A secret program called "Project Ghostbusters" saw Facebook devise a way to intercept and decrypt the encrypted network traffic of Snapchat users to study their behavior.
Facebook achieved their MITM attack by selling a VPN with spyware in it.
And so you have to wonder: who in his right mind would buy a VPN service from effing Facebook of all companies? It's like asking the KKK to do the catering at your bar mitzvah: if you have a problem with the service, you kind of asked for it.
Why the hell do they even let them operate anymore? Spying on people. That's one of the most illegal things you can fucking do to a person, save bodily harm. Even law enforcement needs a damn permit for it.
The project was part of the company’s In-App Action Panel (IAPP) program, which used a technique for “intercepting and decrypting” encrypted app traffic from users of Snapchat, and later from users of YouTube and Amazon, the consumers’ lawyers wrote in the document.
Looks like they didn't decrypt anything, just used MitM spyware.
In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers.
On Tuesday, a federal court in California released new documents discovered as part of the class action lawsuit between consumers and Meta, Facebook’s parent company.
“Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them,” Meta chief executive Mark Zuckerberg wrote in an email dated June 9, 2016, which was published as part of the lawsuit.
When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.
This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet.
“We now have the capability to measure detailed in-app activity” from “parsing snapchat [sic] analytics collected from incentivized participants in Onavo’s research program,” read another email.
The original article contains 671 words, the summary contains 175 words. Saved 74%. I'm a bot and I'm open source!
It's a proprietary platform .... what do people expect?
It's visiting someone's business and you are in their property and you are watching TV on their TV set. You are reading newspapers and books that are on their property. And everyone acts surprised when the property owner keeps track of what you watched and what you read on their property.
You have no rights to do anything on their property .... other than the rights they give you, which they can also take away, or just kick you out.
I'm concerned that the narrative that what Facebook was trying to achieve here was wrong or bad is itself user-hostile, and pushes in favor of the non-fiduciary model of software.
Facebook paid people to let them have access to those people's communications with Snap, Inc., via Snapchat's app. This is so that Facebook could do their analytics magic and try and work out how often Snapchat users tend to do X, Y, or Z. Did they pay enough? Who knows. Would you take the deal? Maybe not. Was this a totally free choice without any influence from the creeping specter of capitalist immiseration? Of course not. But it's not some unusually nefarious plot when a person decides to let a company watch them do stuff! Privacy isn't about never being allowed to reveal what you are up to. Some people like to fill out those little surveys they get in the mail.
Now, framing this as Facebook snooping on Snapchat's data concedes that a person's communications from their Snapchat app to Snapchat HQ are Snapchat's data. Not that person's data, to do with as they please. If the user interferes with the normal operation of one app at the suggestion of someone who runs a different app, this framing would see that as two apps having a fight, with user agency nowhere to be found. I think it is important to see this as a user making a choice about what their system is going to do. Snapchat on your phone is entirely your domain; none of it belongs to Snap, Inc. If you want to convince it to send all your Snapchat messages to the TV in Zuckerberg's seventh bathroom in exchange for his toenail clippings, that's your $DEITY-given right.
User agency is under threat already, and we should not write it away just to try and make Facebook look bad.
How many times is Facebook going to be caught doing this kind of shit before some real action is taken? They clearly can’t be trusted. Let’s add them to the same TikTok ban at this point.