Facebook's VPN Service Onavo Protect Collects Personal Data -- Even When It's Switched Off (medium.com)

Security researcher Will Strafach took a look at Onavo Protect, a newly released VPN service from Facebook: I found that Onavo Protect uses a Packet Tunnel Provider app extension, which should consistently run for as long as the VPN is connected, in order to periodically send the following data to Facebook (graph.facebook.com) as the user goes about their day:
When user's mobile device screen is turned on and turned off.
Total daily Wi-Fi data usage in bytes (Even when VPN is turned off).
Total daily cellular data usage in bytes (Even when VPN is turned off).
Periodic beacon containing an "uptime" to indicate how long the VPN has been connected.

Comments

Farcebook

[Anonymous Coward]

It gets worse by the day

Re:Farcebook

[Z00L00K]

After 25 May 2018 this would be "interesting" in the EU.

Re:Farcebook

[Maritz]

It gets worse by the day

Facebook needs to die. ASAP.

Re:Farcebook

[Maritz]

This is really hilarious. You're a very funny person. Ha, ha, ha.

Is this supposed to be a joke?

[DontBeAMoran]

VPN from Facebook? Of course they're going to collect data!

I'd go as far as calling it a VFN instead, there's probably nothing private about it.

Re:Is this supposed to be a joke?

[gnick]

You've GOTTA trust your VPN. What choice is there? That said, pick a VPN you can trust. It might be worth that $40/yr not to pipe shit through FB.

Re:Is this supposed to be a joke?

[Anonymous Coward]

Well consumer affairs should get involved. There is no P in private, if they get a tracable data back. Do not use the word private. use Shared (VSN) Group(VGN) or Compromised (VCN).
Pulling this trick is just as bad as VW - reality is not the same as advertised.

In the meantime can some clever soul modify the outgoing packets to say you have been conencted 56 hours in the past 4 hours and other bad numbers to thorougly mess up their reporting.

Re:Is this supposed to be a joke?

[gnick]

reality is not the same as advertised

That's a lesson I'm learning over and over again. Pretty sure this isn't the life I signed up for, but it looks like I'll be sticking with it. I was told there would be cake.

Re:Is this supposed to be a joke?

[um... Lucas]

A couple things to consider. Not that I'm trying to defend facebook, i'm not. But:

1) No one should ever think that their VPN can't see their traffic. They can. But they can prevent outside observers from seeing your traffic. I can use a VPN to prevent comcast from keeping logs on me, or when at the coffee shop on their crappy open wifi so that the rest of the patrons can't see what I'm doing.

2) Even though we're thinking that this app is only for those of us in the West, their VPN COULD (and, I repeat, could - not will) provide a way for people in more locked down countries to access the rest of the web. But that's only if Facebook actually keeps their VPN logs from the authorities.

Whether they would say "Hey, we're Facebook China, you can't demand that we provide logs from Onavo Protect, which is governed by the laws of California" - that's a different story.

But anyone in the Europe, their VPN is a downgrade. Anyone in the US, it's probably negligible. But people in more locked down countries could see benefit, but only if FB is offering it to provide them a benefit and not just try to vacuum up even more info.

Re:Is this supposed to be a joke?

[DontBeAMoran]

I was told there would be cake.

Oh man, stay away from the game Portal.

Re:Is this supposed to be a joke?

[morethanapapercert]

Maybe we can all start referring to it as the onnahole service? (we the users being the thing that gets fucked, rather than the person doing the fucking) It seems pretty obvious that this, like pretty much everything Facebook does, is designed from the ground up as a privacy raping source of ad revenue.

Re:Is this supposed to be a joke?

[morethanapapercert]

1) I believe that a *reputable* VPN service would encrypt everything over their network so that while they can tell where you are browsing to, even they can't tell what you're doing once there. With current state of the art, only onion routing gives any real measure of privacy and even then, only if you stay in the network. As far as I know, given control of enough exit nodes and the ability to capture traffic at the ISP you can tie exiting traffic to specific users/machines.

2) Facebook, like any other company, must and will turn over logs when required to by legal authorities. Where they operate in locked down countries, like China, failure to do so would only result in that application getting red-flagged in the great firewalls those countries filter all traffic through. In addition, the nation can and would seize any assets held in that country. How can a VPN like Facebooks "onnahole" operate if all connections are blocked at the national firewall, any one attempting to use it are automatically flagged for investigation and any and all Chinese Facebook assets are confiscated? Of greater concern would be when Facebook is pro-actively sharing traffic of interest with the relevant authorities. We've all seen the news stories about various major players on the Internet including backdoors and secret access to user traffic without even the flimsy excuse of a national security letter. Cooperating with authorities in a legal investigation is one thing, actively acting as a informer in advance of any investigation is another.

The only way I can someone to maintain browsing privacy would be to use an onion/garlic routing service like Tor or I2P and even then, only as long as the exit node (which the user can't choose) isn't in his or own country. But that leads to the problems of a) Such traffic is easy to detect at the ISP level, leading to possible investigation by authorities and b) such services are closely associated with straight up criminal behaviour like drugs, guns, stolen credit cards and child porn. That association with criminal activities means someone would have to hide possession of the application even from friends and family, lest they be branded a paedophile or drug dealer.

And what did we expect it to do?

[Maelwryth]

This is, after all, a company based on selling users meta-data in various forms. VPN's were a threat to that collection.

Clueless

[110010001000]

People are clueless. They don't get it: unless you have the applications source code you have NO IDEA what the software is doing. It could be sending your credit card number to hackers. It could be sending your photos to the FBI. It could be doing nothing at all. Stop using closed source software and you won't have these issues.

Re: Clueless

[Maelwryth]

Even with 100% open source people wouldn't read it all. People don't even read privacy policies or EULA's. What we need is either ethics in business or laws to deal with it. I prefer laws.

Re: Clueless

[Chris Mattern]

With 100% open source, most people won't read it all. But a few will. That makes it tough to keep any dirty work under wraps. Look at this article. Facebook's VPN is closed source, but the packets it sends can't be hidden from a determined user. Does the average user packet sniff what it does? Of course not. But somebody does, and the cat's out of the bag.

Re:Clueless

[PolygamousRanchKid]

People are clueless.

"“No one ever went broke underestimating the intelligence of the American public.” -- H. L. Mencken

It could be sending your photos to the FBI. It could be doing nothing at all.

The former head of the FBI ran a private FBI within the FBI to collect dirt on folks he wanted to . . . "influence".

By the time of his death Hoover’s scandalous private and personal files numbered in the thousands, including 883 senators, 722 congressmen, 12 Supreme Court judges and hundreds of celebrities.

When Zuckerberg becomes President of US, he won't need the help of the FBI . . . he will have all he needs from Facebook and their pals in privacy crime.

Stop using closed source software and you won't have these issues.

Try explaining that to people who are clueless . . . I gave up a long time ago. When I did try to explain that Facebook's business model was selling their data . . . I got the answer, "Oh, look! Facebook! Ponies!"

Re: Clueless

[thegarbz]

But a few will.

No they won't. That has been proven time and time again. Long standing bugs have survived in critical projects for long periods of time. Major work was done to audit the code of something as important as encryption software and that software released 2 additional versions ceased existing and then forked by the time the first audit was done making the exercise futile.

You DON'T know what's in your software period. Even if the source code is available. People not only don't read it but there's no practical way of verifying distributed binaries are even related to the published source.

Re: Clueless

[Chris Mattern]

I would submit that there's a difference between subtle bugs (which the few people who read the source might not catch) and blatant Trojan behavior (which would stick out like a sore thumb).

Re: Clueless

[thegarbz]

Then you would be very wrong. There have been many documented cases of trojan behavior being very much identical to a subtle bug.

Do you not remember when this line got submitted to the Linux Kernel as a patch:

if ((options == (__WCLONE|__WALL)) && (current->uid = 0))

An = is all that separates a bug from a confirmed and purposeful back door to elevate user access.

Re:Clueless

[Actually, I do RTFA]

They don't get it: unless you have the applications source code you have NO IDEA what the software is doing.

That's not true. For instance, Alexa has a "stop listening" button. I have no access to the source. However, I can trivially see if Alexa is sending any data to the mothership while that setting is on. Now, it could cache the data to send, but IIRC, the amount of audio it can store is asserted to be under a minute. And that should be checkable by examining how much memory it has.

Raise your hand,

[ReneR]

if you thought a VPN from Facebook would be a good idea, what were they expecting? And who the heck would want to ever use this? FB employees?

NEWSFLASH!

[Qbertino]

Facebook does Facebook things!

Film at eleven.

Are you surprised?

[Anonymous Coward]

Tell me, who the hell is surprised by any of this?

Facebook exists to collect your data and monetize it. This was always about giving them as much information about you as possible.

Fuck Facebook, and fuck anybody who works for Facebook .. these people deserve the same treatment .. publish the name, address, banking information, name of children and spouses.

Let's see how these assholes like the surveillance society.

Facebook is a company of assholes.

Switched off != Powered off

[Rosco P. Coltrane]

That sort of shenanigan (and the desire to lower my electricity bill) is why I have a physical switch to remove the power to the devices I don't trust. That include PCs with wake-on-lan and shady BIOS code from Intel and whatnot.

With the power off, the only way for a device to phone home is to have its own battery and an internal 3G modem. Not impossible but not very likely, since sneaky manufacturers probably rely on people pushing the fake power-off button.

As for cellphones, since it's getting hard to find devices with removable batteries, I transport mine in a metal lunchbox. Yes I'm paranoid, but I'm proven right more and more everyday...

Quit FB

[DigiShaman]

I quit FB a year ago, and never looked back. Not just stopped using it, I actually closed the account out. "Deleted", but technically more like suspended in the FB database someplace. In any case, it's gone, and out of public view including off the radar of my Friends list.

I still keep in touch IRL with a few of them, but do yourself, and humanity a favor, GET RID OF THE ACCOUNT!

Shocking!

[grasshoppa]

Facebook, known paragon of personal privacy, tracking you in a vpn?

Seriously, what dumbass was shocked by this? I would expect the only reason to use a facebook branded VPN would be so your information is collected.

Re:Of course it does

[ctilsie242]

What it boils down to is who is the paying customer. With FB, users are the product. Same with Google. This is why one uses a decent VPN, that you pay for, and where the VPN provider's reputation matters.

VPNs are a must have, just because ISPs and local endpoints do so many shenanigans.

Re:Of course it does

[gnick]

VPNs are a must have, just because ISPs and local endpoints do so many shenanigans.

I agree. I'm sometimes accused of overusing mine. Unless I'm downloading something big (that I don't need to hide), I pipe everything on my home PC through Private Internet Access. Music streams fine; porn streams fine; no noticeable lag in normal browsing. Netflix & Youtube work fine with the VPN up, but if I'm using one of those I'm probably using my phone & Chromecast which avoids PIA. It just boils down to me trusting my VPN more than my ISP and suffering no consequences for gimping my connection for normal use.

Your Info Their Profit

[sdinfoserv]

THE business model of FB is to sell "your information" (just like every other social media site and search engine). No one with more than 2 firing neurons should expect anything less than every single keystroke tracked, recorded, monitored, analyzed and monetized.
It's a business, a business to make profit, off you....
So, go ahead and put that Amazon echo, Google Home or Nest in your house and feel complete secure nobody is listening to background sounds and determining what your doing and what can be sold to you. (or what can be subpoena.. later....)

And?

[thegarbz]

Sounds like perfectly normal metrics for a VPN software vendor to want to know about their device:

How long it gets used, If it is used in the background or foreground, and what percentage of user data travels via a metered connection. I'm really struggling to get upset about this even in the slightest.

Better Zuckerberg than Maduro

[williamyf]

I live in Venezuela, and deployed this so called VPN a few days ago.

With it enabled, I can use sites/apps prohibited by the government (www.dolartoday.com) as well as sites/apps that became colateral damage of the censorship (Formula Live24 2018).

I dot use a VPN to access geo-restricted content, or to hide shaddy practices online. I use it just to access restricted sites from an oppresive regime, and to be safer when using public/free wifi in airports and coffee shops...

Facebook already knows a lot about me, because I told them, willingly (my only complaint is that they do not use that info wisely).

If they get to know a little bit more about me, so be it. In the mean time, this VPN is free, it lets me do what I need, is well mantained and, when the time comes, I can move to a stronger solution... What's not to like?

Privacy is dead, get over it!

https://www.youtube.com/watch?...

Re:Better Zuckerberg than Maduro

[williamyf]

If privacy is dead then you should upload naked pictures of yourself to facebook, you know, because what have you got to hide?

I would, but those are banned, so I pose with Speedos during my scuba diving trips. ;-)

Having said that, "Privacy is dead. Get over it!" is the name of a now famous talk, linked at the end of my post.

PS: I use speedos while scubadiving, because it makes it easier to get in/out of the wetsuit. The picture opportunities are an added bonus... ;-)

Well

[DaMattster]

I must admit that this is not shocking! After all, it is a Facebook product and Facebook makes its money by harvesting data and re-selling it. I have a bridge to sell anyone who is surprised at this. It's cherry, only lightly used.

Facebook app collects data from non-users

[knorthern knight]

Even if you don't have an account, that effing "F" on your stock Android smartphone is scanning through your contact list etc, and sending info back to the mothership.

To re-purpose an old meme... only crAPPy crAPPy crAPPs crAPP on your privacy.