3 ms·
Popular apps do cert pinning today. Back in 2016 (when the claims date back to), maybe Snapchat didn't. You can read the full complaint here. It is full of jui
by dannyw 3y ago
Popular apps do cert pinning today. Back in 2016 (when the claims date back to), maybe Snapchat didn't.
You can read the full complaint here. It is full of juicy details, including Mark Zuckerberg directly suggesting 'figuring out a way' to access Snapchat's encrypted traffic, and how Meta installed a root certificate onto user devices to snoop.
https://storage.courtlistener.com/recap/gov.uscourts.cand.369872/gov.uscourts.cand.369872.735.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.36...
Direct quote from Meta employee based on the complaint: "we install a root CA on the device and MITM all SSL traffic"
- gruez 3y ago>This code, which included a client-side “kit” that installed a “root” certificate on Snapchat users’ (and later, YouTube and Amazon users’) mobile devices I'm surprised it took 7 years and a lawsuit for this to be confirmed. I remember there were reports of "facebook-affiliated VPN app that might be spying on users" a few years ago, but I don't think the fact that they were MITMing user traffic was confirmed. Sure enough, I went back and skimmed the news stories[1] from back then and there were no mentions of root certificates or MITM. Given how many scary prompts you have to go through to install a root certificate, I'm surprised nobody got suspicious and posted screenshots to the public. [1] https://gizmodo.com/do-not-i-repeat-do-not-download-onavo-facebook-s-vam-1822937825 https://gizmodo.com/do-not-i-repeat-do-not-download-onavo-fa..., https://www.extremetech.com/internet/263867-facebooks-new-onavo-protect-vpn-spyware-application https://www.extremetech.com/internet/263867-facebooks-new-on..., https://techcrunch.com/2018/02/12/facebook-starts-pushing-its-data-tracking-onavo-vpn-within-its-main-mobile-app/ https://techcrunch.com/2018/02/12/facebook-starts-pushing-it...