4 ms·
> Facebook sidesteps the App Store and rewards teenagers and adults to download the Research app and give it root access But how? I didn't knew this is possibl
by qwerty456127 8y ago
> Facebook sidesteps the App Store and rewards teenagers and adults to download the Research app and give it root access
But how? I didn't knew this is possible to do on iPhones except really old models. If it is I'd love to know how.
- saagarjha 8y agoThe article is misleading; the app does not have root access, it has access to web traffic via a trusted root certificate. The app is distributed outside the App Store through the enterprise developer program.
- eunoia 8y agoIt's worth noting that one of the main rules of these Enterprise accounts is that they are not to be used to bypass the App Store. For example, we use them to distribute frictionless test builds internally.
- saagarjha 8y agoYes, I know what the enterprise program is for; this is a clear violation of those rules. But Facebook is not getting root access to your device, as the title of this post and the article claims.
- eunoia 8y agoYeah I can tell you have experience with iOS code signing. I just wanted it to be clear to others that this is NOT the intended purpose of the Enterprise program.
- blattimwind 8y agoI'm looking forward to Apple revoking Facebook's access to it.
- morpheuskafka 8y agoIt appears to be their main In-House Enterprise cert, so it may well cause some major chaos as all internal apps go dead.
- kerbs 8y agoTo get a good idea of what they are doing, visit whatsmyudid.com and follow the instructions to use SuperUDID (you don’t need to go through with it, just read the steps). Similar to SuperUDID, they installed a profile onto their device that provided special privileges for Facebook.
- morpheuskafka 8y agoThis is actually not quite true. They only installed a signing profile, which still requires a prompt to install each app and wasn't used to do anything but install the research app. The "keys to the kingdom" is the trusted root certificate, which coupled with the VPN, made them your ISP and gave them complete access to all traffic in all apps.
- kerbs 8y agoI was showing how they would go about getting the trusted root certificate on the phone, which can be packaged with MDM profiles installed similar to the method used above.