe” oh what irony

tehlike 9y ago

there is a reason why there are so many battery cleaner & anti virus apps with almost-god permissions.

bhhaskin 9y ago

It's really scary the amount of power we free give companies like Facebook and Google.

pier25 9y ago

Whenever I see stuff like this I wonder if Mark Zuckerberg is even aware of such things. I work in a small company of less than 50 people and different teams/depts. barely know what each other is working on.