Damn, I tried DM'ing some security researchers about this a week ago, looks like I should have just sent it here. I've got some added details from my research i

Damn, I tried DM'ing some security researchers about this a week ago, looks like I should have just sent it here. I've got some added details from my research into it. 1) Regarding distribution channels, I have only once had the program advertised, via an Instagram ad. I have my real age on Insta (I know, I know...) so targeting younger users may have played a role. I first saw the ad in June 2018, and decided to click through to see how bad it was from a security standpoint. IIRC I never installed it, but I got an email to my throwaway account a few weeks ago asking to reinstall, so I decided to give it a run-through for research. They refer to is as "Research Application," and avoid mentioning FB, their email the first time was facebookresearch@applause.com and it is now sent through a mailer with no mention of FB in email address. The contractor was Applause/uTest, they offered $10/month via PayPal (which <18 technically aren't allowed to have). Since uninstalling, they sent an email saying it hadn't heard from the app in 24-hours and you must participate 23/days month to be paid. 2) The install link is at https://m.facebook.com/facebook-study/f8854f1fb9f4f57bf0d861c03528ce4c/<unique_code> https://m.facebook.com/facebook-study/f8854f1fb9f4f57bf0d861..., and the IP used by the VPN is vpn-sjc1.v.facebook-program.com / 185.89.216.194. On iOS, the "Connect on Demand" feature is used to render the normal VPN off switch useless, one must uninstall the app or turn off COD on the VPN info page. Outgoing traffic goes through a regular FB IP (I wonder if any IP-based authentication on their systems might be weakened by doing this?). 3) I definitely agree with TechCrunch that this is an Apple ToS issue, however, they are wrong to say that FB "avoided TestFlight." TestFlight is for closed betas only, and this app is not a beta of anything, so it is patently ineligible. Interestingly, if Apple revokes their cert in response (as they due to shell company certs used for sideloading marketplaces), it would result in an immediate shutdown of all Facebook's legit internal apps, because Apple only (afaik) issues one cert to each DUNS number. Notably, the cert says "Facebook, Inc. (In-House)" not just "Facebook Research, Inc." so it looks like the main cert. I've sent a complaint to Apple Privacy about this, will report back if they reply. 3b) Apple's Enterprise Dev Program ToS[1] excludes from allowed internal apps those that are, "used, distributed, or otherwise made available to other companies, contractors (except for contractors who are developing the Internal Use Application for You on a custom basis and therefore need to use or have access to such Application), distributors, vendors, resellers, end-users or members of the general public." It does allow the use of written, binding agreements to enable contractors to use the app, but it seems doubtful that this would extend to those ostensibly participating in social research for a nominal compensation. 4) Most users need to be clearly told that installing a "trusted root" cert is the keys to the kingdom. Providing a normal VPN honestly wouldn't be that bad, as TLS protects everything but the domain name. So they could see "morpheuskafka made 200 requests to reddit.com in an hour," but not the content, much less my login and password. Most people who know what a VPN is are familiar with the idea of their network traffic being rerouted and monitored at the ISP level, but they could easily think they were installing the VPNs server certificate or a client certificate to access it. It's staggering to think that . Also remember that Facebook owns the certs for its own platforms, so they could (ethically) monitor your use of their own services w/out this. Remember "don't even give the IT people your password?" Fill out any login in form and FB has your password (and can use the same IP to sign in without raising suspicion). Job or college app? SSN, tax info, etc. Only e2e is safe. Notable, Caddy's MITM detector cannot detect this "research app." I hope they do revoke the signing cert, and will enjoy seeing all their internal apps stop working in the chaos. And I hope that Google and other large companies send password change warning to anyone who has logged in from these IPs. [1] https://download.developer.apple.com/Documentation/License_Agreements__Apple_Developer_Enterprise_Program/Apple_Developer_Enterprise_Program_License_Agreement_20181019.pdf https://download.developer.apple.com/Documentation/License_A... [can sign in with any Apple ID to view] Sorry for the long post, but this is truly outrageous.