10 ms·

Quote: A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices runni

Quote: A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.

nottorp 1y ago
If this is true, why is this a civil lawsuit? Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities?
- yubblegum 1y ago
  Because: $random_kid is not running an outsourced surveillance service for the security state.
- gruez 1y ago
  >Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities? Because there's probably some clause buried in the ToS that gives them the right to do this, so it would not count as "exceeds authorized access" under the CFAA. edit: it's not even buried. there's a screen that specifically says "facebook uses aggregated onavo data for market and business analytics"
  - salawat 1y ago
    So... Where was the negotiation step where there was the option to do VPN'ry without the surveillance? Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. Not one company, in particular, tech companies, have a legal pipeline that can support redlining a contract or facilitating negotiation at scale which is the actual desired incarnation of contract law as a tool of mutual empowerment through agreements. We need to seriously hold our system to account for building only the accept as-is part of the pipeline, but not the negotiation side of the pipeline. Make no mistake either, as that was an intentional decision to chase growth in the interests of becoming TBTF. We need to clamp down and make it clear, big mofos do not get to call unilateral shots and that it is not acceptable for terms to be dictated only in one direction. Yes, this complicates the hell out of business logic, but ya know what, the ones who have TBTF'd have drank of the waters of economies of scale to get the sweet draught, it's about damn time they got the bitters too.
    - gruez 1y ago
      >Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. I might be sympathetic to this if this was some essential service with strong network effects such that there's no alternative (eg. facebook or whatsapp), but that's not the case here. This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow.
      - salawat 1y ago
        >This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow. You mean like a loud ass bell rings? Point out to me a single piece of software utilizing a EULA that supports individual redlining and renegotiation on a user by user basis, with a feedback loop tight enough to be reasonable. I'll wait. The point is there might be the illusion of user choice there, but when the overarching legal framework operates in unity in a take it or leave it fashion, with no escape hatch, every business model behaves the same. No one builds the business willing to charge for contractual dumb pipe, because everyone is just dumping anyone else who won't take the default terms. The entire architecture of our networked world has turned into building machines through which everyone gives up every right and civil protection through a goddamn click, nevermind the fact Third Party Doctrine in this age has completely dismantled the 4th Amendment by extension.
        gruez 1y ago
        >Point out to me a single piece of software utilizing a EULA that supports individual redlining and renegotiation on a user by user basis, with a feedback loop tight enough to be reasonable. I'll wait. If you want apps priced at $0.99 or even $99.99, standard form, take it or leave it contracts is the only game in town, for pure economic reasons. No company is going to bother getting legal involved to negotiate a bespoke contract for anything with less than 5 figures TCV.
- DrillShopper 1y ago
  Because Facebook is key to their online surveillance, so Facebook making itself better is making itself more effective to the state surveillance apparatus
- benmmurphy 1y ago
  I assume because there was no actual hacking. I'm guessing users consented to this. As a user I should be able to view all traffic from my device and also give other third parties permission to view all traffic on my device. If I can't do this, is it really my device? It's not too much different from what Nielsen was doing when they installed boxes in people's homes to record what TV shows they were watching.
- Arnt 1y ago
  You can file a civil lawsuit. You may or may not be able to persuade the prosecutor to file a criminal case. The video near the middle of the page shows fairly clearly what they did, with accurate and understandable descriptions of shady behaviour. I think a capable prosecutor might regard it as difficult to prove that behaviour illegal. Shady, sure, but in dubio pro so why even prosecute. So that leaves a civil lawsuit. There's no need to persuade a prosecutor for a civil lawsuit, and the balance of evidence counts, there's no in dubio pro.
  - qingcharles 1y ago
    I think there are still some small pockets of the USA where a person can file a private prosecution. And other countries definitely allow it.
    - Arnt 1y ago
      Right, so a third option is to try to establish jurisdiction in a location where private prosecution of criminal issues is permitted.
- pjc50 1y ago
  Just like AI companies are allowed to do the piracy that Aaron Schwartz was going to be jailed for, Facebook are too big to prosecute for hacking.

nottorp 1y ago

If this is true, why is this a civil lawsuit? Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities?

yubblegum 1y ago
Because: $random_kid is not running an outsourced surveillance service for the security state.
gruez 1y ago
>Shouldn't the government prosecutors handle this "hacking" case and demand jail time, like they do for $random_kid playing around with security vulnerabilities? Because there's probably some clause buried in the ToS that gives them the right to do this, so it would not count as "exceeds authorized access" under the CFAA. edit: it's not even buried. there's a screen that specifically says "facebook uses aggregated onavo data for market and business analytics"
- salawat 1y ago
  So... Where was the negotiation step where there was the option to do VPN'ry without the surveillance? Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. Not one company, in particular, tech companies, have a legal pipeline that can support redlining a contract or facilitating negotiation at scale which is the actual desired incarnation of contract law as a tool of mutual empowerment through agreements. We need to seriously hold our system to account for building only the accept as-is part of the pipeline, but not the negotiation side of the pipeline. Make no mistake either, as that was an intentional decision to chase growth in the interests of becoming TBTF. We need to clamp down and make it clear, big mofos do not get to call unilateral shots and that it is not acceptable for terms to be dictated only in one direction. Yes, this complicates the hell out of business logic, but ya know what, the ones who have TBTF'd have drank of the waters of economies of scale to get the sweet draught, it's about damn time they got the bitters too.
  - gruez 1y ago
    >Take it or leave it license agreements in my opinion violate meeting-of-the-minds, and our legal system has just cut a pass for the last half a century to one sided take it or leave it levels of exploitative entering into contracts at scale. I might be sympathetic to this if this was some essential service with strong network effects such that there's no alternative (eg. facebook or whatsapp), but that's not the case here. This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow.
    - salawat 1y ago
      >This is a separate "security" app, of which there's probably dozens of competitors that you can choose from if you don't like the ToS/privacy policy of this one, so the "one sided take it or leave it levels of exploitative entering into contracts at scale" aspect you're decrying really rings hollow. You mean like a loud ass bell rings? Point out to me a single piece of software utilizing a EULA that supports individual redlining and renegotiation on a user by user basis, with a feedback loop tight enough to be reasonable. I'll wait. The point is there might be the illusion of user choice there, but when the overarching legal framework operates in unity in a take it or leave it fashion, with no escape hatch, every business model behaves the same. No one builds the business willing to charge for contractual dumb pipe, because everyone is just dumping anyone else who won't take the default terms. The entire architecture of our networked world has turned into building machines through which everyone gives up every right and civil protection through a goddamn click, nevermind the fact Third Party Doctrine in this age has completely dismantled the 4th Amendment by extension.
      - gruez 1y ago
        >Point out to me a single piece of software utilizing a EULA that supports individual redlining and renegotiation on a user by user basis, with a feedback loop tight enough to be reasonable. I'll wait. If you want apps priced at $0.99 or even $99.99, standard form, take it or leave it contracts is the only game in town, for pure economic reasons. No company is going to bother getting legal involved to negotiate a bespoke contract for anything with less than 5 figures TCV.
DrillShopper 1y ago
Because Facebook is key to their online surveillance, so Facebook making itself better is making itself more effective to the state surveillance apparatus
benmmurphy 1y ago
I assume because there was no actual hacking. I'm guessing users consented to this. As a user I should be able to view all traffic from my device and also give other third parties permission to view all traffic on my device. If I can't do this, is it really my device? It's not too much different from what Nielsen was doing when they installed boxes in people's homes to record what TV shows they were watching.
Arnt 1y ago
You can file a civil lawsuit. You may or may not be able to persuade the prosecutor to file a criminal case. The video near the middle of the page shows fairly clearly what they did, with accurate and understandable descriptions of shady behaviour. I think a capable prosecutor might regard it as difficult to prove that behaviour illegal. Shady, sure, but in dubio pro so why even prosecute. So that leaves a civil lawsuit. There's no need to persuade a prosecutor for a civil lawsuit, and the balance of evidence counts, there's no in dubio pro.
- qingcharles 1y ago
  I think there are still some small pockets of the USA where a person can file a private prosecution. And other countries definitely allow it.
  - Arnt 1y ago
    Right, so a third option is to try to establish jurisdiction in a location where private prosecution of criminal issues is permitted.
pjc50 1y ago
Just like AI companies are allowed to do the piracy that Aaron Schwartz was going to be jailed for, Facebook are too big to prosecute for hacking.