7 ms·
Facebook snooped on users' Snapchat traffic in secret project, documents reveal
- habibappp 3y ago[flagged]
- habibappp 3y ago[flagged]
- habibappp 3y ago[flagged]
- nycdatasci 3y ago"Research Cannot Be the Justification for Compromising People’s Privacy" https://about.fb.com/news/2021/08/research-cannot-be-the-justification-for-compromising-peoples-privacy/ https://about.fb.com/news/2021/08/research-cannot-be-the-jus... "The researchers [at NYU's Ad Observatory] gathered data by creating a browser extension that was programmed to evade our detection systems and scrape data such as usernames, ads, links to user profiles and “Why am I seeing this ad?” information, some of which is not publicly-viewable on Facebook. The extension also collected data about Facebook users who did not install it or consent to the collection. The researchers had previously archived this information in a now offline, publicly-available database. "
- pixxel 3y ago58 comments. Actual hacker news.
- digidigo 3y agoSurely all the traffic was HTTPS? Can someone explain how they technically would have been able to do this? Doesn’t VPN happen after HTTPS in the network stack?
- DuskHorizon 3y agoThe immorality of Facebook has no limits. Censorship? Check. Espionage? Check. Profiling? Check. Propaganda? Double check. Dictators of the world are envy of Mark ;)
- adrr 3y agoI don't understand how FB can decrypt other apps network traffic. TLS will fail if they tried a man in the middle attack even if they had VPN software installed on the device.
- yusaydat 3y agoThey asked users of the VPN service to install a certificate, that's how they did it.
- stbenjam 3y agoThe TC article leaves that a little unclear: were they actually looking at the plaintext or just gathering metrics about snapchat usage? The latter wouldn't require decrypting the session. If Onavo did install a certificate and MITM the connections and send private user data to Meta... that's beyond the pale. That's far more worthy of a cover story than Bloomberg's debunked secretive tiny chips story from a few years ago. It's equally as bad if not worse. Hopefully the technical details will come out.
- rpdillon 3y agoThis is the first sentence of the article: > In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers. I read the rest of the article as well, and saw only confirmation: > Given that Snapchat encrypted the traffic between the app and its servers, this network analysis technique was not going to be effective. This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet. Where do you see the ambiguity? Other than the weasel words about proposing these programs (versus actually running them), it seems clear that they were decrypting the traffic (or reading it before it was encrypted). Did I miss a piece?
- stbenjam 3y ago> This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet. This doesn't make sense, they wouldn't see the traffic before it was encrypted. They would see it encrypted, but using the MITM certificate instead of Snapchat's. Given the inaccuracies in the article, it makes me wonder what else they got wrong. Using a VPN client to monitor how much, when, and where traffic is going is bad, but MITM'ing a user's connection is much, much worse. I'm really skeptical that's what happened, especially given TC's inability to articulate accurately what Facebook did.
- cedws 3y agoThis alone should be cause for investigation. What the fuck? Is Zuckerberg a US intelligence asset or something?
- red-iron-pine 3y agohe is not an asset. he is absolutely a Fed Gov vendor and will happily sell data to people willing to pay. and the USG can pay, bigly.
- uslic001 3y agoYes.
- ijijijjij 3y ago> Is Zuckerberg a US intelligence asset or something? We know that is true since the Snowden leak. More than 10 years ago already... It's probably why they want to ban TikTok... because they can't get the same data pipe from them.
- bottom999mottob 3y agoReminds me of the Chinese hacking company leak a few weeks ago. Hack-a-Nation-State-as-a-Service and Hack-a-Service-as-a-Nation-State. The most predictable and boring dystopia. Like was anyone surprised Facebook was doing this?
- red-iron-pine 3y agoI mean I assumed they were doing something along those lines by default -- they're a data mining company. Actually impressed they didn't already have hooks in, doing it automatically.
- skybrian 3y agoThe secret was revealed in 2017 [1]. I guess there are new documents, though? Facebook knew about Snap's struggles months before the public (Engadget) > To be clear, Facebook isn't grabbing this data behind anyone's back. The company says Onavo Protect is explicit about what info it's collecting and how it's used, and that apps have incorporated market research services like this "for years." The odds are slim that many people read these disclosures before using Protect, but anyone who was concerned could have found them. The revelation here is more about how Facebook uses that information rather than the collection itself. [1] https://www.engadget.com/2017-08-13-facebook-knew-about-snap-struggles-through-app-tracking.html https://www.engadget.com/2017-08-13-facebook-knew-about-snap...
- dvngnt_ 3y agoI think the solution is to force tiktok to sell to an American company we can trust
- deleted 3y ago[deleted]
- cozzyd 3y agoIt's hilarious because it would probably be better for US citizens for TikTok to be sold to an EU company.
- fransje26 3y agoNow, now. We don't want the Europoor to be spying on our citizens, do we? Imagine the impact on our privacy.
- hifromwork 3y agoTo the downvoters: I believe this is sarcasm.
- fransje26 3y agoYes, very much so. I apologize for it, as it is, I believe, indirectly against the HN guidelines. Even more so because sarcasm as a form of humour is not necessarily understood as such in every culture, which can lead to misunderstandings.. (From experience, it doesn't go down well in Germany, for instance....)
- gloryjulio 3y agoyou can use /s to mark it as sarcasm
- motoxpro 3y agoIronic because people still say “TikTok isn’t doing anything nasty behind the scenes!”
- oneepic 3y agoHonest question, as I want to learn something. Zuck's quotes were: > “Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them” > “Given how quickly they’re growing, it seems important to figure out a new way to get reliable analytics about them. Perhaps we need to do panels or write custom software. You should figure out how to do this.” I'm against what FB did, and it is still Zuck's responsibility, but let's take a fake company as an example. Say I'm your manager, and I ask you to start learning more about what our competition is doing. If you used publicly available info (like news articles or other media, even their engineering blog), OK great -- but if you decided to snoop their traffic, which only went between that competitor's servers and their users, I wouldn't be OK with that. Perhaps you did something unethical, but also I'd be responsible bc I hired you. How do you prevent this sort of thing, especially at a huge company? Especially a huge tech company, where I believe lots of tech workers tend to specialize in tech and often lack soft skills/ability to think about the bigger non-technical picture. For example, "oh shit, we can't actually read this data w/o the customer's consent."
- Ctyra 3y agoYou answered your own question. If you are a manager, and you asked someone to get this information. You have enough oversight to know if the information was obtained through ethical means or not. At FB scale, if Zuck wanted this information, he has enough staff to flag unethical snooping of users. They did it because they wanted to do it even if it's not ethical, not because they didn't realize it's unethical.
- geoduck14 3y agoIf you are the direct manager, you should ask plenty of questions. If you are the IC, be prepared to answer plenty of questions. If you are a skip-manager, you need to build a culture where being ethically responsible is the right thing to do. This isn't easy to do because you quickly run out of time to talk to all of your employees and figure out what everyone is doing.
- rchaud 3y ago> How do you prevent this sort of thing, especially at a huge company? You don't have to when you're a huge American company. No one is risking prison time, and the fines are a drop in the bucket considering FB's profitability.
- htrp 3y agowell that explains why onavo existed since their business model made no sense
- danielscrubs 3y agoIf you were a Californian engineer, wouldn’t you speak up? Anyone with insights about what consequences they are afraid of?
- Intralexical 3y agoYou're assuming the engineers that do this care on a fundamental level, but that there must exist other factors which coerce them into doing it anyway. That's a comforting thought. It rationalizes the harmful behaviour. But it's also arrogant in a way, because you're projecting your own moral values and assuming that other individuals must share those too. The simpler explanation, but also one that's much more difficult to understand, is that some number of humans simply don't care about, and may not even be capable of understanding and internalizing in any real way, the consequences that their actions have for other people. And sometimes, a system built around apathy as a value weeds out all the ones that do care, or are even able to care. The question in those cases isn't "Why not speak up? What are you afraid of?"; it's "Why say anything? How does that profit me personally?". I believe Zuckerberg when he says he doesn't know why [1] people trust him. I think it, and most of the harm that Facebook does, comes from a genuine place of not understanding. Amoral actions don't require the presence of some willful evil, nor of some coercive force; they just require the absence of sufficient empathy and self-awareness. --- 1: https://www.businessinsider.com/embarrassing-and-damaging-zuckerberg-ims-confirmed-by-zuckerberg-the-new-yorker-2010-9 https://www.businessinsider.com/embarrassing-and-damaging-zu...
- red-iron-pine 3y ago> You're assuming the engineers that do this care on a fundamental level, but that there must exist other factors which coerce them into doing it anyway. FAANG salaries. prestige of FAANG work. work devolved into L1 and L2 requirements that can, with a bit of effort, obfuscate what a feature does. "hey Jim, did you knock out those 8 L2s? we gotta ship end of the month" -- and it just becomes another feature add.
- itopaloglu83 3y ago> If you were a Californian engineer, wouldn’t you speak up? Let’s ask the latest whistleblower we know about. Wait, he’s no longer alive with a controversial suicide.
- x3sphere 3y agoThe irony is Meta have a draconian stance against site scrapers, and have been known to sue over it. Yet they go and do this. Which is much worse than just scraping public pages.
- nycdatasci 3y agoExactly. Here's a great example of them criticizing NYU for researching political influence & advertising on the Meta platform: "Research Cannot Be the Justification for Compromising People’s Privacy" https://about.fb.com/news/2021/08/research-cannot-be-the-justification-for-compromising-peoples-privacy/ https://about.fb.com/news/2021/08/research-cannot-be-the-jus...
- immibis 3y agoThat's why Cory calls it "adversarial interoperability". All's fair in love and war, and all that. They play dirty, so should we.
- bradley13 3y agoSomeone on Slashdot asked the key question: If an individual did this, they would be prosecuted for hacking under one law or another. Why is Facebook not facing criminal charges?
- Figs 3y agoWhat they did is a form of wiretapping. Everyone involved in this project should be fined and go to jail. California Penal Code § 632 seems applicable: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=632 https://leginfo.legislature.ca.gov/faces/codes_displaySectio... Other laws may also be applicable depending on where the victims were.
- 99112000 3y agoDid they get consent?
- 3seashells 3y ago[dead]
- Figs 3y agoClearly, they did not. California is an all party consent state. There is no reason to build a VPN snooping system if you have consent of all parties; Snap Inc could've just straight up given them usage information and/or direct access to monitor behavioral data and read conversations in the app if everyone consented. That would have been much cheaper and simpler if everyone consents. The entire point of building this system is that Snap Inc, at a minimum, did NOT consent. Additionally, I find it very likely that the other participants in conversations on the platform who were monitored did not consent either. The user who installed the app may have consented, but that is not good enough in California. ALL parties must consent.
- 0xBDB 3y agoCalifornia is the one state where this argument might have a chance, because both Meta and Snapchat are there and maybe some of the users Meta talked into this are too. However I wouldn't put the chance anywhere near 100%: https://www.kelleydrye.com/viewpoints/blogs/commlaw-monitor/court-rules-for-isp-in-deep-packet-inspection-lawsuit https://www.kelleydrye.com/viewpoints/blogs/commlaw-monitor/... Also another article I read says the CIPA has a civil statute $5,000 per violation, so if you're Meta, who cares. Not exactly the federal Computer Fraud and Abuse Act.