Facebook to Remove Onavo App from Apple Store

https://www.wsj.com/articles/facebook-to-remove-data-security-app-from-apple-store-1534975340

by mudil • 8 years ago

135 85 8 years ago

IBM• 8 years ago

The next step is to ban third party frameworks in apps for "analytics" or serving ads. That should be something intermediated and provided by Apple itself.

https://developer.apple.com/documentation/storekit/skadnetwo...

aaaaaaaaaab• 8 years ago

I would love that! Finally I could reject the marketing department’s requests to integrate “tracking framework n+1” without my manager threatening to fire me.

kyle-rb• 8 years ago

Yeah, Apple needs a monopoly on serving ads too.

scarface74• 8 years ago

After the iAd fiasco, I don’t think Apple wants to go anywhere near in app ads.

Rjevski3• 8 years ago

Given their commitment to user privacy so far, I'd trust them more than any other ad provider at the moment.

tombrossman• 8 years ago

Apple won't even warn you which apps are adware, which Google Play has transparently done for years, so there is room for improvement by everyone involved. Previous submission (which got zero interest): https://news.ycombinator.com/item?id=17489987

neurotech12• 8 years ago

non-paywall: http://archive.is/dA1vk

politician• 8 years ago

"Error 1001 DNS resolution error

What happened? You've requested a page on a website (archive.is) that is on the Cloudflare network. Cloudflare is currently unable to resolve your requested domain (archive.is)."

Domain blocked?

neurotech12• 8 years ago

worked fine for me. CloudFlare can sometimes have issues contacting the webservers.

toomuchtodo• 8 years ago

Archive.is blocks DNS lookups from Cloudflare’s public resolver.

Edit: No idea why, just sharing context I have.

happybuy3• 8 years ago

This is malware and should have been rejected from the App Store months (if not years ago). Better late than never.

I'm sure if it was a smaller company doing a similar thing they wouldn't have been given such leeway as Facebook was for so long.

meritt• 8 years ago

Eh, I dunno. My Data Manager [1] (owned by Mobidia / App Annie) is still going strong. It along with other VPN-based apps are a major source of user-level app usage and engagement data being sold to large corporations and investors. In-app analytics libraries are another source (which are heavily fragmented since they only can track apps they're packaged with) but it's going to be a lot more difficult for Apple to regulate those.

Until Apple starts banning all of these types of apps and libraries (which their recently updated policies indicate they just might [2]), I view this as more of a strategic play against Facebook as opposed to in the best interest of users.

[1] https://itunes.apple.com/us/app/my-data-manager-track-your/i...

[2] http://www.integrity-research.com/new-apple-policies-threate...

happybuy3• 8 years ago

Apple quickly and efficiently banned all VPN-based ad blocking apps as they do not follow allowed uses of the VPN apis as per App Store guidelines.

VPN-based data collection apps could just as easily be cleaned up if there was the will to do so.

jamiequint• 8 years ago

"Malware: software that is intended to damage or disable computers and computer systems."

It's hardly malware. Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not.

happybuy3• 8 years ago

Perhaps spyware is the more accurate term.

Even if it is clear in the app description that it is collecting data from users, I don't believe that the extent or consequences of such data collection would be considered or understood by the majority of its users.

It's a spyware product, wrapped up as a VPN, relying upon lack of attention from users to succeed.

lawnchair_larry2• 8 years ago

The first problem with this claim is that no users exercised any right to trade access to their data for free compression. This was a trojan horse. That's malware.

ernesth• 8 years ago

Where is this definition coming from?

Merriam-Webster says "software designed to interfere with a computer's normal functioning". Wiktionary: "Software which has been designed to operate in a malicious, undesirable manner". Etymologically, it means software that is malevolent.

This app collects data in a malevolent/undesirable way. It clearly tries to interfere with the personal data of the user and hence the intended functioning of the computer. Hence a malware.

AlexandrB2• 8 years ago

Users should have the right to trade access to their data for free data compression, whether you personally think that's a good idea or not.

This is utter nonsense. How many users are making an informed decision here? How many understand what their data may be used for or how it may affect their insurance, employment, or housing prospects in the future?

There's a reason some contracts are not legal/enforceable (slavery for example).

lazzlazzlazz• 8 years ago

I understand people say things like this because they're the edgy, hot take - but the Onavo VPN software is absolutely not malware. It's a performant, free VPN that people use in exchange for some anonymized data. There have been no known leaks or breaches.

binomialxenon2• 8 years ago

It's obviously in exchange for data, but I'm skeptical of how anonymised it is, given that FB has made a business of tracking everyone on the web as much as possible.

pvg• 8 years ago

The data is not anonymized, they say they may share anonymized data with partners. Malware is too strong but if you read the product description and FAQ, it's deliberately deceptive. Lieware? Slimeware?

mirimir5• 8 years ago

From Apple's App Store Review Guidelines:[0]

2.5.14 Apps must request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity. This includes any use of the device camera, microphone, or other user inputs.

So did Onavo "provide a clear visual indication" whenever collecting data? Somehow I doubt that, because it would have been a constant warning.

0) https://developer.apple.com/app-store/review/guidelines/

SmellyGeekBoy6• 8 years ago

anonymized

Do you have any proof of this?

matz13• 8 years ago

I used this app before, how is this a malware ?

bhouston2• 8 years ago

It sends anonymized data of every website on the internet, when you access it, and it also monitors the apps you use (probably because it intercepts their web traffic.) So basically Facebook knows what you do.

lacker2• 8 years ago

FYI, it was a smaller company doing this in the first place. Facebook didn't change what the app was fundamentally doing after they acquired the company.

insaneirish• 8 years ago

And why do you think they acquired them?

_bxg1• 8 years ago

Non-paywall coverage on The Verge: https://www.theverge.com/2018/8/22/17771298/facebook-onavo-p...

"Onavo, which began as an Israeli analytics startup focused on helping users monitor their data usage, was acquired by Facebook in 2013. Its VPN provider then became a data collection tool for Facebook to monitor smartphone users’ behavior outside its core apps, helping inform Facebook’s live video strategy, competition from other social apps, and its decision to acquire companies including WhatsApp."

Geez, man. That is evil. Especially since most users don't know the difference between "security" and "privacy", and probably assume that it would have the exact opposite effect.

mirimir5• 8 years ago

There ought to be civil and criminal penalties for stuff like this. I mean, this is basically malware.

Edit: Just how is this distinguishable from the Sony or HB Gary hacks? Not as much data was taken, it's true. But there were far more victims. And I doubt that there was adequate disclosure.

Edit: OK, spyware. And people have been prosecuted over spyware.

cjhopman2• 8 years ago

Oh please. The description in the app stores is pretty clear about this behavior (https://play.google.com/store/apps/details?id=com.onavo.spac...):

"As part of providing these features, Onavo may collect your mobile data traffic. This helps us improve and operate the Onavo service by analyzing your use of websites, apps and data. Because we're part of Facebook, we also use this info to improve Facebook products and services, gain insights into the products and services people value, and build better experiences."

Running a VPN isn't particularly cheap. I'd assume that any free VPN is one of:

  1. criminals collecting and monetizing your information
  2. state actors collecting and ?????????? your information
  3. companies collecting and monetizing your information
  4. too small to need to do one of (1)-(3)

cjhopman2• 8 years ago

Geez, man. You represent it like Onavo wasn't collecting that user data and selling it to any random company before Facebook bought them:

https://techcrunch.com/2013/02/08/onavo-insights/

hegz• 8 years ago

Why post a paywall link?

logicallee• 8 years ago

This might be kind of ironic (you'll see what I mean) but to get to full wsj.com articles just put the word "full" before wsj, keeping the rest of the URL the same.

For this article that means go to

https://www.fullwsj.com/articles/facebook-to-remove-data-sec...

(I just copied and pasted our post link then added "full" before wsj.com)

dang• 8 years ago

If there's a workaround, it's ok. Users usually post workarounds in the thread, as people did in this case.

This is in the FAQ at https://news.ycombinator.com/newsfaq.html and there's more explanation here:

https://news.ycombinator.com/item?id=10178989

https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

etaioinshrdlu• 8 years ago

Related: Sensor Tower puts out several free VPN products and sells the analytics observed.

bhouston2• 8 years ago

Do all VPN companies sell their traffic to others? I think that is now probably assumed to be the case.

binomialxenon2• 8 years ago

All gratis VPNs, for sure. I'd figure that paid VPNs would probably vary on that count.

mirimir5• 8 years ago

Many ISPs and telecom providers certainly do. Some were even selling geolocation data. So arguably you must use VPNs and/or Tor for privacy.

icelancer• 8 years ago

It's turtles all the way down.

Rjevski3• 8 years ago

Many ISPs and telecom providers certainly do

Do you have a list of them or source for this claim? (not that I'm disagreeing with you, but just want to see the full extent of the problem)

SmellyGeekBoy6• 8 years ago

My ISP / telecom provider (in my case they're the same company) is a legitimate corporation registered in my home country, against whom I can seek legal recourse if my data is misused. That's more than I can say about most VPN providers.

seibelj• 8 years ago

I know exactly how this software works because I have analyzed it deeply. Every packet that goes through the Onavo VPN is analyzed. Using API's available to a normal sandboxed app, the source port is mapped with the process ID, then mapped to the package identifier, and then Facebook knows how much data is being used by which apps. Until SSL was mandatory for apps, they could also analyze the data itself, but that was stopped a couple years ago on iOS.

Once Facebook has all the packets, they can do various analyses and machine learning to even learn which features are most popular within a competitor's app. It is quite sophisticated.

floatingatoll• 8 years ago

Does it have logic to inhibit packet analysis when being tested by Apple App Store reviewers?

gumby• 8 years ago

You're thinking of Volkswagon's VPN app.

willstrafach2• 8 years ago

No, it does not.

willstrafach2• 8 years ago

Using API's available to a normal sandboxed app, the source port is mapped with the process ID, then mapped to the package identifier, and then Facebook knows how much data is being used by which apps.

This is just not true at all. Where are you getting this information?

They do not do any sort of analysis on the device side as that is not possible. They connect your device to a VPN server (All analysis is conducted there). The APIs you describe can not be accessed from within the App Store sandbox, I believe as of iOS 8 that became no longer possible.

Here are technical details on the local functions of the app:

https://medium.com/@chronic_9612/notes-on-analytics-and-trac...

BlissfulRear• 8 years ago

If it were impossible to perform some analysis on device, how are apps like https://itunes.apple.com/us/app/my-data-manager-track-your/i... attributing data to apps?

aylmao2• 8 years ago

I really hope Apple pulls through with a thorough research of other free VPN apps on the App Store and cracks down on other sketchy ones too. I doubt that Onavo users will be inclined to pay for a VPN, and I suspect they instead will look for other free alternatives.

Onavo didn't have to make money because it was owned by Facebook and it was known to collect data for its parent company's market research. Much less is known about how other VPN apps remain sustainable-- I wouldn't doubt some might be running on sketchy business models.

paulpauper• 8 years ago

Censorship and privacy concerns have ironically created a market for malware-laden and snooping VPNs to prey on unsuspecting users. the cure is worse than the disease

908087• 8 years ago

This isn't what I'd call "the cure", though. This is the "privacy" equivalent of those bullshit cancer "cures" that prey on poorly informed or desperate people.

djrogers• 8 years ago

Facebook Inc. pulled its data-security app

Calling this a ‘data security app’ is like calling a Snickers bar a diet meal replacement.

This app literally gives facebook the ability to track every app you runs and every website you visit, for how long, when, and what network you do it from.

It is literally the kind of data collection that people use VPNs to avoid!

eric_h2• 8 years ago

It is literally the kind of data collection that people use VPNs to avoid!

I have a feeling that a majority of VPN app users use them with the intent of preventing a specific party from collecting that data (e.g. an employer or a government).

inlined• 8 years ago

There's also a lot of people who use VPNs to keep their browsing private while they're on a broadly accessible wifi

sigjuice2• 8 years ago

Why are there a million VPN apps and protocols with pointless variations? Why isn’t the VPN software included in my operating system enough? e.g. Settings/General/VPN on iOS. macOS and Windows have something similar.

EDIT: This was an honest question. If anyone has any insights to share, I would really appreciate it. Over the years, I have dealt with some truly questionable third-party VPN software from the usual big name networking equipment vendors and plenty of other so called “security” vendors.

r3bl• 8 years ago

Because VPN is a service, not a piece of software.

You're paying third parties for the service, and those third parties use the money to maintain the infrastructure powerful enough for each user to have high speed VPN service (nobody's gonna use a VPN that throttles the speed by 90%) across different geographical regions.

If Microsoft and Apple wanted to offer a VPN as a first-party service out of the box, they would be forced to maintain a pretty complex infrastructure across multiple regions and somehow be able to support way more traffic than any third party VPN provider (because of their name). So, where's the money for the infrastructure going to come from?

In Facebook's case, form mining the data. I would argue that Apple isn't stupid enough to attempt something like that, and as for Google, they already do have a first-party VPN integrated into Android[0].

I would argue that the reason that third-party VPNs are shady is because they need a large infrastructure in place before they can offer the service. Once they do have the infrastructure in place, they're not making profit, but covering their losses, while at the same time being forced to scale even further.

[0] On Nexus/Pixel devices from certain regions that activates automatically when connected to an insecure WiFi: https://www.howtogeek.com/275474/how-to-use-androids-wi-fi-a...

sigjuice2• 8 years ago

You are confusing service with software. All major operating systems have built-in VPN support. Check the network settings on your phone or computer. There will be a section for VPN settings.

SmellyGeekBoy6• 8 years ago

I suggest you read up on how VPNs actually work. You're just tunnelling traffic through someone else's connection. A VPN app included in your OS would relay all of your internet traffic through whoever wrote the OS (unless they partnered up with another provider, I guess).

I'll give Apple the benefit of the doubt but I'm not sure I'd be keen on this kind of setup in the case of Google or Microsoft. Then again, they have access to all of your browsing data anyway via the OS so what's to lose?

opencl• 8 years ago

Why would OS built in support go through the OS vendor's servers? It's exactly like every other network service built into the OS. Android and Windows at least both have built in VPN support and you just type in the server details of whoever your VPN provider is.

computerfriend• 8 years ago

Your OS probably only supports IPSec, etc., because of kernel support. OpenVPN is a third-party application.

lazerwalker• 8 years ago

I feel really conflicted about this.

On the one hand, there's a clear value proposition here: instead of paying a few bucks a month for a VPN, you can instead pay by giving a giant megacompany your private data.

The problem is we as a culture don't have a good consent model for educating people about what this actually means. In a world where everyone who used Onavo knew exactly what data Facebook was getting from them, and what that meant, what number of users would willingly use it?

Calling it "malware" or "spyware" doesn't feel accurate, since they're not outright lying about what the value prop is, but they're still being deceitful by omission and are preying on people's ignorance.

SmellyGeekBoy6• 8 years ago

A lot of the bundled type of spyware I've seen relies on users clicking "I Agree" on an EULA. The problem is nobody reads the EULA, they just want whatever software it's attached to as quickly as possible.

I suppose my point being that just because users "agreed" to something doesn't necessarily mean they knew what they were agreeing to at the time.

Facebook to Remove Onavo App from Apple Store

Related Stories