6 ms·

Do Not, I Repeat, Do Not Download Onavo, Facebook’s Vampiric VPN Service

111 points by ourmandave 9y ago

BuildTheRobots 9y ago
Apart from tunnelling all traffic, Has anyone checked to see how malicious the Onavo installer is? The pessimist in me expects SSL root certs and even keylogg-e-r-s - apologies, dictionary personalisation profiles.
- mankash666 9y ago
  Why do you suspect the Onavo installer to be malicious?
  - eganist 9y ago
    Other practices like https://www.fastcompany.com/40451455/facebook-is-spying-on-your-phone-habits-to-figure-out-which-ideas-to-steal-next https://www.fastcompany.com/40451455/facebook-is-spying-on-y...
    - BuildTheRobots 9y ago
      That (distrust in general) but also the fact it seems to be sold as a "Protection" service - which, if you look at a decent number of "secure browsers" tends to involve protecting you from encrypted sites.
degenerate 9y ago
How can any self-respecting programmer at FB work on a project like this? At least most of the IE6 toolbar spyware had some useful purpose for the end-user... smileys, pagerank, search bar etc... This on the other hand is straight up deception in my mind. Hot air. Prove me wrong? What benefit does anyone get from installing this?
- draw_down 9y ago
  Programmers typically don’t work on mergers and acquisitions.
- bubblethink 9y ago
  Google does it too. It kicks in when you are on public wifi if you opt in. It's a vpn app at the end of the day that's optional. I don't see much reason for all the outcry. Assuming a majority of the web moves to https soon (going by the chrome roadmap), you are only giving second order data like dns to the vpn or isp. And I don't see much reason to trust isps more than Google/FB.
- tushar-r 9y ago
  >How can any self-respecting programmer at FB work on a project like this? You mean like the hundreds who work on Deep packet inspection technology?
  - hetspookjee 9y ago
    Catch child predators and terrorism seems like a probable rationalisation.
- Grangar 9y ago
  We need something like a Hippocratic Oath for IT professionals.
  - TomMarius 9y ago
    We might need it but it's of course impossible given how easy it is even for a child to get started in professional IT.
    - IntronExon 9y ago
      Have a software equivalent of the AMA, have licenses to practice, and that’s solved.
dfee 9y ago
What’s most alarming are the AppStore reviews [0] - a majority of the authors appear to have downloaded the app after clicking a banner ad which claimed their iPhone had viruses. For example: “I just downloaded it today because of four viruses so I hope it helps get rid of them” - burnt tacos [0] https://itunes.apple.com/us/app/onavo-protect-vpn-security/id577491499?mt=8 https://itunes.apple.com/us/app/onavo-protect-vpn-security/i...
dzhiurgis 9y ago
This all depends whether you trust your ISP more than Facebook or not.
- 8_hours_ago 9y ago
  I pay my ISP a lot of money each month. They don’t need my data to be profitable. Facebook, on the other hand, has a business model completely dependent on selling advertising based on my data to 3rd parties.
  - lazyman75 9y ago
    Exactly. It's terrifying how many people still don't get it, no matter how many times it is repeated - you are not a customer, you are a product!
  - sprayk 9y ago
    off the top of my head, AT&T and Verizon have done various forms of customer tracking for advertisers. They both used supercookies at some point, which were injected into customer egress, and ATT used to inspect web traffic in order to target ads (opt-out with a monthly fee, of course).
    - jmknoll 9y ago
      Certainly, if ISPs can access your data, they would like to. Its basically free money. But its not a life-or-death situation for them, and thus my (somewhat uneducated) guess is that there is less management focus on things like deep packet inspection and consumer targeting. They can also jsut jack up prices or sell more subscriptions. At Facebook, on the other hand, selling ads is priority number 0. Its the only way to make money. So I'd worry more about Facebook seeing my traffic.
    - tamrix 9y ago
      However that happened in America, land of the greed. If you're from other countries, I think the point still stands.
lafar6502 9y ago
But what kind of security does it provide? Website blocker?
- beckler 9y ago
  A VPN provides a secure tunnel, so it prevents your data from being sniffed on the insecure WiFi in your local coffee shop, and up every hop to the terminating server. So you can prevent an ISP and friendly neighborhood hacker from seeing your requests. However, the terminating server can see EVERYTHING. So if you want a VPN, use https://github.com/trailofbits/algo https://github.com/trailofbits/algo or https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand. Algo is my favorite, but both are pretty effective in my opinion.
dingo_bat 9y ago
Exactly the low quality crap you would expect from gizmodo. Who would you rather trust? Random VPN app or Facebook? The choice is obvious to me.
- craftyguy 9y ago
  Well in this case "random VPN app" and "facebook" are the same thing. So you automatically lose if you choose either!
  - dingo_bat 9y ago
    No they aren't? Random VPN app is like one of these[0], and Facebook is a $100 billion social media giant, trusted by billions of people. [0] https://goo.gl/kDPjxf https://goo.gl/kDPjxf
    - Fins 9y ago
      But at least with those Random VPN apps there is some chance that they are not actually stealing your data. With Facebook there is not. And if billions of people trust Facebook, that's just a sad commentary on the amound of critical thinking in the world.
    - yousir 9y ago
      Creating an app and calling it "protection" when it is in fact spying on you to give FB a glimpse of how you use the internet, this is something you are defending? And also, did you just call the gizmodo article "fake news"? It this [0] then also fake news to you? Seems to me you are getting your true news fix from a news feed somewhere. [0] https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm-inside-peek-at-rivals-users-1502622003 https://www.wsj.com/articles/facebooks-onavo-gives-social-me...
    - kup0 9y ago
      Facebook bought Onavo. Facebook owns Onavo. They are not a random VPN app. They are a Facebook property. They are touting the VPN as being protection, when in actuality they are using it to gather data on the users that use the VPN. I do not understand your comments in light of these facts. If one trusts Facebook, then using Onavo isn't a concern for them, but they should be aware just because it's a VPN it doesn't imply any kind of privacy or protection, and should be aware that Facebook's marketing/use of Onavo is shady. If one already does not trust Facebook, then it should be clear to stay away from Onavo, whether found randomly, through an app store, or advertised by Facebook.

111 points by ourmandave 9y ago

Apart from tunnelling all traffic, Has anyone checked to see how malicious the Onavo installer is? The pessimist in me expects SSL root certs and even keylogg-e-r-s - apologies, dictionary personalisation profiles.

mankash666 9y ago
Why do you suspect the Onavo installer to be malicious?
- eganist 9y ago
  Other practices like https://www.fastcompany.com/40451455/facebook-is-spying-on-your-phone-habits-to-figure-out-which-ideas-to-steal-next https://www.fastcompany.com/40451455/facebook-is-spying-on-y...
  - BuildTheRobots 9y ago
    That (distrust in general) but also the fact it seems to be sold as a "Protection" service - which, if you look at a decent number of "secure browsers" tends to involve protecting you from encrypted sites.

degenerate 9y ago

How can any self-respecting programmer at FB work on a project like this? At least most of the IE6 toolbar spyware had some useful purpose for the end-user... smileys, pagerank, search bar etc... This on the other hand is straight up deception in my mind. Hot air. Prove me wrong? What benefit does anyone get from installing this?

draw_down 9y ago
Programmers typically don’t work on mergers and acquisitions.
bubblethink 9y ago
Google does it too. It kicks in when you are on public wifi if you opt in. It's a vpn app at the end of the day that's optional. I don't see much reason for all the outcry. Assuming a majority of the web moves to https soon (going by the chrome roadmap), you are only giving second order data like dns to the vpn or isp. And I don't see much reason to trust isps more than Google/FB.
tushar-r 9y ago
>How can any self-respecting programmer at FB work on a project like this? You mean like the hundreds who work on Deep packet inspection technology?
- hetspookjee 9y ago
  Catch child predators and terrorism seems like a probable rationalisation.
Grangar 9y ago
We need something like a Hippocratic Oath for IT professionals.
- TomMarius 9y ago
  We might need it but it's of course impossible given how easy it is even for a child to get started in professional IT.
  - IntronExon 9y ago
    Have a software equivalent of the AMA, have licenses to practice, and that’s solved.

dfee 9y ago

What’s most alarming are the AppStore reviews [0] - a majority of the authors appear to have downloaded the app after clicking a banner ad which claimed their iPhone had viruses. For example: “I just downloaded it today because of four viruses so I hope it helps get rid of them” - burnt tacos [0] https://itunes.apple.com/us/app/onavo-protect-vpn-security/id577491499?mt=8 https://itunes.apple.com/us/app/onavo-protect-vpn-security/i...

dzhiurgis 9y ago

This all depends whether you trust your ISP more than Facebook or not.

8_hours_ago 9y ago
I pay my ISP a lot of money each month. They don’t need my data to be profitable. Facebook, on the other hand, has a business model completely dependent on selling advertising based on my data to 3rd parties.
- lazyman75 9y ago
  Exactly. It's terrifying how many people still don't get it, no matter how many times it is repeated - you are not a customer, you are a product!
- sprayk 9y ago
  off the top of my head, AT&T and Verizon have done various forms of customer tracking for advertisers. They both used supercookies at some point, which were injected into customer egress, and ATT used to inspect web traffic in order to target ads (opt-out with a monthly fee, of course).
  - jmknoll 9y ago
    Certainly, if ISPs can access your data, they would like to. Its basically free money. But its not a life-or-death situation for them, and thus my (somewhat uneducated) guess is that there is less management focus on things like deep packet inspection and consumer targeting. They can also jsut jack up prices or sell more subscriptions. At Facebook, on the other hand, selling ads is priority number 0. Its the only way to make money. So I'd worry more about Facebook seeing my traffic.
  - tamrix 9y ago
    However that happened in America, land of the greed. If you're from other countries, I think the point still stands.

lafar6502 9y ago

But what kind of security does it provide? Website blocker?

beckler 9y ago
A VPN provides a secure tunnel, so it prevents your data from being sniffed on the insecure WiFi in your local coffee shop, and up every hop to the terminating server. So you can prevent an ISP and friendly neighborhood hacker from seeing your requests. However, the terminating server can see EVERYTHING. So if you want a VPN, use https://github.com/trailofbits/algo https://github.com/trailofbits/algo or https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand. Algo is my favorite, but both are pretty effective in my opinion.

dingo_bat 9y ago

Exactly the low quality crap you would expect from gizmodo. Who would you rather trust? Random VPN app or Facebook? The choice is obvious to me.

craftyguy 9y ago
Well in this case "random VPN app" and "facebook" are the same thing. So you automatically lose if you choose either!
- dingo_bat 9y ago
  No they aren't? Random VPN app is like one of these[0], and Facebook is a $100 billion social media giant, trusted by billions of people. [0] https://goo.gl/kDPjxf https://goo.gl/kDPjxf
  - Fins 9y ago
    But at least with those Random VPN apps there is some chance that they are not actually stealing your data. With Facebook there is not. And if billions of people trust Facebook, that's just a sad commentary on the amound of critical thinking in the world.
  - yousir 9y ago
    Creating an app and calling it "protection" when it is in fact spying on you to give FB a glimpse of how you use the internet, this is something you are defending? And also, did you just call the gizmodo article "fake news"? It this [0] then also fake news to you? Seems to me you are getting your true news fix from a news feed somewhere. [0] https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm-inside-peek-at-rivals-users-1502622003 https://www.wsj.com/articles/facebooks-onavo-gives-social-me...
  - kup0 9y ago
    Facebook bought Onavo. Facebook owns Onavo. They are not a random VPN app. They are a Facebook property. They are touting the VPN as being protection, when in actuality they are using it to gather data on the users that use the VPN. I do not understand your comments in light of these facts. If one trusts Facebook, then using Onavo isn't a concern for them, but they should be aware just because it's a VPN it doesn't imply any kind of privacy or protection, and should be aware that Facebook's marketing/use of Onavo is shady. If one already does not trust Facebook, then it should be clear to stay away from Onavo, whether found randomly, through an app store, or advertised by Facebook.