4 ms·

So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market re

So just to be clear on what is being alleged, because the write-ups are omitting this detail: from what I can tell FB paid SC users to participate in “market research” and install the proxy. The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. (I’d love to get more detail on exactly what the participants were told they were getting paid for, but I’d be surprised if they did not know their actions were being monitored.) The accusation that it’s wiretapping if one party in the communication channel is actively breaking the encryption (even with a tool provided by a third party) seems tenuous to me, but IANAL. If this is wiretapping, is it also wiretapping for me to use a local SSL proxy to decrypt and analyze traffic to a service’s API?

haxrob 2y ago
> from what I can tell FB paid SC users to participate in “market research” and install the proxy. The app was available on both the Google Play and Apple App stores for anyone to download. > The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. It could be that you are confused with a previous case. From the blog post: > The wiretapping claim is new and perhaps not to be confused with the prior controversy and litigation: In 2023, two subsidiaries of Facebook was ordered to pay a total of $20M by the Australian Federal Court for "engaging in conduct liable to mislead in breach of the Australian Consumer Law", according to the ACCC ... Facebook had shutdown Onavo in 2019 after an investigation revealed they had been paying teenagers to use the app to track them. Also that year, Apple went as far as to revoke Facebook's developer program certificates, sending a clear message. > If this is wiretapping, is it also wiretapping for me to use a local SSL proxy to decrypt and analyze traffic to a service’s API If by "local" on your own network/machine with your own traffic then obviously no.
ec109685 2y ago
Neilson does something similar with TV where they install capture boxes in people’s houses to determine what they’re watching for their panels: https://www.nytimes.com/athletic/3194414/2022/03/22/the-ultimate-nielsen-faq-how-we-and-they-know-how-many-of-you-are-watching-sports-on-tv/?source=user_shared_article https://www.nytimes.com/athletic/3194414/2022/03/22/the-ulti... I hope they were upfront about what they were collecting. The article didn’t show what the consent screen was before installing the proxy.
vlovich123 2y ago
From the article: > Note this is a new case, different from the one that TechCrunch also covered in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines.
- theptip 2y ago
  This has since been edited in OP, and the full quote I think supports my claim more: > Note this is different to what TechCrunch had revealed in 2019 in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines. With the new MITM information revealed: what is currently unclear is if all app users had their traffic "intercepted" or just a subset of users.
oefrha 2y ago
No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was even more invasive.[2] So no, this Onavo bullshit isn’t defensible at all. [1] https://apkpure.com/onavo-protect-from-facebook/com.onavo.spaceship?ref=doubleagent.net https://apkpure.com/onavo-protect-from-facebook/com.onavo.sp... [2] https://techcrunch.com/2019/01/29/facebook-project-atlas/?ref=doubleagent.net https://techcrunch.com/2019/01/29/facebook-project-atlas/?re...
- H8crilA 2y ago
  Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.
  - kotaKat 2y ago
    It takes the correct morally bankrupt person to be willing to take the job.
    - dl9999 2y ago
      Or a person with a sick kid, or who is about to be evicted, or who made some bad financial decisions or for some other reason is about to run out of food money. In those situations it's very easy to rationalize that the good outweighs the bad. I've only been in a similar situation once. I could barely sleep at night for a week before I finally told them that I couldn't do it. In my situation I would have taken a financial hit if they decided to let me go, but my wife works and I have savings and there was no immediate threat, and it still was a difficult decision.
      - IG_Semmelweiss 2y ago
deleted 2y ago
[deleted]
BobaFloutist 2y ago
> The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. All the best/most effective hacks involve convincing someone to download something they shouldn't that lets you sidestep security.
- halJordan 2y ago
  It was fully clear and fully remunerated. It was no way a hack and thats disingenuous wording so you can hate on FB. If you install a vpn then you are affirmatively giving control of your traffic tot he vpn. FB isnt under any obligation to explain how networks work. In the same way we don't explain dns or routing. Is your boss obligated to tell you ACH transactions are in the clear and anyone can watch settlement? No. You're not being hacked when your bank sends payments via ach.
  - BobaFloutist 2y ago
    I'm not arguing that the users got hacked, I'm arguing that the competitors got hacked.
hollerith 2y ago
SC == Snapchat

haxrob 2y ago

> from what I can tell FB paid SC users to participate in “market research” and install the proxy. The app was available on both the Google Play and Apple App stores for anyone to download. > The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. It could be that you are confused with a previous case. From the blog post: > The wiretapping claim is new and perhaps not to be confused with the prior controversy and litigation: In 2023, two subsidiaries of Facebook was ordered to pay a total of $20M by the Australian Federal Court for "engaging in conduct liable to mislead in breach of the Australian Consumer Law", according to the ACCC ... Facebook had shutdown Onavo in 2019 after an investigation revealed they had been paying teenagers to use the app to track them. Also that year, Apple went as far as to revoke Facebook's developer program certificates, sending a clear message. > If this is wiretapping, is it also wiretapping for me to use a local SSL proxy to decrypt and analyze traffic to a service’s API If by "local" on your own network/machine with your own traffic then obviously no.

ec109685 2y ago

Neilson does something similar with TV where they install capture boxes in people’s houses to determine what they’re watching for their panels: https://www.nytimes.com/athletic/3194414/2022/03/22/the-ultimate-nielsen-faq-how-we-and-they-know-how-many-of-you-are-watching-sports-on-tv/?source=user_shared_article https://www.nytimes.com/athletic/3194414/2022/03/22/the-ulti... I hope they were upfront about what they were collecting. The article didn’t show what the consent screen was before installing the proxy.

vlovich123 2y ago

From the article: > Note this is a new case, different from the one that TechCrunch also covered in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines.

theptip 2y ago
This has since been edited in OP, and the full quote I think supports my claim more: > Note this is different to what TechCrunch had revealed in 2019 in which Facebook were paying teenagers to gather data on usage habits. That resulted in the Onavo app being pulled from the app stores and fines. With the new MITM information revealed: what is currently unclear is if all app users had their traffic "intercepted" or just a subset of users.

oefrha 2y ago

No, the writeup isn’t omitting anything, you’re mixing things up, which this article explicitly called out. This article is about Onavo Protect[1], “Free VPN + Data Manager”, which was not paying anyone. There was a separate program where Facebook paid teenagers money to install their Facebook Research VPN through their enterprise distribution channel, bypassing the App Store and its rules, so that paid version was even more invasive.[2] So no, this Onavo bullshit isn’t defensible at all. [1] https://apkpure.com/onavo-protect-from-facebook/com.onavo.spaceship?ref=doubleagent.net https://apkpure.com/onavo-protect-from-facebook/com.onavo.sp... [2] https://techcrunch.com/2019/01/29/facebook-project-atlas/?ref=doubleagent.net https://techcrunch.com/2019/01/29/facebook-project-atlas/?re...

H8crilA 2y ago
Why do people work on such projects? I mean specifically the engineers. You're still paid the same engineer salary, except now you expose yourself to criminal prosecution. The corpo is at least getting some extra returns for the risk, you as an engineer are not. So dumb.
- kotaKat 2y ago
  It takes the correct morally bankrupt person to be willing to take the job.
  - dl9999 2y ago
    Or a person with a sick kid, or who is about to be evicted, or who made some bad financial decisions or for some other reason is about to run out of food money. In those situations it's very easy to rationalize that the good outweighs the bad. I've only been in a similar situation once. I could barely sleep at night for a week before I finally told them that I couldn't do it. In my situation I would have taken a financial hit if they decided to let me go, but my wife works and I have savings and there was no immediate threat, and it still was a difficult decision.
    - IG_Semmelweiss 2y ago

deleted 2y ago

[deleted]

BobaFloutist 2y ago

> The way most of the writeups make it sound is that it’s some sort of hack, but this doesn’t seem to be the case. All the best/most effective hacks involve convincing someone to download something they shouldn't that lets you sidestep security.

halJordan 2y ago
It was fully clear and fully remunerated. It was no way a hack and thats disingenuous wording so you can hate on FB. If you install a vpn then you are affirmatively giving control of your traffic tot he vpn. FB isnt under any obligation to explain how networks work. In the same way we don't explain dns or routing. Is your boss obligated to tell you ACH transactions are in the clear and anyone can watch settlement? No. You're not being hacked when your bank sends payments via ach.
- BobaFloutist 2y ago
  I'm not arguing that the users got hacked, I'm arguing that the competitors got hacked.

hollerith 2y ago

SC == Snapchat