3 ms·

>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a p

>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.

lrvick 4y ago
Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people. Personal user browsing or communications leaking in plain text to private companies without explicit and obvious user consent puts users at risk, and is a vulnerability. It just so happens to be one arising from malicious profit seeking behavior that happens to be the status quo. Not having https was once the status quo, and a boon for corporate spying, but we call that a vulnerability now because the abuses became too big too ignore.
- 202206241203 4y ago
  Yes, but people love that, otherwise e.g. freemium and ad-driven games would not exist. Consumers have a payment-avoiding behaviour as a status quo.
  - lrvick 4y ago
    This comes across as victim blaming. Users are given the choice to accept risks that are buried on page 7 of privacy policies only a lawyer could understand the tricks in. Services knowingly endangering unknowing users for money should be like cigarettes and be forced to say on the signup page in big bold text they can and will sell user data to anyone, including law enforcement. Users largely think free services are like public libraries and do not default to expecting they are being exploited for money. Element, Wikipedia, and duckduckgo exist for free without selling user data so it is not a given that exploitation is always present in free services.
  - noduerme 4y ago
    This isn't a consumer choice issue. People love morphine too, it doesn't mean Amazon can sell it to them. If Apple enforced its own rules in this case, Facebook would just have to act like any other developer and find some revenue streams that comply with established privacy norms.
- wmeredith 4y ago
  > this is the same company that just gave police DMs that aided in an abortion investigation They were served a warrant. I'm no friend of Facebook/Meta, but any company served a warrant is going to turn over what they have.
  - woodruffw 4y ago
    I don't think the GP is saying that Meta should have ignored a lawful order. I think they're saying that they shouldn't have put themselves in the position of being able to render that information, and only have done so because it's profitable for them to do so.
    - wonderbore 4y ago
      It’s really painful to see all of these encryption holes in every product we use daily. Apple claims privacy, yet your whole phone sits unencrypted on their server ready to be served to anyone who asks (assuming you back up your phone to iCloud)
      - woodruffw 4y ago
        My understanding is that iCloud backups are encrypted[1]. [1]: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
        wonderbore 4y ago
        Encrypted but they have the keys so they can serve it to anyone who asks. That’s why “end-to-end” is subsequently mentioned as an “additional” step for certain data. It should all be end-to-end like iCloud Keychain is, at least on demand.
      - lrvick 4y ago
        End to end encryption is only useful when the software on each end is open source and deterministically built/distributed by third parties with accountability. Even Signal or Google/Apple could ship a bad Signal app update to targeted devices to dump convos if ordered. If you use Matrix with a client from an F-Droid build or a reproducible build from debian etc, then the Matrix developers literally could not comply with orders to obtain your plaintext content.
- zip1234 4y ago
  Well, one can go ahead and enable End-to-End encryption in Facebook Messenger now: https://www.facebook.com/help/messenger-app/786613221989782 https://www.facebook.com/help/messenger-app/786613221989782
vade 4y ago
It is a vulnerability. You the user are just vulnerable to them...
deleted 4y ago
[deleted]
sleepyhead 4y ago
It should be reported as a vulnerability. To Apple. Yes they made a decision for this as well but a decision can still be reported as a vulnerability.
deleted 4y ago
[deleted]
samstave 4y ago
>just because you don't like it, doesn't mean it's a vulnerability. Technical Vuln or Business Vuln?

lrvick 4y ago

Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people. Personal user browsing or communications leaking in plain text to private companies without explicit and obvious user consent puts users at risk, and is a vulnerability. It just so happens to be one arising from malicious profit seeking behavior that happens to be the status quo. Not having https was once the status quo, and a boon for corporate spying, but we call that a vulnerability now because the abuses became too big too ignore.

202206241203 4y ago
Yes, but people love that, otherwise e.g. freemium and ad-driven games would not exist. Consumers have a payment-avoiding behaviour as a status quo.
- lrvick 4y ago
  This comes across as victim blaming. Users are given the choice to accept risks that are buried on page 7 of privacy policies only a lawyer could understand the tricks in. Services knowingly endangering unknowing users for money should be like cigarettes and be forced to say on the signup page in big bold text they can and will sell user data to anyone, including law enforcement. Users largely think free services are like public libraries and do not default to expecting they are being exploited for money. Element, Wikipedia, and duckduckgo exist for free without selling user data so it is not a given that exploitation is always present in free services.
- noduerme 4y ago
  This isn't a consumer choice issue. People love morphine too, it doesn't mean Amazon can sell it to them. If Apple enforced its own rules in this case, Facebook would just have to act like any other developer and find some revenue streams that comply with established privacy norms.
wmeredith 4y ago
> this is the same company that just gave police DMs that aided in an abortion investigation They were served a warrant. I'm no friend of Facebook/Meta, but any company served a warrant is going to turn over what they have.
- woodruffw 4y ago
  I don't think the GP is saying that Meta should have ignored a lawful order. I think they're saying that they shouldn't have put themselves in the position of being able to render that information, and only have done so because it's profitable for them to do so.
  - wonderbore 4y ago
    It’s really painful to see all of these encryption holes in every product we use daily. Apple claims privacy, yet your whole phone sits unencrypted on their server ready to be served to anyone who asks (assuming you back up your phone to iCloud)
    - woodruffw 4y ago
      My understanding is that iCloud backups are encrypted[1]. [1]: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
      - wonderbore 4y ago
        Encrypted but they have the keys so they can serve it to anyone who asks. That’s why “end-to-end” is subsequently mentioned as an “additional” step for certain data. It should all be end-to-end like iCloud Keychain is, at least on demand.
    - lrvick 4y ago
      End to end encryption is only useful when the software on each end is open source and deterministically built/distributed by third parties with accountability. Even Signal or Google/Apple could ship a bad Signal app update to targeted devices to dump convos if ordered. If you use Matrix with a client from an F-Droid build or a reproducible build from debian etc, then the Matrix developers literally could not comply with orders to obtain your plaintext content.
zip1234 4y ago
Well, one can go ahead and enable End-to-End encryption in Facebook Messenger now: https://www.facebook.com/help/messenger-app/786613221989782 https://www.facebook.com/help/messenger-app/786613221989782

vade 4y ago

It is a vulnerability. You the user are just vulnerable to them...

deleted 4y ago

[deleted]

sleepyhead 4y ago

It should be reported as a vulnerability. To Apple. Yes they made a decision for this as well but a decision can still be reported as a vulnerability.

deleted 4y ago

[deleted]

samstave 4y ago

>just because you don't like it, doesn't mean it's a vulnerability. Technical Vuln or Business Vuln?