4 ms·

It seems surprising to me that no one has questioned the claims here. Popular apps do cert pinning and there are multiple hoops you have to jump through to inst

It seems surprising to me that no one has questioned the claims here. Popular apps do cert pinning and there are multiple hoops you have to jump through to install a root cert, so are the claims even valid?

gruez 3y ago
According to the quote they want "reliable analytics", whatever that means. If this means time of use/frequency of use data, all of that can be derived without needing the encryption keys. Just being able to observe network traffic would be enough. If you do additional traffic analysis, you can probably infer what the user is doing as well (eg. sending snaps vs scrolling)
dannyw 3y ago
Popular apps do cert pinning today. Back in 2016 (when the claims date back to), maybe Snapchat didn't. You can read the full complaint here. It is full of juicy details, including Mark Zuckerberg directly suggesting 'figuring out a way' to access Snapchat's encrypted traffic, and how Meta installed a root certificate onto user devices to snoop. https://storage.courtlistener.com/recap/gov.uscourts.cand.369872/gov.uscourts.cand.369872.735.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.36... Direct quote from Meta employee based on the complaint: "we install a root CA on the device and MITM all SSL traffic"
- gruez 3y ago
  >This code, which included a client-side “kit” that installed a “root” certificate on Snapchat users’ (and later, YouTube and Amazon users’) mobile devices I'm surprised it took 7 years and a lawsuit for this to be confirmed. I remember there were reports of "facebook-affiliated VPN app that might be spying on users" a few years ago, but I don't think the fact that they were MITMing user traffic was confirmed. Sure enough, I went back and skimmed the news stories[1] from back then and there were no mentions of root certificates or MITM. Given how many scary prompts you have to go through to install a root certificate, I'm surprised nobody got suspicious and posted screenshots to the public. [1] https://gizmodo.com/do-not-i-repeat-do-not-download-onavo-facebook-s-vam-1822937825 https://gizmodo.com/do-not-i-repeat-do-not-download-onavo-fa..., https://www.extremetech.com/internet/263867-facebooks-new-onavo-protect-vpn-spyware-application https://www.extremetech.com/internet/263867-facebooks-new-on..., https://techcrunch.com/2018/02/12/facebook-starts-pushing-its-data-tracking-onavo-vpn-within-its-main-mobile-app/ https://techcrunch.com/2018/02/12/facebook-starts-pushing-it...

gruez 3y ago

According to the quote they want "reliable analytics", whatever that means. If this means time of use/frequency of use data, all of that can be derived without needing the encryption keys. Just being able to observe network traffic would be enough. If you do additional traffic analysis, you can probably infer what the user is doing as well (eg. sending snaps vs scrolling)

dannyw 3y ago

Popular apps do cert pinning today. Back in 2016 (when the claims date back to), maybe Snapchat didn't. You can read the full complaint here. It is full of juicy details, including Mark Zuckerberg directly suggesting 'figuring out a way' to access Snapchat's encrypted traffic, and how Meta installed a root certificate onto user devices to snoop. https://storage.courtlistener.com/recap/gov.uscourts.cand.369872/gov.uscourts.cand.369872.735.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.36... Direct quote from Meta employee based on the complaint: "we install a root CA on the device and MITM all SSL traffic"

gruez 3y ago
>This code, which included a client-side “kit” that installed a “root” certificate on Snapchat users’ (and later, YouTube and Amazon users’) mobile devices I'm surprised it took 7 years and a lawsuit for this to be confirmed. I remember there were reports of "facebook-affiliated VPN app that might be spying on users" a few years ago, but I don't think the fact that they were MITMing user traffic was confirmed. Sure enough, I went back and skimmed the news stories[1] from back then and there were no mentions of root certificates or MITM. Given how many scary prompts you have to go through to install a root certificate, I'm surprised nobody got suspicious and posted screenshots to the public. [1] https://gizmodo.com/do-not-i-repeat-do-not-download-onavo-facebook-s-vam-1822937825 https://gizmodo.com/do-not-i-repeat-do-not-download-onavo-fa..., https://www.extremetech.com/internet/263867-facebooks-new-onavo-protect-vpn-spyware-application https://www.extremetech.com/internet/263867-facebooks-new-on..., https://techcrunch.com/2018/02/12/facebook-starts-pushing-its-data-tracking-onavo-vpn-within-its-main-mobile-app/ https://techcrunch.com/2018/02/12/facebook-starts-pushing-it...