5 ms·

One issue with this is brought up in the article: > “The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This

One issue with this is brought up in the article: > “The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”

gruez 8y ago
right, but considering most web traffic is encrypted nowadays, it's pretty much mandatory to do MITM to analyze traffic.
- _jal 8y ago
  Perhaps that should be taken as a hint rather than a challenge.
- morpheuskafka 8y ago
  But you can still get the domain/subdomain requested, which should be enough to find out service used and time/frequency of use. That will change with encrypted SNI (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), which is not yet mainstream, but large services Facebook is tracking have dedicated IP pools so that's not a barrier. So for the reported use case, "hey, tiktok looks good, let's find out how many people use it before we buy it out," it would seem that non-MITM would be plenty (and technically easier/lower resource to do, VPN could be kept on device and the pre-anonymized data sent up to the cloud, saving them server costs and bandwidth.
travisoneill1 8y ago
Why would people be unable to consent? "You give us full access to everything on your phone for money" is a way to articulate this to anybody.
- gaius 8y ago
  Because it’s not transitive. If I send you a personal message, I didn’t consent to you giving that to Facebook who will use my phone number to add it to the shadow profile they keep on me. Facebook might as well pay in pieces of silver.
fipple 8y ago
I can easily imagine being poor enough to engage into this contract, despite knowing exactly what power this gives Facebook. Don't confuse desperation for ignorance.
- morpheuskafka 8y ago
  How would someone have an iPhone, cell service, and a PayPal if they don't have $20 a month?
dx034 8y ago
Could they've achieved this another way? Still getting all the metadata for market research without a root certificate? If not, the step wasn't that appalling. Compensating people for information on their behaviour is nothing new. If you participate in a program to report daily purchases you probably give away as many information and yet it's not viewed as controversial. The fact that Facebook doesn't have a great track record is problematic but generally, I don't see a big issue.
rlue 8y ago
I agree that it's ethically dubious, and wasn't trying to defend the move by any means. However, I _would_ contend with the assertion that "there is no good way to articulate just how much power is handed to Facebook when you do this." Sure there is—just not one that would look good for Facebook.

gruez 8y ago

right, but considering most web traffic is encrypted nowadays, it's pretty much mandatory to do MITM to analyze traffic.

_jal 8y ago
Perhaps that should be taken as a hint rather than a challenge.
morpheuskafka 8y ago
But you can still get the domain/subdomain requested, which should be enough to find out service used and time/frequency of use. That will change with encrypted SNI (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), which is not yet mainstream, but large services Facebook is tracking have dedicated IP pools so that's not a barrier. So for the reported use case, "hey, tiktok looks good, let's find out how many people use it before we buy it out," it would seem that non-MITM would be plenty (and technically easier/lower resource to do, VPN could be kept on device and the pre-anonymized data sent up to the cloud, saving them server costs and bandwidth.

travisoneill1 8y ago

Why would people be unable to consent? "You give us full access to everything on your phone for money" is a way to articulate this to anybody.

gaius 8y ago
Because it’s not transitive. If I send you a personal message, I didn’t consent to you giving that to Facebook who will use my phone number to add it to the shadow profile they keep on me. Facebook might as well pay in pieces of silver.

fipple 8y ago

I can easily imagine being poor enough to engage into this contract, despite knowing exactly what power this gives Facebook. Don't confuse desperation for ignorance.

morpheuskafka 8y ago
How would someone have an iPhone, cell service, and a PayPal if they don't have $20 a month?

dx034 8y ago

Could they've achieved this another way? Still getting all the metadata for market research without a root certificate? If not, the step wasn't that appalling. Compensating people for information on their behaviour is nothing new. If you participate in a program to report daily purchases you probably give away as many information and yet it's not viewed as controversial. The fact that Facebook doesn't have a great track record is problematic but generally, I don't see a big issue.

rlue 8y ago

I agree that it's ethically dubious, and wasn't trying to defend the move by any means. However, I _would_ contend with the assertion that "there is no good way to articulate just how much power is handed to Facebook when you do this." Sure there is—just not one that would look good for Facebook.