This is the problem with using VPN services in general, you have to have complete trust in the service provider.

  • Elley Smith :vote:@kzoo.to
    link
    fedilink
    arrow-up
    31
    arrow-down
    3
    ·
    3 months ago

    @yogthos Is anyone surprised by this anymore? Facebook is evil- full stop. We don’t need any more reasons to obstain from using their products but “mArKeTplAcE” and “mY cOuSiNs WoNt SwiTcH.”

    • octopus_ink@lemmy.ml
      link
      fedilink
      English
      arrow-up
      11
      ·
      3 months ago

      Maybe the idea is to show the folks who keep complaining about defederating from Threads that they either don’t know or have forgotten just exactly what kind of company Meta is.

    • Cyborganism@lemmy.ca
      link
      fedilink
      arrow-up
      9
      ·
      3 months ago

      I’m trying really hard to get my family to use something else for communication but they won’t. It’s a fucking drag.

      • gradyp@awful.systems
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        3 months ago

        I feel you. I’ve spent the last couple years building up self hosted replacements for these enshittified services as they flop. But despite all the work I’ve put in, I can’t even get them to log off facebook to look at what I’ve got.

          • gradyp@awful.systems
            link
            fedilink
            English
            arrow-up
            7
            ·
            edit-2
            3 months ago

            You make an excellent point, without use it’s mostly just there for nothing… but, specifically I build shit that they complain about. I have my personal photo site up with all my digital photos from the last 25 years catalogued and available from anywhere, I did this because they complained about not having them accessible. Hasn’t been logged into by anyone but me…

            But I don’t really blame them, I get it. The easy button is right there.

      • ian@lemmy.ml
        link
        fedilink
        arrow-up
        4
        ·
        3 months ago

        Marketplace is pretty useful. I hope a solid open-source alternative comes along.

        • mox@lemmy.sdf.org
          link
          fedilink
          arrow-up
          7
          ·
          edit-2
          3 months ago

          What’s important here is not the source code, but whether the service collects unnecessary information.

          Craigslist does a pretty good job of respecting privacy.

          • ian@lemmy.ml
            link
            fedilink
            arrow-up
            2
            ·
            3 months ago

            I agree. However, I think that most people won’t use Craigslist simply because it doesn’t have a lot of the modern niceties, specifically modern messaging solutions. The email system they have is pretty painful to use.

            • mox@lemmy.sdf.org
              link
              fedilink
              arrow-up
              3
              ·
              3 months ago

              It’s easy enough to do messaging via text, or whatever other contact info you choose to give out. I like that I can use Craigslist without giving them much info about myself.

              If you’re suggesting that a messaging system built into the venue is critical for success, then I suppose all of us wanting privacy are out of luck for now… but perhaps Craigslist (or some other privacy-friendly venue) could make it happen by integrating Matrix.

              • ian@lemmy.ml
                link
                fedilink
                arrow-up
                1
                ·
                3 months ago

                I agree that most messaging services are problematic, but Facebook having Messenger is part of the moat that’s keeping FB users on Marketplace. I think offering any non-email messaging solution would be hugely beneficial. I like the Matrix idea quite a bit.

                • mox@lemmy.sdf.org
                  link
                  fedilink
                  arrow-up
                  4
                  ·
                  3 months ago

                  Europe’s new Digital Markets Act might help in this department, too, through legally mandated interoperable messaging. Let’s hope it works out in our favor.

          • strawberry@kbin.run
            link
            fedilink
            arrow-up
            1
            arrow-down
            1
            ·
            3 months ago

            Craigslist also doesn’t have shit on it. try and buy a car on there. if you’re looking for a beater, sure. but a halfway decent sports car, fb marketplace is the only place

            its still OK for other stuff, I’ve bought tools and whatnot off Craigslist, but for vehicles fb is unfortunately still king

            • mox@lemmy.sdf.org
              link
              fedilink
              arrow-up
              7
              ·
              edit-2
              3 months ago

              What you’re describing is the network effect in action, not a flaw in Craigslist.

              (It will be the same with every alternative you find, except perhaps one that’s well funded with outside money, which will be awful on the privacy front, of course.)

              The way we overcome a network effect is piece by piece:

              • First we switch to the privacy-friendly service for everything we can. That immediately reduces our exposure, reduces the power of the incumbent, and makes the alternative more useful by giving more users a reason to switch.
              • Then, over time, we switch for the remaining things as we find a suitable service for each one. (This might even be the same privacy-friendly alternative we started with, after it has grown a little.)

              If I felt I had to buy a sports car, and some awful invasive site like Facebook was somehow the only viable venue, I would buy just the car there. I wouldn’t make them the middle man for every other transaction in my life.

              • strawberry@kbin.run
                link
                fedilink
                arrow-up
                2
                ·
                3 months ago

                well yea its not Craigslist itself that’s the issue, its the fact that its a smaller platform. and yea I use eBay or Craigslist for everything but vehicles.its sad that Craigslist has been forgotten though.

    • ☆ Yσɠƚԋσʂ ☆@lemmy.mlOP
      link
      fedilink
      arrow-up
      6
      arrow-down
      9
      ·
      3 months ago

      There is no way to know whom the trustworthy VPN provider shares data with. That’s just the reality. And sure you’re back to square one if you don’t use a VPN, but the point here is that people think that using a VPN is much safer than it actually is. Furthermore, another option is always to just run your own VPN that you can host in whatever jurisdiction you want.

        • Lemmy@lemm.ee
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          3 months ago

          The creators of MullvadVPN or their identities are not prominently disclosed, which means you have to trust them. For all we know they could be working with Swedish law enforcement or other nations and you’d never know.

        • ☆ Yσɠƚԋσʂ ☆@lemmy.mlOP
          link
          fedilink
          arrow-up
          1
          arrow-down
          3
          ·
          3 months ago

          It’s safe to assume they were not providing data to anyone at the time, and perhaps they are not now. Thing is that you don’t know that, and it’s a relationship fundamentally based on trust. There’s nothing wrong with trusting a company like Mullvad, but it is just trust in the end.

  • delirious_owl@discuss.online
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    3 months ago

    “I can’t think of a good argument for why this is okay. No security person is ever comfortable with this

    I agree, but wait till you hear what network appliances are doing and what processor manufacturers are doing…

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    4
    ·
    3 months ago

    This is the best summary I could come up with:


    In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers.

    On Tuesday, a federal court in California released new documents discovered as part of the class action lawsuit between consumers and Meta, Facebook’s parent company.

    “Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted we have no analytics about them,” Meta chief executive Mark Zuckerberg wrote in an email dated June 9, 2016, which was published as part of the lawsuit.

    When the network traffic is unencrypted, this type of attack allows the hackers to read the data inside, such as usernames, passwords, and other in-app activity.

    This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet.

    “We now have the capability to measure detailed in-app activity” from “parsing snapchat [sic] analytics collected from incentivized participants in Onavo’s research program,” read another email.


    The original article contains 687 words, the summary contains 175 words. Saved 75%. I’m a bot and I’m open source!

    • ArcaneSlime@lemmy.dbzer0.com
      link
      fedilink
      arrow-up
      2
      arrow-down
      1
      ·
      3 months ago

      Because “adversary” is clearly gender neutral and “man” is not, so “man” isn’t able to continue it’s double meaning as being short for “mankind” which itself is short for “humankind,” for fears that it’s exclusionary.

  • the post of tom joad@sh.itjust.works
    link
    fedilink
    arrow-up
    3
    ·
    3 months ago

    So (and im asking for technical clarification as a layman) Facebook didn’t put this data miner on unknowing user’s phones but did pay teenagers to install one (onavo) on their phones that worked to decrypt traffic for everyone those users interacted with… Right?