I’m not sure if this fully fits into TechTakes mission statement, but “CEO thinks it’s a-okay to abuse certificate trust to sell data to advertisers” is, in my opinion, a great snapshot of what brain worms live inside those people’s heads.
In short, Facebook wiretapped Snapchat by sending data through their VPN company, Onavo. Installing it on your machine would add their certificates as trusted. Onavo would then intercept all communication to Snapchat and pretend the connection is TLS-secure by forging a Snapchat certificate and signing it with its own.
“Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted, we have no analytics about them,” Facebook CEO Mark Zuckerberg wrote in a 2016 email to Javier Olivan.
“Given how quickly they’re growing, it seems important to figure out a new way to get reliable analytics about them,” Zuckerberg continued. “Perhaps we need to do panels or write custom software. You should figure out how to do this.”
Zuckerberg ordered his engineers to “think outside the box” to break TLS encryption in a way that would allow them to quietly sell data to advertisers.
I’m sure the brave programmers that came up with and implemented this nonsense were very proud of their service. Jesus fucking cinammon crunch Christ.
So are we on the precipice of the worlds largest lawsuit from Snap or do they have an interest in letting this slide?
The Onavo app used by FB to MitM traffic is just a VPN, as long as FB can reasonably argue it was installed by users willingly they should be in the clear.