5 ms·

That is insane and I would be inclined to not believe it if someone had told me this. This is such an immense breach of trust that even for me, who has a very l

That is insane and I would be inclined to not believe it if someone had told me this. This is such an immense breach of trust that even for me, who has a very low opinion of Meta, it is unexpected. I hope this will blow up as much as it should

RowanH 3y ago
So this one time, I had a bug report at a client site. The business was largely a member of _______ religion. Our images wouldn't load in the app, but did on the website. How odd I thought, that doesn't make sense! Luckily I was able to be physically present, so I hopped down with laptop in tow, ssh'd into the server and started tailing logs.... Sure enough all the API requests for data were coming through, but whenever a request for image happened - nothing would hit the servers. What the heck I thought to myself? I said to the client 'that can't be, that's almost impossible....the only way that's possible is if the SSL traffic is decrypted, inspected, and images blocked from being requested, which, is a MITM attack". He redirected me to his IT provider. I phoned them up, and explained the situation. "Ahh so they're _____" Me: "So what does that have to do with the price of fish?" Them : "Content filtering..., you need to talk to ____" Sure as the day is long, the content filter was a VPN all members of ____ had to have on their mobile devices (I don't know how widespread this is, whether it was just this business, or the entire ____ ) I applied to have our system approved, it was, and just like magic the next day photos started coming through. I'm guessing basically it detected any .jpg/.mp4 etc URL's in https requests and flagged it up and blocked them from being requested. You can be sure on those devices the VPN would have been somehow locked in with device management, and there's no way on gods green earth they were getting at Facebook/insta etc. So, it's not just meta. That really hammered home how seamless it can be to end users that they really can't trust what's actually happening on their devices.
- leononame 3y ago
  Not that I'm a fan of it, but in corps it's pretty standard praxis to have a custom root cert installed on all devices and enforce VPN connections on devices outside the network to be able to MITM all requests and do stuff like content filtering (e.g. NSFW, swearwords and obviously malware). It's the company's device and they give it to you for work specific purpose, you shouldn't use it for personal stuff. I don't think it compares to an app that shadily installs its own root cert on an end user's device to spy on them.
  - felsokning 3y ago
    From the inference of the commenter, I think they were referring to an app on a mobile device and not the device itself. It also sounds like their issue was at the ISP provider level, as well, which takes the business out of the loop of being the data controller/owner (of the collected data) at that point. Note: I'm not saying that your comment doesn't have merit, I just don't think that the points that you made apply - specifically - in this case?
    - leononame 3y ago
      After re-reasing the comment I think you're right. I had a hard time grokking it it seems. But since the issue was apparently a VPN app installed on the phone, I don't know whether this was the ISP or maybe their IT service provider that did content filtering on behalf of the company (like an outsourced IT department?)
      - RowanH 3y ago
        The VPN (much like Meta's) is doing some root cert trickery to filter content that is deemed inappropriate or potentially inappropriate. This appeared to be controlled by a Company A in another country that undoubtedly contracted to Y religion to be their central point of content filtering globally. So, member of the church? you get this VPN on your phone, (not sure whether phone was supplied by the church, but certainly this VPN was on it) VPN is effectively content filtering and blocking content. I had our app whitelisted by that central company (literally raised a ticket with them, next day magically fixed).
  - RowanH 3y ago
    It's not corporate level it was/is religious group level (of which this particular org I'm guessing largely employed staff from that religion). They are well known within our country to be quite insular. It certainly seemed for all intents and purposes if you were a member of _____ group (wider than the company) you had the vpn on your device, and it was filtering content. I've found other reports in other countries of that happening with the same group. So it's not corporate content filtering, it's personal content filtering and our app got caught up in it (and approved). It certainly made my skin crawl for anyone in that religion. That means the central filtering service could be reading messages. Not sure if they're that sophisticated but certainly they didn't want people to see random images/videos.
- bratwurst3000 3y ago
  Holy shit they can brainwash their peers even better. Those are evil geniuses…. Sorry I meant the optimize the content for their peers and shield them from harmful content for the better of humanity // irony
- Tijdreiziger 3y ago
  There are even ‘safe’ (filtered) ISPs aimed at religious communities.
FLT8 3y ago
I also hope that any ethically minded engineers inside Meta take a stand against this BS. The only way stuff like this happens is because engineers working on these projects decide that they can set aside whatever morals they may have had for the price of a big fat FAANG pay cheque. It's about time our profession adopted a code of ethics, like that of the ACM[1]. To the engineers who _have_ walked away despite the obvious pressures, I salute you. 1. https://www.acm.org/code-of-ethics https://www.acm.org/code-of-ethics
- trvz 3y ago
  Ethically minded engineers don't go work for Facebook in the first place.
  - beagle3 3y ago
    This was news … 5 years ago, I think, I don’t know why it blew up again. But context matters: Onavo provided a compression + VPN service for people traveling; they let users use little or no data while roaming, and still get internet access. I do not know what their original business plan was, but Facebook bought them for the ability to spy on users. Their MITM was, in fact, the raison d’etre of Onavo. And then, they were bought by Facebook. And then there was just some more analytics added. At no point, as I understand it, was it built explicitly for evil - and I suspect very few employees were in on the real reasons. Plausible deniability works for many things.
- toyg 3y ago
  You expect all people to have morals in the first place. That is an erroneous assumption.
  - FLT8 3y ago
    Nah, I've met enough amoral people over the course of my career to know that's not the case. However, the overwhelming majority of people I've worked with are people who do have morals and do care about the outcomes they're creating, and that gives me great hope.
- 3y ago
redder23 3y ago
Here is what is going to happen: 1. Nobody will care in 10 days. 2. They will get a slap on the wrist at best. Reminds me of Google driving around in StreetView cars, hacking and capturing all wifi traffic they could get their hands on. Did anything happen? Of course not! https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad... https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/ The guardian says "open" networks, apart from the fact that in 2010 networks were not secured by default in many cases. I think WEP 1 was a thing and easily hacked, and I would not be surprised if they were actually Wardriving, on the largest scale ever.
- redder23 3y ago
  I did not really need a reminder that this website is filled with morons, just like Reddit. But I get it anyway every time I post something negative. Remind me when anything more than a slap in the wrist happens. And my definition of slap on the wrist is adjusted to how big Meta actually is, they make more than some countries! You just hate facts, just like the idiots on Reddit, I am supposed to praise big tech criminals and just make positive stuff up, then I get all the upvotes.
hulitu 3y ago
> This is such an immense breach of trust Why do you trust it ? Do you think that others (Google, Microsoft, Apple) are not doing/would not do such a thing ? SSL is as secure as its certificates.
- exitheone 3y ago
  Honestly, yes, I don't think Microsoft Google and Apple would do something like this.
  - ethbr1 3y ago
    Imho, the correct way to evaluate corporate potential corporate trust is on self-interest. In Microsoft, Google, and Apple's cases, they all have substantial enterprise business that would shit a brick if they were caught doing this. Ergo, it's not in their best interest to do it. Safer to rely on a company's desire to make money than any sense of "good".
kevin_thibedeau 3y ago
It's a criminal CFAA violation.
justahuman74 3y ago
I'm somewhat surprised it's taken this long to come out. It was something of a open secret that onavo was spying somehow on snapchat traffic within atleast the infra/release org back in 2016 era

RowanH 3y ago

So this one time, I had a bug report at a client site. The business was largely a member of _______ religion. Our images wouldn't load in the app, but did on the website. How odd I thought, that doesn't make sense! Luckily I was able to be physically present, so I hopped down with laptop in tow, ssh'd into the server and started tailing logs.... Sure enough all the API requests for data were coming through, but whenever a request for image happened - nothing would hit the servers. What the heck I thought to myself? I said to the client 'that can't be, that's almost impossible....the only way that's possible is if the SSL traffic is decrypted, inspected, and images blocked from being requested, which, is a MITM attack". He redirected me to his IT provider. I phoned them up, and explained the situation. "Ahh so they're _____" Me: "So what does that have to do with the price of fish?" Them : "Content filtering..., you need to talk to ____" Sure as the day is long, the content filter was a VPN all members of ____ had to have on their mobile devices (I don't know how widespread this is, whether it was just this business, or the entire ____ ) I applied to have our system approved, it was, and just like magic the next day photos started coming through. I'm guessing basically it detected any .jpg/.mp4 etc URL's in https requests and flagged it up and blocked them from being requested. You can be sure on those devices the VPN would have been somehow locked in with device management, and there's no way on gods green earth they were getting at Facebook/insta etc. So, it's not just meta. That really hammered home how seamless it can be to end users that they really can't trust what's actually happening on their devices.

leononame 3y ago
Not that I'm a fan of it, but in corps it's pretty standard praxis to have a custom root cert installed on all devices and enforce VPN connections on devices outside the network to be able to MITM all requests and do stuff like content filtering (e.g. NSFW, swearwords and obviously malware). It's the company's device and they give it to you for work specific purpose, you shouldn't use it for personal stuff. I don't think it compares to an app that shadily installs its own root cert on an end user's device to spy on them.
- felsokning 3y ago
  From the inference of the commenter, I think they were referring to an app on a mobile device and not the device itself. It also sounds like their issue was at the ISP provider level, as well, which takes the business out of the loop of being the data controller/owner (of the collected data) at that point. Note: I'm not saying that your comment doesn't have merit, I just don't think that the points that you made apply - specifically - in this case?
  - leononame 3y ago
    After re-reasing the comment I think you're right. I had a hard time grokking it it seems. But since the issue was apparently a VPN app installed on the phone, I don't know whether this was the ISP or maybe their IT service provider that did content filtering on behalf of the company (like an outsourced IT department?)
    - RowanH 3y ago
      The VPN (much like Meta's) is doing some root cert trickery to filter content that is deemed inappropriate or potentially inappropriate. This appeared to be controlled by a Company A in another country that undoubtedly contracted to Y religion to be their central point of content filtering globally. So, member of the church? you get this VPN on your phone, (not sure whether phone was supplied by the church, but certainly this VPN was on it) VPN is effectively content filtering and blocking content. I had our app whitelisted by that central company (literally raised a ticket with them, next day magically fixed).
- RowanH 3y ago
  It's not corporate level it was/is religious group level (of which this particular org I'm guessing largely employed staff from that religion). They are well known within our country to be quite insular. It certainly seemed for all intents and purposes if you were a member of _____ group (wider than the company) you had the vpn on your device, and it was filtering content. I've found other reports in other countries of that happening with the same group. So it's not corporate content filtering, it's personal content filtering and our app got caught up in it (and approved). It certainly made my skin crawl for anyone in that religion. That means the central filtering service could be reading messages. Not sure if they're that sophisticated but certainly they didn't want people to see random images/videos.
bratwurst3000 3y ago
Holy shit they can brainwash their peers even better. Those are evil geniuses…. Sorry I meant the optimize the content for their peers and shield them from harmful content for the better of humanity // irony
Tijdreiziger 3y ago
There are even ‘safe’ (filtered) ISPs aimed at religious communities.

FLT8 3y ago

I also hope that any ethically minded engineers inside Meta take a stand against this BS. The only way stuff like this happens is because engineers working on these projects decide that they can set aside whatever morals they may have had for the price of a big fat FAANG pay cheque. It's about time our profession adopted a code of ethics, like that of the ACM[1]. To the engineers who _have_ walked away despite the obvious pressures, I salute you. 1. https://www.acm.org/code-of-ethics https://www.acm.org/code-of-ethics

trvz 3y ago
Ethically minded engineers don't go work for Facebook in the first place.
- beagle3 3y ago
  This was news … 5 years ago, I think, I don’t know why it blew up again. But context matters: Onavo provided a compression + VPN service for people traveling; they let users use little or no data while roaming, and still get internet access. I do not know what their original business plan was, but Facebook bought them for the ability to spy on users. Their MITM was, in fact, the raison d’etre of Onavo. And then, they were bought by Facebook. And then there was just some more analytics added. At no point, as I understand it, was it built explicitly for evil - and I suspect very few employees were in on the real reasons. Plausible deniability works for many things.
toyg 3y ago
You expect all people to have morals in the first place. That is an erroneous assumption.
- FLT8 3y ago
  Nah, I've met enough amoral people over the course of my career to know that's not the case. However, the overwhelming majority of people I've worked with are people who do have morals and do care about the outcomes they're creating, and that gives me great hope.
3y ago

redder23 3y ago

Here is what is going to happen: 1. Nobody will care in 10 days. 2. They will get a slap on the wrist at best. Reminds me of Google driving around in StreetView cars, hacking and capturing all wifi traffic they could get their hands on. Did anything happen? Of course not! https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad... https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/ The guardian says "open" networks, apart from the fact that in 2010 networks were not secured by default in many cases. I think WEP 1 was a thing and easily hacked, and I would not be surprised if they were actually Wardriving, on the largest scale ever.

redder23 3y ago
I did not really need a reminder that this website is filled with morons, just like Reddit. But I get it anyway every time I post something negative. Remind me when anything more than a slap in the wrist happens. And my definition of slap on the wrist is adjusted to how big Meta actually is, they make more than some countries! You just hate facts, just like the idiots on Reddit, I am supposed to praise big tech criminals and just make positive stuff up, then I get all the upvotes.

hulitu 3y ago

> This is such an immense breach of trust Why do you trust it ? Do you think that others (Google, Microsoft, Apple) are not doing/would not do such a thing ? SSL is as secure as its certificates.

exitheone 3y ago
Honestly, yes, I don't think Microsoft Google and Apple would do something like this.
- ethbr1 3y ago
  Imho, the correct way to evaluate corporate potential corporate trust is on self-interest. In Microsoft, Google, and Apple's cases, they all have substantial enterprise business that would shit a brick if they were caught doing this. Ergo, it's not in their best interest to do it. Safer to rely on a company's desire to make money than any sense of "good".

kevin_thibedeau 3y ago

It's a criminal CFAA violation.

justahuman74 3y ago

I'm somewhat surprised it's taken this long to come out. It was something of a open secret that onavo was spying somehow on snapchat traffic within atleast the infra/release org back in 2016 era