4 ms·

The cluster of allegations is that the Onavo acquisition put FB-designed and built rootkits underneath TLS on a significant fraction of all smartphones in the U

The cluster of allegations is that the Onavo acquisition put FB-designed and built rootkits underneath TLS on a significant fraction of all smartphones in the United States and that FB/IG (now Meta) used clear text access to ostensibly secure HTTPS sessions to extract arbitrary data from both competitors and partner companies to play poker with X-Ray glasses on as concerned all competition in an ostensibly free and fair and competitive marketplace while simultaneously creating scope for arbitrary other advanced actors to exploit the same intentionally crippled OS-level security at the cost of weakening the entire world’s digital security infrastructure for pure financial profit without so much as a FISA court order to justify such actions. If substantiated, such accusations would be among the most damning in the history of technology.

ajdude 3y ago
If this is true that sounds really, really, bad.
nemothekid 3y ago
>If substantiated, such accusations would be among the most damning in the history of technology. If substantiated? Just search Onavo on HN search - I thought this was widely known for years.
- benreesman 3y ago
  As a former employee until 2018, I heard the words “Project Ghostbusters” two days ago. I was peripherally aware of something called Onavo but I had no notion that anyone was talking about “kits”, we all thought it was some kind of metrics thing that was sort of iffy sounding but lots of iffy ideas got proposed by some PM looking to make a name and shot down by the grownups, what is alleged would have provoked a riot at the weekly all hands. If any of this is true they didn’t tell people like me about it, and at one point there were three people on the org chart between myself and the CEO. I’m very skeptical of the allegations, but I’d be lying if I said I found them to be flat impossible. I tread very lightly on this sort of thing and I didn’t even acknowledge I’d ever heard the word Onavo until I read it on TechCrunch. I certainly hope they’re false: FAIR seems to be the last real hope for an Open future on AI short of a complete housecleaning of the whole Valley.
  - sunshowers 3y ago
    Ex-FB here -- I do feel like I knew about the general scope of what Onavo did, which was to incentivize people so FB could snoop on TLS traffic and grab data about competitor usage.
    - benreesman 3y ago
      Could be a question of what we worked on. I did Ads ML Infrastructure, Abuse Detection Systems (spam basically), and then more ML Infrastructure on IG Feed/Stories. I was deep enough in the engine room it was all more or less feature embeddings. So it’s probably fair to say I would have known less about strategic maneuvering than plenty of less tenured folks closer to the surface. I knew it sounded vaguely sketchy but you remember how many vaguely sketchy things some frisky new PM tried to get pushed through a launch card meeting only to have someone on Sheryl’s radar detonate it on the launch pad. The timeframe is the main reason I’m skeptical: Sheryl didn’t put up with crap like that she knew what was at stake.
      - sunshowers 3y ago
        I was on devinfra/source control (worked 2012-2018 in that area before switching to Libra) so we weren't making decisions, but we got to saw a bunch of what happened as it happened. Onavo was always treated as pretty sus among the people I worked with, who were largely linux/free software/security types. As Pedro said in the email described in [1], no sufficiently well-informed, security-minded person could ever be comfortable with Onavo. [1]: https://techcrunch.com/2024/03/26/facebook-secret-project-snooped-snapchat-user-traffic/ https://techcrunch.com/2024/03/26/facebook-secret-project-sn...
  - nemothekid 3y ago
    I had a friend tell me about Onavo in ~2015. I wont delve into what he told me, but at the time I had the "move fast and break things" spirit and thought it was a pretty cool tool that they had figured out to get competitive information. He never showed me anything, but allegedly they could even see what features were being used in other apps. But I don't think this is something he made up, it's been discussed on HN. https://news.ycombinator.com/item?id=16381812 https://news.ycombinator.com/item?id=16381812 >I wonder if it's be possible to make a social networking startup, optimise solely for Onavo metrics, and get bought out by Facebook. https://news.ycombinator.com/item?id=16373339 https://news.ycombinator.com/item?id=16373339 >The Onavo VPN service from Facebook is disguised as a protection mechanism but tracks the user for the benefit of Facebook. https://news.ycombinator.com/item?id=14971839 https://news.ycombinator.com/item?id=14971839 >The database stems from Facebook’s 2013 acquisition of a Tel Aviv-based startup, Onavo, which had built an app that secures users’ privacy by routing their traffic through private servers. The app gives Facebook an unusually detailed look at what users collectively do on their phones, these people say. I am surprised that this accusation is at all controversial.
loeg 3y ago
> such accusations would be among the most damning in the history of technology. You're putting this up there with IBM in the holocaust?
ahahahahah 3y ago
This article has nothing to do with onavo.

ajdude 3y ago

If this is true that sounds really, really, bad.

nemothekid 3y ago

>If substantiated, such accusations would be among the most damning in the history of technology. If substantiated? Just search Onavo on HN search - I thought this was widely known for years.

benreesman 3y ago
As a former employee until 2018, I heard the words “Project Ghostbusters” two days ago. I was peripherally aware of something called Onavo but I had no notion that anyone was talking about “kits”, we all thought it was some kind of metrics thing that was sort of iffy sounding but lots of iffy ideas got proposed by some PM looking to make a name and shot down by the grownups, what is alleged would have provoked a riot at the weekly all hands. If any of this is true they didn’t tell people like me about it, and at one point there were three people on the org chart between myself and the CEO. I’m very skeptical of the allegations, but I’d be lying if I said I found them to be flat impossible. I tread very lightly on this sort of thing and I didn’t even acknowledge I’d ever heard the word Onavo until I read it on TechCrunch. I certainly hope they’re false: FAIR seems to be the last real hope for an Open future on AI short of a complete housecleaning of the whole Valley.
- sunshowers 3y ago
  Ex-FB here -- I do feel like I knew about the general scope of what Onavo did, which was to incentivize people so FB could snoop on TLS traffic and grab data about competitor usage.
  - benreesman 3y ago
    Could be a question of what we worked on. I did Ads ML Infrastructure, Abuse Detection Systems (spam basically), and then more ML Infrastructure on IG Feed/Stories. I was deep enough in the engine room it was all more or less feature embeddings. So it’s probably fair to say I would have known less about strategic maneuvering than plenty of less tenured folks closer to the surface. I knew it sounded vaguely sketchy but you remember how many vaguely sketchy things some frisky new PM tried to get pushed through a launch card meeting only to have someone on Sheryl’s radar detonate it on the launch pad. The timeframe is the main reason I’m skeptical: Sheryl didn’t put up with crap like that she knew what was at stake.
    - sunshowers 3y ago
      I was on devinfra/source control (worked 2012-2018 in that area before switching to Libra) so we weren't making decisions, but we got to saw a bunch of what happened as it happened. Onavo was always treated as pretty sus among the people I worked with, who were largely linux/free software/security types. As Pedro said in the email described in [1], no sufficiently well-informed, security-minded person could ever be comfortable with Onavo. [1]: https://techcrunch.com/2024/03/26/facebook-secret-project-snooped-snapchat-user-traffic/ https://techcrunch.com/2024/03/26/facebook-secret-project-sn...
- nemothekid 3y ago
  I had a friend tell me about Onavo in ~2015. I wont delve into what he told me, but at the time I had the "move fast and break things" spirit and thought it was a pretty cool tool that they had figured out to get competitive information. He never showed me anything, but allegedly they could even see what features were being used in other apps. But I don't think this is something he made up, it's been discussed on HN. https://news.ycombinator.com/item?id=16381812 https://news.ycombinator.com/item?id=16381812 >I wonder if it's be possible to make a social networking startup, optimise solely for Onavo metrics, and get bought out by Facebook. https://news.ycombinator.com/item?id=16373339 https://news.ycombinator.com/item?id=16373339 >The Onavo VPN service from Facebook is disguised as a protection mechanism but tracks the user for the benefit of Facebook. https://news.ycombinator.com/item?id=14971839 https://news.ycombinator.com/item?id=14971839 >The database stems from Facebook’s 2013 acquisition of a Tel Aviv-based startup, Onavo, which had built an app that secures users’ privacy by routing their traffic through private servers. The app gives Facebook an unusually detailed look at what users collectively do on their phones, these people say. I am surprised that this accusation is at all controversial.

loeg 3y ago

> such accusations would be among the most damning in the history of technology. You're putting this up there with IBM in the holocaust?

ahahahahah 3y ago

This article has nothing to do with onavo.