10 ms·

Facebook is not removable from many android devices... does this mean Zuckerberg has been seeing all user traffic for years regardless of tls?

eru 3y ago
Only when they used Onavo, it seems? https://en.wikipedia.org/wiki/Onavo https://en.wikipedia.org/wiki/Onavo is slightly more readable than the legal document submitted as the link.
douglasmoore 3y ago
I might be wrong but I think you need the onavo VPN installed Then your YouTube, Snapchat analytics would get man in the middled
1oooqooq 3y ago
Yes and No. for TLS traffic you need to also install onavo. But the app does scan your contact list every couple minutes and send diffs to their servers. Even if you have never opened the app. And on previous android versions all your recently open apps list too. But again, if you install whatsapp you must give them the contact list permission anyway otherwise the app is intentionally broken and annoying.
- felsokning 3y ago
  > for TLS traffic you need to also install onavo. I'd be interested to know if it shipped as part of the Facebook SDK, as well.
- 14 3y ago
  I really think you are a fool if you install WhatsApp. I do think you are higher intelligence than normal if you install Signal. When I hear friends talk about WhatsApp I cringe. The few who have signal I regard highly.
  - eru 3y ago
    Real life is full of compromises. If your grandma is on WhatsApp, and you want to talk to her, it might be a good idea to install WhatsApp. (However, if you have time on your hand and principles, you can use WhatsApp on a burner phone, I guess?)
    - 14 3y ago
      Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.
      - 1oooqooq 3y ago
        outside of the imperium center, you'd be lucky to have one provider of some product or service. and usually they will only be reachable via whatsapp. because metabook used whatsbook as a backdoor for for their failed oneinternet(?) project. remember the backlash fb got when they offered free internet in india and africa but only for the Facebook app? well, everywhere in the world you get free whatsapp traffic, so everyone now is on whatsapp. good luck convincing a business who get hundreds of sales call via WhatsApp tobuse signal. or convincing people who can barely afford their water bill that they now need a data plan to use signal instead of free whatsapp. metabook won on this.
        xvector 3y ago
        > metabook won on this. They won on distributing E2EE and the Signal Protocol to 99% of the world, which previously transmitted everything in plain? Sounds like a pretty good win to me.
      - eru 3y ago
        Sure, if you have time on your hand and principles, you can try convincing your grandma to change her ways.
  - xvector 3y ago
    Security SWE here. I have worked with WhatsApp's security engineers, I donate hundreds to the Signal Foundation every year, and I like to think I have a good amount of experience by now in the security industry. > you are a fool if you install WhatsApp [...] meta is balls deep inside the app and watching what you do. WhatsApp uses the same protocols as Signal under the hood. The Signal team even helped WhatsApp implement it. Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin. https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ > When I hear friends talk about WhatsApp I cringe. The few who have signal I regard highly. Your clear lack of knowledge on the subject matter combined with your judgement of others says far more about you than your friends. It seems that you have fallen victim to the Dunning-Kruger curve, so consider not judging people until that is rectified.

eru 3y ago

Only when they used Onavo, it seems? https://en.wikipedia.org/wiki/Onavo https://en.wikipedia.org/wiki/Onavo is slightly more readable than the legal document submitted as the link.

douglasmoore 3y ago

I might be wrong but I think you need the onavo VPN installed Then your YouTube, Snapchat analytics would get man in the middled

1oooqooq 3y ago

Yes and No. for TLS traffic you need to also install onavo. But the app does scan your contact list every couple minutes and send diffs to their servers. Even if you have never opened the app. And on previous android versions all your recently open apps list too. But again, if you install whatsapp you must give them the contact list permission anyway otherwise the app is intentionally broken and annoying.

felsokning 3y ago
> for TLS traffic you need to also install onavo. I'd be interested to know if it shipped as part of the Facebook SDK, as well.
14 3y ago
I really think you are a fool if you install WhatsApp. I do think you are higher intelligence than normal if you install Signal. When I hear friends talk about WhatsApp I cringe. The few who have signal I regard highly.
- eru 3y ago
  Real life is full of compromises. If your grandma is on WhatsApp, and you want to talk to her, it might be a good idea to install WhatsApp. (However, if you have time on your hand and principles, you can use WhatsApp on a burner phone, I guess?)
  - 14 3y ago
    Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.
    - 1oooqooq 3y ago
      outside of the imperium center, you'd be lucky to have one provider of some product or service. and usually they will only be reachable via whatsapp. because metabook used whatsbook as a backdoor for for their failed oneinternet(?) project. remember the backlash fb got when they offered free internet in india and africa but only for the Facebook app? well, everywhere in the world you get free whatsapp traffic, so everyone now is on whatsapp. good luck convincing a business who get hundreds of sales call via WhatsApp tobuse signal. or convincing people who can barely afford their water bill that they now need a data plan to use signal instead of free whatsapp. metabook won on this.
      - xvector 3y ago
        > metabook won on this. They won on distributing E2EE and the Signal Protocol to 99% of the world, which previously transmitted everything in plain? Sounds like a pretty good win to me.
    - eru 3y ago
      Sure, if you have time on your hand and principles, you can try convincing your grandma to change her ways.
- xvector 3y ago
  Security SWE here. I have worked with WhatsApp's security engineers, I donate hundreds to the Signal Foundation every year, and I like to think I have a good amount of experience by now in the security industry. > you are a fool if you install WhatsApp [...] meta is balls deep inside the app and watching what you do. WhatsApp uses the same protocols as Signal under the hood. The Signal team even helped WhatsApp implement it. Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin. https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ > When I hear friends talk about WhatsApp I cringe. The few who have signal I regard highly. Your clear lack of knowledge on the subject matter combined with your judgement of others says far more about you than your friends. It seems that you have fallen victim to the Dunning-Kruger curve, so consider not judging people until that is rectified.