Facebook's VPN Service Onavo Protect Collects Personal Data -- Even When It's Switched Off (medium.com) 67
Security researcher Will Strafach took a look at Onavo Protect, a newly released VPN service from Facebook: I found that Onavo Protect uses a Packet Tunnel Provider app extension, which should consistently run for as long as the VPN is connected, in order to periodically send the following data to Facebook (graph.facebook.com) as the user goes about their day:
When user's mobile device screen is turned on and turned off.
Total daily Wi-Fi data usage in bytes (Even when VPN is turned off).
Total daily cellular data usage in bytes (Even when VPN is turned off).
Periodic beacon containing an "uptime" to indicate how long the VPN has been connected.
When user's mobile device screen is turned on and turned off.
Total daily Wi-Fi data usage in bytes (Even when VPN is turned off).
Total daily cellular data usage in bytes (Even when VPN is turned off).
Periodic beacon containing an "uptime" to indicate how long the VPN has been connected.
Farcebook (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
After 25 May 2018 this would be "interesting" in the EU.
Re: (Score:2)
It gets worse by the day
Facebook needs to die. ASAP.
Is this supposed to be a joke? (Score:5, Insightful)
VPN from Facebook? Of course they're going to collect data!
I'd go as far as calling it a VFN instead, there's probably nothing private about it.
Re: (Score:2)
Re: (Score:3)
You've GOTTA trust your VPN. What choice is there? That said, pick a VPN you can trust. It might be worth that $40/yr not to pipe shit through FB.
Re: (Score:1)
Well consumer affairs should get involved. There is no P in private, if they get a tracable data back. Do not use the word private. use Shared (VSN) Group(VGN) or Compromised (VCN).
Pulling this trick is just as bad as VW - reality is not the same as advertised.
In the meantime can some clever soul modify the outgoing packets to say you have been conencted 56 hours in the past 4 hours and other bad numbers to thorougly mess up their reporting.
Re: (Score:2)
reality is not the same as advertised
That's a lesson I'm learning over and over again. Pretty sure this isn't the life I signed up for, but it looks like I'll be sticking with it. I was told there would be cake.
Re: (Score:2)
Oh man, stay away from the game Portal.
Re: (Score:2)
A couple things to consider. Not that I'm trying to defend facebook, i'm not. But:
1) No one should ever think that their VPN can't see their traffic. They can. But they can prevent outside observers from seeing your traffic. I can use a VPN to prevent comcast from keeping logs on me, or when at the coffee shop on their crappy open wifi so that the rest of the patrons can't see what I'm doing.
2) Even though we're thinking that this app is only for those of us in the West, their VPN COULD (and, I repeat, coul
Re: (Score:2)
2) Facebook, like any other com
Re:Of course it does (Score:4, Insightful)
What it boils down to is who is the paying customer. With FB, users are the product. Same with Google. This is why one uses a decent VPN, that you pay for, and where the VPN provider's reputation matters.
VPNs are a must have, just because ISPs and local endpoints do so many shenanigans.
Re: (Score:2)
VPNs are a must have, just because ISPs and local endpoints do so many shenanigans.
I agree. I'm sometimes accused of overusing mine. Unless I'm downloading something big (that I don't need to hide), I pipe everything on my home PC through Private Internet Access. Music streams fine; porn streams fine; no noticeable lag in normal browsing. Netflix & Youtube work fine with the VPN up, but if I'm using one of those I'm probably using my phone & Chromecast which avoids PIA. It just boils down to me trusting my VPN more than my ISP and suffering no consequences for gimping my connectio
And what did we expect it to do? (Score:2)
Clueless (Score:2)
Re: Clueless (Score:5, Insightful)
Re: Clueless (Score:4, Insightful)
With 100% open source, most people won't read it all. But a few will. That makes it tough to keep any dirty work under wraps. Look at this article. Facebook's VPN is closed source, but the packets it sends can't be hidden from a determined user. Does the average user packet sniff what it does? Of course not. But somebody does, and the cat's out of the bag.
Re: (Score:2)
But a few will.
No they won't. That has been proven time and time again. Long standing bugs have survived in critical projects for long periods of time. Major work was done to audit the code of something as important as encryption software and that software released 2 additional versions ceased existing and then forked by the time the first audit was done making the exercise futile.
You DON'T know what's in your software period. Even if the source code is available. People not only don't read it but there's no practical way
Re: (Score:2)
I would submit that there's a difference between subtle bugs (which the few people who read the source might not catch) and blatant Trojan behavior (which would stick out like a sore thumb).
Re: (Score:2)
Then you would be very wrong. There have been many documented cases of trojan behavior being very much identical to a subtle bug.
Do you not remember when this line got submitted to the Linux Kernel as a patch:
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
An = is all that separates a bug from a confirmed and purposeful back door to elevate user access.
Re: (Score:2)
People are clueless.
"“No one ever went broke underestimating the intelligence of the American public.” -- H. L. Mencken
It could be sending your photos to the FBI. It could be doing nothing at all.
The former head of the FBI ran a private FBI within the FBI to collect dirt on folks he wanted to . . . "influence".
By the time of his death Hoover’s scandalous private and personal files numbered in the thousands, including 883 senators, 722 congressmen, 12 Supreme Court judges and hundreds of celebrities.
When Zuckerberg becomes President of US, he won't need the help of the FBI . . . he will have all he needs from Facebook and their pals in privacy crime.
Stop using closed source software and you won't have these issues.
Try explaining that to people who are clueless . . . I gave up a long time ago. When I did try to explain that Facebook's business
Re: (Score:2)
That's not true. For instance, Alexa has a "stop listening" button. I have no access to the source. However, I can trivially see if Alexa is sending any data to the mothership while that setting is on. Now, it could cache the data to send, but IIRC, the amount of audio it can store is asserted to be under a minute. And that should be checkable by examining how much memory it has.
Raise your hand, (Score:1)
NEWSFLASH! (Score:3)
Facebook does Facebook things!
Film at eleven.
Are you surprised? (Score:1)
Tell me, who the hell is surprised by any of this?
Facebook exists to collect your data and monetize it. This was always about giving them as much information about you as possible.
Fuck Facebook, and fuck anybody who works for Facebook .. these people deserve the same treatment .. publish the name, address, banking information, name of children and spouses.
Let's see how these assholes like the surveillance society.
Facebook is a company of assholes.
Switched off != Powered off (Score:3)
That sort of shenanigan (and the desire to lower my electricity bill) is why I have a physical switch to remove the power to the devices I don't trust. That include PCs with wake-on-lan and shady BIOS code from Intel and whatnot.
With the power off, the only way for a device to phone home is to have its own battery and an internal 3G modem. Not impossible but not very likely, since sneaky manufacturers probably rely on people pushing the fake power-off button.
As for cellphones, since it's getting hard to find devices with removable batteries, I transport mine in a metal lunchbox. Yes I'm paranoid, but I'm proven right more and more everyday...
Re: (Score:2)
Shocking! (Score:3)
Facebook, known paragon of personal privacy, tracking you in a vpn?
Seriously, what dumbass was shocked by this? I would expect the only reason to use a facebook branded VPN would be so your information is collected.
Your Info Their Profit (Score:2)
It's a business, a business to make profit, off you....
So, go ahead and put that Amazon echo, Google Home or Nest in your house and feel complete secure nobody is listening to background sounds and determining what your doing and what can be so
And? (Score:2)
Sounds like perfectly normal metrics for a VPN software vendor to want to know about their device:
How long it gets used, If it is used in the background or foreground, and what percentage of user data travels via a metered connection. I'm really struggling to get upset about this even in the slightest.
Better Zuckerberg than Maduro (Score:2)
I live in Venezuela, and deployed this so called VPN a few days ago.
With it enabled, I can use sites/apps prohibited by the government (www.dolartoday.com) as well as sites/apps that became colateral damage of the censorship (Formula Live24 2018).
I dot use a VPN to access geo-restricted content, or to hide shaddy practices online. I use it just to access restricted sites from an oppresive regime, and to be safer when using public/free wifi in airports and coffee shops...
Facebook already knows a lot about me
Re: (Score:2)
If privacy is dead then you should upload naked pictures of yourself to facebook, you know, because what have you got to hide?
I would, but those are banned, so I pose with Speedos during my scuba diving trips. ;-)
Having said that, "Privacy is dead. Get over it!" is the name of a now famous talk, linked at the end of my post.
PS: I use speedos while scubadiving, because it makes it easier to get in/out of the wetsuit. The picture opportunities are an added bonus... ;-)
Well (Score:2)
Facebook app collects data from non-users (Score:2)
Even if you don't have an account, that effing "F" on your stock Android smartphone is scanning through your contact list etc, and sending info back to the mothership.
To re-purpose an old meme... only crAPPy crAPPy crAPPs crAPP on your privacy.