this post was submitted on 27 Mar 2024
817 points (99.0% liked)

Technology

57501 readers
3450 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Meta tried to gain a competitive advantage over its competitors, including Snapchat and later Amazon and YouTube, by analyzing the network traffic of how its users were interacting with Meta’s competitors. Given these apps’ use of encryption, Facebook needed to develop special technology to get around it.

Facebook’s engineers solution was to use Onavo, a VPN-like service that Facebook acquired in 2013. In 2019, Facebook shut down Onavo after a TechCrunch investigation revealed that Facebook had been secretly paying teenagers to use Onavo so the company could access all of their web activity.

After Zuckerberg’s email, the Onavo team took on the project and a month later proposed a solution: so-called kits that can be installed on iOS and Android that intercept traffic for specific subdomains, “allowing us to read what would otherwise be encrypted traffic so we can measure in-app usage,” read an email from July 2016. “This is a ‘man-in-the-middle’ approach.”

A man-in-the-middle attack — nowadays also called adversary-in-the-middle — is an attack where hackers intercept internet traffic flowing from one device to another over a network. When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 211 points 5 months ago (31 children)

And people want to let these parasites integrate into the fediverse

[–] [email protected] 8 points 5 months ago (1 children)

honest question: why does it matter? all data in any fediverse project is public anyways

[–] [email protected] 20 points 5 months ago* (last edited 5 months ago) (1 children)

For me it's not really about the data, it's unforseen malicious maneuvers outside data. Sabotaging instances, manipulating feeds for their gain, or try to still centralize the fediverse undermining the whole concept. My point is, we don't know what bad thing they could/would do, they are creative. But we sure as fuck know it's an evil organization and they can't be trusted.

load more comments (1 replies)
load more comments (30 replies)
[–] [email protected] 104 points 5 months ago (4 children)

This is blatantly circumventing encryption and a violation of the DMCA but lets see the DoJ do fuck all about it.

Right, Biden? Facebook, Good, Tiktok, bad?

[–] gravitas_deficiency 56 points 5 months ago (8 children)

Two things can be bad at once.

What Meta did/is doing here is unbelievably shitty (but not that shocking).

That in no way diminishes the incredibly serious implications of TikTok being wholly owned and operated by a PRC-based company, which comes with the implicit but very real and crucial caveat of the CCP will tell you to do just quietly things with your company sometimes, and if you don’t do it, you go to jail indefinitely.

[–] [email protected] 19 points 5 months ago (2 children)

But then it just comes off hypocritical and disingenuous if you selectively apply pressure. Then it just looks like you're trying to give a competitive edge to US evil social media and preventing youth from learning about the situation in Palestine.

[–] [email protected] 6 points 5 months ago* (last edited 5 months ago)

Then it just looks like you're trying to give a competitive edge to US evil social media.

This is not just probable but certain; the whole thing is a very long way of saying this. In a world where the US worked for its citizens, this is a national security no-brainer. But we don't live in a world where the spirit of things is followed when you can enrich yourself skirting the letter. Shit sucks, but this not a secret conspiracy; it's realpolitik.

and preventing youth from learning about the situation in Palestine.

This one is more subjective...and also still probable for the same fucking reasons and good luck sharing the fact that you can act in a so called 'security' driven purpose and this is the perfect time to do sneaky shit. As if all of History wasn't rife with examples with the Patriot Act being the first USA centric coming to mind amongst fuck what, hundreds?

That is also realpolitik, and all the players know it. Shit sucks.

load more comments (1 replies)
load more comments (7 replies)
[–] [email protected] 19 points 5 months ago (1 children)
load more comments (1 replies)
[–] lurch 7 points 5 months ago (2 children)

While I agree Facebook is also bad, the Tiktok thing is entirely different, because the legal issue is sending Amarican citizens data out to China, which the users agreed to give to Tiktok, but the government doesn't want to be sent to China. The Facebook crime is secretly snooping without proper user consent.

load more comments (2 replies)
[–] [email protected] 4 points 5 months ago (1 children)

I definitely see why this would be illegal, but how would the DMCA apply?

[–] [email protected] 32 points 5 months ago (23 children)

It's illegal to bypass encryption for the purpose of breaking DRM, which is what the app specifically does with Snapchats DRM.

https://www.dmlp.org/legal-guide/circumventing-copyright-controls

load more comments (23 replies)
[–] [email protected] 82 points 5 months ago (2 children)

Let that parasite rot in prison.

And can somebody split Meta already? Please and thank you.

[–] [email protected] 7 points 5 months ago

Why split Meta? The poor mom and pop shop only makes 350 million in revenue... Every day..

[–] [email protected] 6 points 5 months ago

Yeah, he wont

[–] [email protected] 37 points 5 months ago

Shocked, I tell you

[–] [email protected] 36 points 5 months ago (1 children)

I was thinking of buying a Meta Quest 3, because of a lack of similar devices. I wasn't really seriously considering it, but I sure as hell am not at all now.

load more comments (1 replies)
[–] [email protected] 27 points 5 months ago

What a fucking piece of shit.

[–] [email protected] 22 points 5 months ago (5 children)

I'm sure corporations like this would give you free Internet if they could collect and sell all your data. I'm also sure people would still do it, regardless of how much they are being monetized as a product.

Since companies like Facebook own legislators, our only real choice is to stop using it. Unpopular opinion, but If you really want fuck Zuck, delete your account, and get all your friends and family to as well. Maybe there's some alternatives for the people who truly use the service to connect with friends/family?

[–] [email protected] 25 points 5 months ago

corporations like this would give you free Internet if they could collect and sell all your data

Facebook Zero is more or less what you described.

[–] [email protected] 8 points 5 months ago (3 children)

The free Internet if you give use your data is already a thing. I saw an ad in germany where you get unlimited free internet access (can't remember if it was a data plan for phones or cable / fibre service) if you use their "payment partner" for your usual payments like rent, loans and salary. So they basically can see your daily payments and will use and sell this data im exchange for "free" Internet access.

The company and its investors and corporation lead to a weird network of people and a corp in dubai. It's all quite shady really.

load more comments (3 replies)
load more comments (3 replies)
[–] [email protected] 22 points 5 months ago (2 children)

Delete this shit from your phones asap

Zuck Fuckerberg

[–] [email protected] 11 points 5 months ago

Can’t delete something that was never there in the first place

load more comments (1 replies)
[–] [email protected] 21 points 5 months ago (1 children)

Every 60 seconds in Africa, a minute passes.

[–] [email protected] 16 points 5 months ago

And this fact is more surprising than Meta spying on people

[–] [email protected] 19 points 5 months ago* (last edited 5 months ago) (1 children)

I must be way out of the loop, cuz I had no idea this was possible. So does this mean the Facebook app on my phone has permission to view all of my network traffic? Why do Android and iOS allow this? Shouldn't that be a special permission that can only be granted explicitly?

[–] [email protected] 14 points 5 months ago (1 children)

Nope, because Facebook app is not a VPN service so it cannot intercept traffic.

What it is unclear from the article is how they circumvented the certificate check on the app side. Probably (given this was many years ago, maybe these apps weren't setupping certificate pinning/HPKP)

load more comments (1 replies)
[–] [email protected] 16 points 5 months ago

The world would be a better place if Mark Zuckerberg accidentally got sucked into a jetski engine somehow

[–] [email protected] 14 points 5 months ago (2 children)

Learning: VPN services are tracking instruments, not some magic tool.

And its not even new...

load more comments (2 replies)
[–] [email protected] 13 points 5 months ago

Certainly they weren’t planning on actually planning on finding a way to get people to install a VPN to decrypt their traffic just to use Facebook, right?

That’s why they paid teenagers to use the VPN so they could get some “guerrilla market research”.

Even in 2013 apps didn’t have the permission access to install a device level VPN without some unspecified exploit. 0 chance Facebook would literally hack people’s phones, right?

Right?

[–] [email protected] 13 points 5 months ago

Lock that turd up already

[–] [email protected] 10 points 5 months ago (2 children)

Wait, how does a VPN break TLS encryption?

[–] [email protected] 16 points 5 months ago (1 children)

The VPN adds its own root certs to the device, and just terminates TLS at the gateway, then establishes a second TLS tunnel to the device.

[–] [email protected] 5 points 5 months ago (1 children)

It can't do that silently, the user has to approve installation of root certs. This only works silently with apps which have broken (insecure) cert validation

load more comments (1 replies)
[–] [email protected] 5 points 5 months ago (1 children)

it doesn’t, what this is suggesting is the vpn was routing traffic through it so they could analyze snapchat traffic. not the contents of it but essentially meta analysis of the traffic. how often it was sending data, how much data, where it was going etc.

load more comments (1 replies)
[–] [email protected] 5 points 5 months ago

This is the best summary I could come up with:


In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers.

On Tuesday, a federal court in California released new documents discovered as part of the class action lawsuit between consumers and Meta, Facebook’s parent company.

“Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them,” Meta chief executive Mark Zuckerberg wrote in an email dated June 9, 2016, which was published as part of the lawsuit.

When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.

This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet.

“We now have the capability to measure detailed in-app activity” from “parsing snapchat [sic] analytics collected from incentivized participants in Onavo’s research program,” read another email.


The original article contains 671 words, the summary contains 175 words. Saved 74%. I'm a bot and I'm open source!

load more comments
view more: next ›