5 ms·

"Facebook expects partner services to be optimized for smartphones and feature phones, and be free from JavaScript or SSL/TLS/HTTPS elements" No HTTPS? Really?

by dest 11y ago

"Facebook expects partner services to be optimized for smartphones and feature phones, and be free from JavaScript or SSL/TLS/HTTPS elements" No HTTPS? Really??

dfabulich 11y ago
Facebook does NOT have to follow this rule today in its zero-rated India service. https://developers.facebook.com/docs/internet-org/platform-technical-guidelines https://developers.facebook.com/docs/internet-org/platform-t... > Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities. Catch that? They can proxy HTTPS for themselves, but they won't proxy HTTPS for "third-party sites." Thus, Internet.org isn't even neutral between Facebook and other developers; Facebook gets special HTTPS treatment that nobody else can get! Related, in an interview on Scroll.in: http://scroll.in/article/724975/facebook-opens-up-internet-org-to-developers-hoping-to-pacify-net-neutrality-critics http://scroll.in/article/724975/facebook-opens-up-internet-o... > Q: Isn’t it strange that Internet.org wants to offer free basic services but has no email? > A: If an email provider wants to comply with the platform guidelines that we are announcing, Internet.org would be glad to have it. Well, yeah, but if that means someone would have to offer email service without HTTPS, so anybody can read my email unencrypted or even send email as me, is that even useful?
- rjaco31 11y ago
  You would be amazed by the number of webmails that still offer plain HTTP on their login page, and yet people use them. I'd say it's better than no Internet.
  - minot 11y ago
    > and yet people use them People won't know the difference but we should. We need to find the root of the problem. So far, it seems the root of the problem is that developing nations do not have access to a fat enough pipe to the Internet backbone. Now, why do developing nations not have a fat enough pipe to the Internet backbone? What's the reason here? We should try to fix that at the same time as we try to improve connectivity. Just because I'm doing something for free does not mean I can half-ass it. People see my commitment and motivation in all things I do. So far, Facebook seems to really be interested in growth for itself as well as an effective shield against an upstart from upsetting them in the developing world. My apologies for being cynical but we really need to make the infrastructure issue a bigger priority.
    - jace 11y ago
      The pipe's fat enough. There's plenty of dark fiber. It's the last mile (wireless) that isn't cheap enough yet, because telcos want to protect themselves from being turned into dumb pipes before the users arrive -- internet.org is their smart pipe card (among similar, competing plans).
- userbinator 11y ago
  so anybody can read my email unencrypted or even send email as me For webmail login it'd be a problem, but email is almost always sent over the Internet in plaintext; those who want encryption and authentication will be using something like PGP.
  - diafygi 11y ago
    No, the vast majority uses opportunistic encryption in transit. http://www.google.com/transparencyreport/saferemail/ http://www.google.com/transparencyreport/saferemail/
- macns 11y ago
  > proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities Since they're just proxying, it makes sense to abandon encryption all together, not? I mean after all, HTTPS is supposed to protect from man-in-the-middle attacks, but aren't they themselves exactly that?
  - pjc50 11y ago
    You can have HTTPS proxies which only connect to a predefined list of IPs if you want. Because this is a surveillance-value-based product, they don't want to do that. (Given the Indian govt vs Blackberry, I wouldn't be surprised to hear that they had a hand in this somewhere. Very convenient if all mass political organisation goes through unencrypted facebook...)
slimsag 11y ago
It looks to be related to the above paragraph: “Websites that require high-bandwidth will not be included. Services should not use VoIP, video, file transfer, high resolution photos, or high volume of photos.” — Facebook points out that operators are giving up resources for the project for free, so this is a limit to prevent them totally being taken to the cleaners. Perhaps HTTPS is too heavy for the large number of users on such crippled networks?
- cheese1756 11y ago
  Maybe the service providers are caching heavily, and that's impossible with HTTPS? That seems likely, but I don't know a ton about the protocol.
- ripdog 11y ago
  Assuming a dumb pipe, SSL is no harder on the ISP than unencrypted traffic. It's likely that they want unencrypted because the data is then easily cacheable, drastically reducing cost on network operators.
  - will_hughes 11y ago
    Surely for network operators the cost isn't in external connectivity, its in radio channel capacity at the edge.
    - jsnell 11y ago
      In the west, sure. But that can't be generalized to all over the world. In some developing countries the internet connection costs of an operator can be very significant. High enough that it's been profitable to deploy expensive caches even for non-HTTP protocols, which account for a very small proportion of traffic. In the most extreme cases it's not just that the connectivity is expensive, it's that there's an absolute hard cap on bandwidth for a whole country, which is rationed among all the operators. No amount of money could buy a bigger portion in a sensible amount of time.
userbinator 11y ago
My completely-uninformed guess is that they don't want people to tunnel out to the real Internet: https://news.ycombinator.com/item?id=9203946 https://news.ycombinator.com/item?id=9203946 Although I suppose a bit of steganography is enough... Edit: steganography, not stenography.
- pshinghal 11y ago
  Did you mean steganography?
  - myhf 11y ago
    You can tunnel through stenography, but it's very slow.
kriro 11y ago
No JavaScript is also curious given their own React Native. Maybe they don't consider it "optimized for smartphones"? No SSL/TLS/HTTPS is just ridiculous and flat out unacceptable in this day and age. I'd expect a "no HTTP" clause and not the other way around. The linked technical guidelines from the original FB blogpost also seems to be dead: https://www.facebook.com/docs/internet-org/platform-technical-guidelines https://www.facebook.com/docs/internet-org/platform-technica...
- blumkvist 11y ago
  They don't consider it "optimized for featurephones".
- 1234567890123 11y ago
  https://developers.facebook.com/docs/internet-org/platform-technical-guidelines https://developers.facebook.com/docs/internet-org/platform-t...
1234567890123 11y ago
They have explained the reason: [0] Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities. [0]: https://developers.facebook.com/docs/internet-org/platform-technical-guidelines https://developers.facebook.com/docs/internet-org/platform-t...
pjc50 11y ago
No Javascript is an even more ridiculous restriction.

by dest 11y ago

"Facebook expects partner services to be optimized for smartphones and feature phones, and be free from JavaScript or SSL/TLS/HTTPS elements" No HTTPS? Really??

dfabulich 11y ago

Facebook does NOT have to follow this rule today in its zero-rated India service. https://developers.facebook.com/docs/internet-org/platform-technical-guidelines https://developers.facebook.com/docs/internet-org/platform-t... > Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities. Catch that? They can proxy HTTPS for themselves, but they won't proxy HTTPS for "third-party sites." Thus, Internet.org isn't even neutral between Facebook and other developers; Facebook gets special HTTPS treatment that nobody else can get! Related, in an interview on Scroll.in: http://scroll.in/article/724975/facebook-opens-up-internet-org-to-developers-hoping-to-pacify-net-neutrality-critics http://scroll.in/article/724975/facebook-opens-up-internet-o... > Q: Isn’t it strange that Internet.org wants to offer free basic services but has no email? > A: If an email provider wants to comply with the platform guidelines that we are announcing, Internet.org would be glad to have it. Well, yeah, but if that means someone would have to offer email service without HTTPS, so anybody can read my email unencrypted or even send email as me, is that even useful?

rjaco31 11y ago
You would be amazed by the number of webmails that still offer plain HTTP on their login page, and yet people use them. I'd say it's better than no Internet.
- minot 11y ago
  > and yet people use them People won't know the difference but we should. We need to find the root of the problem. So far, it seems the root of the problem is that developing nations do not have access to a fat enough pipe to the Internet backbone. Now, why do developing nations not have a fat enough pipe to the Internet backbone? What's the reason here? We should try to fix that at the same time as we try to improve connectivity. Just because I'm doing something for free does not mean I can half-ass it. People see my commitment and motivation in all things I do. So far, Facebook seems to really be interested in growth for itself as well as an effective shield against an upstart from upsetting them in the developing world. My apologies for being cynical but we really need to make the infrastructure issue a bigger priority.
  - jace 11y ago
    The pipe's fat enough. There's plenty of dark fiber. It's the last mile (wireless) that isn't cheap enough yet, because telcos want to protect themselves from being turned into dumb pipes before the users arrive -- internet.org is their smart pipe card (among similar, competing plans).
userbinator 11y ago
so anybody can read my email unencrypted or even send email as me For webmail login it'd be a problem, but email is almost always sent over the Internet in plaintext; those who want encryption and authentication will be using something like PGP.
- diafygi 11y ago
  No, the vast majority uses opportunistic encryption in transit. http://www.google.com/transparencyreport/saferemail/ http://www.google.com/transparencyreport/saferemail/
macns 11y ago
> proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities Since they're just proxying, it makes sense to abandon encryption all together, not? I mean after all, HTTPS is supposed to protect from man-in-the-middle attacks, but aren't they themselves exactly that?
- pjc50 11y ago
  You can have HTTPS proxies which only connect to a predefined list of IPs if you want. Because this is a surveillance-value-based product, they don't want to do that. (Given the Indian govt vs Blackberry, I wouldn't be surprised to hear that they had a hand in this somewhere. Very convenient if all mass political organisation goes through unencrypted facebook...)

slimsag 11y ago

It looks to be related to the above paragraph: “Websites that require high-bandwidth will not be included. Services should not use VoIP, video, file transfer, high resolution photos, or high volume of photos.” — Facebook points out that operators are giving up resources for the project for free, so this is a limit to prevent them totally being taken to the cleaners. Perhaps HTTPS is too heavy for the large number of users on such crippled networks?

cheese1756 11y ago
Maybe the service providers are caching heavily, and that's impossible with HTTPS? That seems likely, but I don't know a ton about the protocol.
ripdog 11y ago
Assuming a dumb pipe, SSL is no harder on the ISP than unencrypted traffic. It's likely that they want unencrypted because the data is then easily cacheable, drastically reducing cost on network operators.
- will_hughes 11y ago
  Surely for network operators the cost isn't in external connectivity, its in radio channel capacity at the edge.
  - jsnell 11y ago
    In the west, sure. But that can't be generalized to all over the world. In some developing countries the internet connection costs of an operator can be very significant. High enough that it's been profitable to deploy expensive caches even for non-HTTP protocols, which account for a very small proportion of traffic. In the most extreme cases it's not just that the connectivity is expensive, it's that there's an absolute hard cap on bandwidth for a whole country, which is rationed among all the operators. No amount of money could buy a bigger portion in a sensible amount of time.

userbinator 11y ago

My completely-uninformed guess is that they don't want people to tunnel out to the real Internet: https://news.ycombinator.com/item?id=9203946 https://news.ycombinator.com/item?id=9203946 Although I suppose a bit of steganography is enough... Edit: steganography, not stenography.

pshinghal 11y ago
Did you mean steganography?
- myhf 11y ago
  You can tunnel through stenography, but it's very slow.

kriro 11y ago

No JavaScript is also curious given their own React Native. Maybe they don't consider it "optimized for smartphones"? No SSL/TLS/HTTPS is just ridiculous and flat out unacceptable in this day and age. I'd expect a "no HTTP" clause and not the other way around. The linked technical guidelines from the original FB blogpost also seems to be dead: https://www.facebook.com/docs/internet-org/platform-technical-guidelines https://www.facebook.com/docs/internet-org/platform-technica...

blumkvist 11y ago
They don't consider it "optimized for featurephones".
1234567890123 11y ago
https://developers.facebook.com/docs/internet-org/platform-technical-guidelines https://developers.facebook.com/docs/internet-org/platform-t...

1234567890123 11y ago

They have explained the reason: [0] Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities. [0]: https://developers.facebook.com/docs/internet-org/platform-technical-guidelines https://developers.facebook.com/docs/internet-org/platform-t...

pjc50 11y ago

No Javascript is an even more ridiculous restriction.