8 ms·

This is malware and should have been rejected from the App Store months (if not years ago). Better late than never. I'm sure if it was a smaller company doing

This is malware and should have been rejected from the App Store months (if not years ago). Better late than never. I'm sure if it was a smaller company doing a similar thing they wouldn't have been given such leeway as Facebook was for so long.

deleted 8y ago
[deleted]
meritt 8y ago
Eh, I dunno. My Data Manager [1] (owned by Mobidia / App Annie) is still going strong. It along with other VPN-based apps are a major source of user-level app usage and engagement data being sold to large corporations and investors. In-app analytics libraries are another source (which are heavily fragmented since they only can track apps they're packaged with) but it's going to be a lot more difficult for Apple to regulate those. Until Apple starts banning all of these types of apps and libraries (which their recently updated policies indicate they just might [2]), I view this as more of a strategic play against Facebook as opposed to in the best interest of users. [1] https://itunes.apple.com/us/app/my-data-manager-track-your/id477865384?mt=8 https://itunes.apple.com/us/app/my-data-manager-track-your/i... [2] http://www.integrity-research.com/new-apple-policies-threaten-alternative-data/ http://www.integrity-research.com/new-apple-policies-threate...
- happybuy 8y ago
  Apple quickly and efficiently banned all VPN-based ad blocking apps as they do not follow allowed uses of the VPN apis as per App Store guidelines. VPN-based data collection apps could just as easily be cleaned up if there was the will to do so.
jamiequint 8y ago
"Malware: software that is intended to damage or disable computers and computer systems." It's hardly malware. Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not.
- happybuy 8y ago
  Perhaps spyware is the more accurate term. Even if it is clear in the app description that it is collecting data from users, I don't believe that the extent or consequences of such data collection would be considered or understood by the majority of its users. It's a spyware product, wrapped up as a VPN, relying upon lack of attention from users to succeed.
- lawnchair_larry 8y ago
  The first problem with this claim is that no users exercised any right to trade access to their data for free compression. This was a trojan horse. That's malware.
- ernesth 8y ago
  Where is this definition coming from? Merriam-Webster says "software designed to interfere with a computer's normal functioning". Wiktionary: "Software which has been designed to operate in a malicious, undesirable manner". Etymologically, it means software that is malevolent. This app collects data in a malevolent/undesirable way. It clearly tries to interfere with the personal data of the user and hence the intended functioning of the computer. Hence a malware.
- AlexandrB 8y ago
  > Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not. This is utter nonsense. How many users are making an informed decision here? How many understand what their data may be used for or how it may affect their insurance, employment, or housing prospects in the future? There's a reason some contracts are not legal/enforceable (slavery for example).
lazzlazzlazz 8y ago
I understand people say things like this because they're the edgy, hot take - but the Onavo VPN software is absolutely not malware. It's a performant, free VPN that people use in exchange for some anonymized data. There have been no known leaks or breaches.
- deleted 8y ago
  [deleted]
- binomialxenon 8y ago
  It's obviously in exchange for data, but I'm skeptical of how anonymised it is, given that FB has made a business of tracking everyone on the web as much as possible.
- pvg 8y ago
  The data is not anonymized, they say they may share anonymized data with partners. Malware is too strong but if you read the product description and FAQ, it's deliberately deceptive. Lieware? Slimeware?
  - SmellyGeekBoy 8y ago
    "Spyware" is perfectly sufficient.
- mirimir 8y ago
  From Apple's App Store Review Guidelines:[0] > 2.5.14 Apps must request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity. This includes any use of the device camera, microphone, or other user inputs. So did Onavo "provide a clear visual indication" whenever collecting data? Somehow I doubt that, because it would have been a constant warning. 0) https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/
  - eric_h 8y ago
    There is a constantly visible indicator that you're using a vpn on everything but the iPhone X. It's a stretch admittedly, but there's an argument to be made.
matz1 8y ago
I used this app before, how is this a malware ?
- bhouston 8y ago
  It sends anonymized data of every website on the internet, when you access it, and it also monitors the apps you use (probably because it intercepts their web traffic.) So basically Facebook knows what you do.
  - matz1 8y ago
    Yes its writen in the app description. Its free in return for data collection. How is this damaging my device?
    - darpa_escapee 8y ago
      If I've mistaken your question for pedantry, please forgive me. You can narrowly define malware by a quick dictionary definition[1]: > software that is intended to damage or disable computers and computer systems. However, malware also has a much looser definition[2] if we don't restrict ourselves to a one sentence Google result: > Programs officially supplied by companies can be considered malware if they secretly act against the interests of the computer user. For example, Sony sold the Sony rootkit, which contained a Trojan horse embedded into CDs that silently installed and concealed itself on purchasers' computers with the intention of preventing illicit copying. It also reported on users' listening habits, and unintentionally created vulnerabilities that were then exploited by unrelated malware. [1] https://www.google.com/search?q=define%3Amalware https://www.google.com/search?q=define%3Amalware [2] https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware
    - AlexandrB 8y ago
      It's shocking how far the overton window on privacy has shifted in just 10 years. Bonzi Buddy and it's ilk were generally considered malware and frequently chided on the internet at the time. Now people defend almost the same practices (in a nicer package) on Hacker News. We are truly fucked.
lacker 8y ago
FYI, it was a smaller company doing this in the first place. Facebook didn't change what the app was fundamentally doing after they acquired the company.
- insaneirish 8y ago
  And why do you think they acquired them?
  - lacker 8y ago
    For the data. It was like their own private App Annie, only available to themselves, with different strengths and weaknesses compared to App Annie data. And pretty much the same individual privacy implications as App Annie.

deleted 8y ago

[deleted]

meritt 8y ago

Eh, I dunno. My Data Manager [1] (owned by Mobidia / App Annie) is still going strong. It along with other VPN-based apps are a major source of user-level app usage and engagement data being sold to large corporations and investors. In-app analytics libraries are another source (which are heavily fragmented since they only can track apps they're packaged with) but it's going to be a lot more difficult for Apple to regulate those. Until Apple starts banning all of these types of apps and libraries (which their recently updated policies indicate they just might [2]), I view this as more of a strategic play against Facebook as opposed to in the best interest of users. [1] https://itunes.apple.com/us/app/my-data-manager-track-your/id477865384?mt=8 https://itunes.apple.com/us/app/my-data-manager-track-your/i... [2] http://www.integrity-research.com/new-apple-policies-threaten-alternative-data/ http://www.integrity-research.com/new-apple-policies-threate...

happybuy 8y ago
Apple quickly and efficiently banned all VPN-based ad blocking apps as they do not follow allowed uses of the VPN apis as per App Store guidelines. VPN-based data collection apps could just as easily be cleaned up if there was the will to do so.

jamiequint 8y ago

"Malware: software that is intended to damage or disable computers and computer systems." It's hardly malware. Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not.

happybuy 8y ago
Perhaps spyware is the more accurate term. Even if it is clear in the app description that it is collecting data from users, I don't believe that the extent or consequences of such data collection would be considered or understood by the majority of its users. It's a spyware product, wrapped up as a VPN, relying upon lack of attention from users to succeed.
lawnchair_larry 8y ago
The first problem with this claim is that no users exercised any right to trade access to their data for free compression. This was a trojan horse. That's malware.
ernesth 8y ago
Where is this definition coming from? Merriam-Webster says "software designed to interfere with a computer's normal functioning". Wiktionary: "Software which has been designed to operate in a malicious, undesirable manner". Etymologically, it means software that is malevolent. This app collects data in a malevolent/undesirable way. It clearly tries to interfere with the personal data of the user and hence the intended functioning of the computer. Hence a malware.
AlexandrB 8y ago
> Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not. This is utter nonsense. How many users are making an informed decision here? How many understand what their data may be used for or how it may affect their insurance, employment, or housing prospects in the future? There's a reason some contracts are not legal/enforceable (slavery for example).

lazzlazzlazz 8y ago

I understand people say things like this because they're the edgy, hot take - but the Onavo VPN software is absolutely not malware. It's a performant, free VPN that people use in exchange for some anonymized data. There have been no known leaks or breaches.

deleted 8y ago
[deleted]
binomialxenon 8y ago
It's obviously in exchange for data, but I'm skeptical of how anonymised it is, given that FB has made a business of tracking everyone on the web as much as possible.
pvg 8y ago
The data is not anonymized, they say they may share anonymized data with partners. Malware is too strong but if you read the product description and FAQ, it's deliberately deceptive. Lieware? Slimeware?
- SmellyGeekBoy 8y ago
  "Spyware" is perfectly sufficient.
mirimir 8y ago
From Apple's App Store Review Guidelines:[0] > 2.5.14 Apps must request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity. This includes any use of the device camera, microphone, or other user inputs. So did Onavo "provide a clear visual indication" whenever collecting data? Somehow I doubt that, because it would have been a constant warning. 0) https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/
- eric_h 8y ago
  There is a constantly visible indicator that you're using a vpn on everything but the iPhone X. It's a stretch admittedly, but there's an argument to be made.

matz1 8y ago

I used this app before, how is this a malware ?

bhouston 8y ago
It sends anonymized data of every website on the internet, when you access it, and it also monitors the apps you use (probably because it intercepts their web traffic.) So basically Facebook knows what you do.
- matz1 8y ago
  Yes its writen in the app description. Its free in return for data collection. How is this damaging my device?
  - darpa_escapee 8y ago
    If I've mistaken your question for pedantry, please forgive me. You can narrowly define malware by a quick dictionary definition[1]: > software that is intended to damage or disable computers and computer systems. However, malware also has a much looser definition[2] if we don't restrict ourselves to a one sentence Google result: > Programs officially supplied by companies can be considered malware if they secretly act against the interests of the computer user. For example, Sony sold the Sony rootkit, which contained a Trojan horse embedded into CDs that silently installed and concealed itself on purchasers' computers with the intention of preventing illicit copying. It also reported on users' listening habits, and unintentionally created vulnerabilities that were then exploited by unrelated malware. [1] https://www.google.com/search?q=define%3Amalware https://www.google.com/search?q=define%3Amalware [2] https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware
  - AlexandrB 8y ago
    It's shocking how far the overton window on privacy has shifted in just 10 years. Bonzi Buddy and it's ilk were generally considered malware and frequently chided on the internet at the time. Now people defend almost the same practices (in a nicer package) on Hacker News. We are truly fucked.

lacker 8y ago

FYI, it was a smaller company doing this in the first place. Facebook didn't change what the app was fundamentally doing after they acquired the company.

insaneirish 8y ago
And why do you think they acquired them?
- lacker 8y ago
  For the data. It was like their own private App Annie, only available to themselves, with different strengths and weaknesses compared to App Annie data. And pretty much the same individual privacy implications as App Annie.