The VPN Is On Everybody's Shitlist After Years Of Scammy Providers And Empty Promises

from the it's-not-magic dept

The high number of scammy providers and overall rise in encryption appears to have turned the public sentiment against virtual private network (VPN) VPNs, and whether most consumers actually even need one. As privacy scandals and hacks grew over the last decade, VPNs quickly emerged as a sort of mystical panacea, that could protect you from all harm on the internet. Of course, this resulted in a flood of VPN competitors who were outright scams, made misleading statements about what data is collected, or failed to protect consumer data.

The end result is a new trend in the press where about once a month we get a new story informing you that you probably don't actually need a VPN. NBC News was the latest last week, pointing out that VPNs aren't the panacea many people seem to assume:

"Most commercial VPNs are snake oil from a security standpoint,” said Nicholas Weaver, a cybersecurity lecturer at the University of California, Berkeley. “They don’t improve your security at all."

Scammy VPN providers are a major reason for the shift. A Consumer Reports study last month took a look at 16 top VPN providers, and found that the majority of them misrepresented their products or their data retention practices, and many of the companies actually put consumer privacy at greater risk. Only a quarter of the VPNs looked at clearly indicated how long they retain user browsing and other data. The gold rush and regulatory apathy created an environment where the industry's floorboards rotted out below it, creating products that actually put consumer privacy and security at greater risk.

Granted simple technical innovation is another reason why the VPN is no longer deemed essential. Most browsers implemented HTTPS, making the dreaded (and frankly often unlikely) scenario whereby a nearby coffee shop hacker hijacks the entirety of your finances no longer as much of a threat. There's also (much to the chagrin of total surveillance fans in intelligence and law enforcement) greater encryption overall, and a parade of browser extensions and plugins that can help provide additional security. Now, you're far more likely to be subject to a basic human engineering phishing attack, which a VPN won't help with:

"Users now need to worry far less about being hacked by a fellow coffee shop patron than by a hacker simply sending an email from anywhere around the world to trick them into giving up their passwords and other sensitive information, she said.

Hackers “would likely do a phishing attack on you before they would walk into a cafe with free Wi-Fi,” Hancock said. “Sending people nefarious emails, it’s much easier to do that kind of campaign. Those have been tried and true, unfortunately,” she said."

That's not to say VPNs don't still have their function. The technology is still an essential security layer for governments, corporations, or others dealing with extremely sensitive information. But for many ordinary consumers, they're more trouble than they're worth, in no small part thanks to an industry that completely lost its soul at the data collection and monetization trough.

Filed Under: encryption, overhype, scams, security, vpn

Latest VPN Security Scandals Show (Yet Again) That VPNs Aren't A Panacea

from the not-a-magic-bullet dept

Given the seemingly endless privacy scandals that now engulf the tech and telecom sectors on a near-daily basis, many consumers have flocked to virtual private networks (VPN) to protect and encrypt their data. One study found that VPN use quadrupled between 2016 and 2018 as consumers rushed to protect data in the wake of scandals, breaches, and hacks.

Usually, consumers are flocking to VPNs under the mistaken impression that such tools are a near-mystical panacea, acting as a sort of bullet-proof shield that protects them from any potential privacy violations on the internet. Not only is that not true (ISPs, for example, have a universe of ways to track you anyway), many VPN providers are even less ethical than privacy-scandal-plagued companies or ISPs.

The latest case in point: a number of VPN providers who claim to offer "zero logging" protection were found to have not only been tracking a laundry list of user behaviors online, but doing a piss poor job securing said data. Kicking it off, Comparitech's Bob Diachenko recently discovered 894 GB worth of of user data in an unsecured Elasticsearch cluster belonging to UFO VPN, a provider whose privacy policy informs users that they aren't tracked as they travel around the internet. That wound up being, you know, not even remotely true:

"Hong Kong-based VPN provider UFO VPN exposed a database of user logs and API access records on the web without a password or any other authentication required to access it. The exposed information includes plain text passwords and information that could be used to identify VPN users and track their online activity."

Again, "VPN" should not be automatically associated with "secure," and the majority of these companies simply aren't particularly trustworthy. Just ask vpnMentor, which discovered last week that an entirely different group of "no logging" free VPN providers had left more than a terabyte of private user data openly exposed online without a shred of protection:

"The vpnMentor research team, led by Noam Rotem, uncovered the server and found Personally Identifiable Information (PII) data for potentially over 20 million VPN users, according to claims of user numbers made by the VPNs.

Each of these VPNs claims that their services are “no-log” VPNs, which means that they don’t record any user activity on their respective apps. However, we found multiple instances of internet activity logs on their shared server. This was in addition to the PII data, which included email addresses, clear text passwords, IP addresses, home addresses, phone models, device ID, and other technical details."

The irony of consumers (justifiably) fearing for their security in the wake of massive privacy scandals, only to stumble into the arms of "security companies" that are even worse on security and privacy is just very 2020. For many of these fly by night operations, the VPN itself is just security theater, and in some instances you're actually probably better off with the devil you already know:

That's not to say that VPNs don't certainly have their use, but folks need to exercise some good judgement and spend a little time reading and comparing recommendations from respected outlets before putting their behavior data into the hands of total randos half a world away.

Filed Under: privacy, security, vpn

Russia Expands Site Blocking To VPNs

from the watch-out dept

Over the last few years, Russia has been one of the most aggressive countries in using claims of copyright infringement to push for full site blocking at the ISP level. Of course, that has resulted in tens of thousands of innocent sites getting blocked (collateral damage!), not to mention a corruption scandal and... no meaningful decrease in piracy. Apparently, the answer for the Russians: head deeper into the infrastructure to push site blocking even further.

Now, apparently, beyond just demanding ISPs engage in massive site blocking, various VPNs have been ordered to start blocking full sites as well.

During the past few days, telecoms watch Roscomnadzor says it sent compliance notifications to 10 major VPN services with servers inside Russia – NordVPN, ExpressVPN, TorGuard, IPVanish, VPN Unlimited, VyprVPN, Kaspersky Secure Connection, HideMyAss!, Hola VPN, and OpenVPN.

The government agency is demanding that the affected services begin interfacing with the FGIS database, blocking the sites listed within. Several other local companies – search giant Yandex, Sputnik, Mail.ru, and Rambler – are already connected to the database and filtering as required.

You can understand how this came about: as site blocking gets more popular, more people sign up for VPNs that allow them to get around local censorship and access content as before. However, it appears the Russians are trying to stop that as well. While not quite as bad as when China started banning VPNs completely, this still represents quite a threat to securely surfing the internet.

I was actually in Moscow a few years ago, very briefly, to speak on a panel, and I came armed with three separate VPN services to (hopefully?) stay safe and be able to tunnel out of the Russian internet. That was well before the big crackdown, however, and it must be more and more difficult to use the internet safely there. We've also discussed Russia's supposed plans to test disconnecting from the internet -- and it might not need to do much if it continues to reach deeper and deeper into the internet ecosystem to make it harder and harder to use the internet safely and securely.

And, of course, as Professor Annemarie Bridy notes, none of this is really about copyright infringement. This is entirely about authoritarian control of the internet and censorship:

Indeed, remember a few years back when the Russian government used questionable claims of copyright infringement to intimidate government critics? The US's infatuation with copyright has handed a tool of out and out censorship to authoritarian leaders, who can censor freely while insisting they're doing so to help American copyright corporate interests.

Filed Under: internet freedom, isp, russia, site blocking, vpn

Facebook Finally Shuts Down Its Snooping, Bullshit 'VPN' After A Full Year Of Complaints

from the with-friends-like-these dept

Just about a year ago we noted how Facebook was taking some heat on the security and privacy fronts for pitching a "privacy protecting" VPN to consumers that actually violated consumer privacy. Based on the Onavo platform acquired by Facebook back in 2013, the company's "Onavo Protect – VPN Security" app informed users that the product would "keep you and your data safe when you browse and share information on the web" and that the "app helps keep your details secure when you login to websites or enter personal information such as bank accounts and credit card numbers."

It didn't take long before many began to notice those claims weren't, well, true.

A wide variety of different news outlets were quick to point out that Facebook was actually using the "privacy" app to track users around the internet when they wandered away from Facebook, then using that data to its own competitive advantage:

"Interviews with more than a dozen people familiar with Facebook’s use of Onavo data show in detail how the social-media giant employs it to measure what people do on their phones beyond Facebook’s own suite of apps. That information shapes Facebook’s product and acquisition strategy—furthering its already formidable competitive edge, the people said."

By August, complaints had heated up enough that Apple announced it would be pulling the service from its app store for misleading its customers and violating the app store policies. Even then, Facebook continued to market and push the VPN as a privacy tool while undermining the whole point of said privacy tool. That continued well into this year until TechCrunch released a story noting that Facebook has also been paying kids to install a “Facebook Research VPN," very similar to the Onavo "VPN," the entire function of which was to sidestep app store bans and continue hoovering up data.

That story, understandably, finally appeared to drive a stake into the heart of Facebook's efforts, as many wondered if the participating kids were actually capable of giving their consent for the project. As such it's now a full year later, and as Facebook faces a wave of endless scandals of its own making, it appears to have finally gotten the message and will be shutting these dubious VPN efforts down:

"With the suspicions about tech giants and looming regulation leading to more intense scrutiny of privacy practices, Facebook has decided that giving users a utility like a VPN in exchange for quietly examining their app usage and mobile browsing data isn’t a wise strategy. Instead, it will focus on paid programs where users explicitly understand what privacy they’re giving up for direct financial compensation."

For one, notice how conventional tech "wisdom" didn't really give a shit that Facebook was misleading users until kids were involved, which speaks pretty loudly to our collective privacy apathy. Two, that it took Facebook a full year to realize this was the correct path forward is astonishing. This is a company that's been facing calls for privacy regulation in the wake of nearly a year of almost weekly scandals, yet just kept stumbling forward on the same path. It's another example that Facebook's biggest problem isn't a mean press (as some Facebook insiders have allegedly declared), it's Facebook's executive "leadership."

Filed Under: misleading, onavo, privacy, snooping, vpn
Companies: facebook

Canada's Bell Tried To Have VPNs Banned During NAFTA Negotiations

from the missing-the-point dept

Countries around the world continue to wage a not particularly subtle war on the use of virtual private networks (VPNs) and encryption. In Russia, the government has all but banned the use of VPNs by layering all manner of obnoxious restrictions and caveats on VPN operators. The goal, as we've seen in China and countless other countries, is to ban VPN use without making it explicitly clear you're banning VPN use. The deeper goal is always the same: less privacy and online freedom for users who use such tools to dodge surveillance or other, even dumber government policies.

Of course there's plenty of companies eager to see VPN use banned as well, whether it's the entertainment industry hoping to thwart piracy, or broadcasters trying to hinder those looking to dance around geographical viewing restrictions. Lost in the hysteria is usually the fact that VPNs are just another security tool with a myriad of purposes, most of which aren't remotely nefarious and shouldn't be treated as such.

Apparently, you can count Canadian telecom incumbent Bell among the companies hoping to ban VPN use. Anja Karadeglija, the editor of paywalled telecom news outlet the Wire Report, obtained documents this week highlighting how Bell had been pushing Canadian Foreign Affairs Minister Chrystia Freeland for a VPN ban to be included in NAFTA negotiations. Why? It doesn't want users using VPNs to watch the US Netflix catalog:

"In its submission, Bell argued that Canadians accessing content from a US service with a VPN “unjustly enriches the US service, which has not paid for the Canadian rights” but nonetheless makes that content available to Canadians. Bell’s media arm reportedly spends millions on content for it streaming service, Crave TV, which allows Canadians to stream content from American networks such as HBO and Showtime."

Again though, it's not the VPN doing that. And if you want to stop users from flocking to better content catalogs elsewhere on the continent, you should focus your ire on the things causing that to happen -- like increasingly dated and absurd geo-viewing restrictions, and your own substandard content offerings that fail to adequately match up. That message was lost on Bell, however:

“Canada should seek rules in NAFTA that require each party to explicitly make it unlawful to offer a VPN service used for the purpose of circumventing copyright, to allow rightsholders to enforce this rule, and to confirm that it is a violation of copyright if a service effectively makes content widely available in territories in which it does not own the copyright due to an ineffective or insufficiently robust geo-targeting system,” the submission stated."

How exactly you're supposed to determine that somebody is using a VPN to not watch Bell's own television services isn't really explained, and the fact that enforcement would likely be technically impossible appears to have been an afterthought. As Canadian Law Professor Michael Geist was quick to note, trying to ban VPNs just as they're reaching critical mass as a partial solution to raging North American privacy scandals suggests Bell may not exactly have its finger on the pulse of common sense on this particular subject.

Filed Under: canada, streaming, trade agreements, usmca, vpn, vpns
Companies: bell canada

Facebook's Privacy Problems Are Piling Up Too Quickly To Chronicle

from the own-worst-enemy dept

Another day, another Facebook privacy mess. Actually, this one is a few different privacy messes that we'll roll up into a single post because, honestly, who can keep track of them all these days? While we've noted that the media is frequently guilty of exaggerating or misunderstanding certain claims about Facebook and privacy, Facebook does continue to do a really, really awful job concerning how it handles privacy and its transparency about these things with its users. And that's a problem that comes from the executive team, who still doesn't seem to fully comprehend what a mess they have on their hands.

The latest flaps both involve questionable behavior targeted at younger Facebook users. First there's a followup on a story we wrote about a few weeks ago, involving internal Facebook documents showing staffers gleefully refusing to refund money spent unwittingly by kids on games on the Facebook platform. Reveal, from the Center for Investigative Reporting, who broke that story, also had a much more detailed and much more damning followup, about how Facebook was clearly knowingly duping young children out of their parents' money.

Facebook encouraged game developers to let children spend money without their parents’ permission – something the social media giant called “friendly fraud” – in an effort to maximize revenues, according to a document detailing the company’s game strategy.

Sometimes the children did not even know they were spending money, according to another internal Facebook report. Facebook employees knew this. Their own reports showed underage users did not realize their parents’ credit cards were connected to their Facebook accounts and they were spending real money in the games, according to the unsealed documents.

For years, the company ignored warnings from its own employees that it was bamboozling children.

A team of Facebook employees even developed a method that would have reduced the problem of children being hoodwinked into spending money, but the company did not implement it, and instead told game developers that the social media giant was focused on maximizing revenues.

Yes, they not only called it "friendly fraud," but in an internal memo, they explained "why you shouldn't try to block it" (i.e., why you should let game developers scam kids out of their parents' money).

This reminds me so much of the early days of adware scammers, who pulled similar kinds of stunts -- and it's incredible to think that Facebook, which presented itself as a squeaky clean alternative to the open web where those kinds of scams piled up, was basically doing the same thing on a much larger scale. The Reveal article has much more on this, and is worth reading in full to see how the focus on revenue had the company deliberately look the other way as it scooped up cash from kids.

But rather than focus on that, we already need to move on to the more recent Facebook privacy scandal, which also (partially) involves kids. Last summer, we wrote about how Apple had booted Facebook's Onavo app from its app store. Facebook had marketed it as a privacy protecting "VPN," but it was really pretty blatant spyware. Indeed, late last year when yet another Facebook privacy scandal broke, it was revealed that Facebook had been using Onavo data to determine what competitive apps were most popular -- including giving it ideas on what apps to buy or (much more damning) what apps to hinder or block from Facebook.

Apparently, even having Apple boot the app didn't give Facebook the idea that maybe this spyware was going a bit too far. Instead, it now appears that Facebook "pivoted" into paying teens to install Onavo on iPhones in a way that routed around Apple's App Store blocks, by saying it was a part of "Facebook Research." And they hid this from Apple by using third party "beta testing" services:

The program is administered through beta testing services Applause, BetaBound and uTest to cloak Facebook’s involvement, and is referred to in some documentation as “Project Atlas” — a fitting name for Facebook’s effort to map new trends and rivals around the globe.

Facebook appears to have desperately wanted all of this data, if it was willing to go these lengths even after Apple had booted Onavo. After TechCrunch broke this story, Facebook claimed that it would stop that program on iPhones, while Apple claims it banned the app before Facebook itself could pull it.

For years, people like Jaron Lanier have argued that Facebook should pay its users for all the data they get -- but I think even people who wanted payment would balk a bit at how much access people were giving in exchange for $20/month in gift cards.

“By installing the software, you’re giving our client permission to collect data from your phone that will help them understand how you browse the internet, and how you use the features in the apps you’ve installed . . . This means you’re letting our client collect information such as which apps are on your phone, how and when you use them, data about your activities and content within those apps, as well as how other people interact with you or your content within those apps. You are also letting our client collect information about your internet browsing activity (including the websites you visit and data that is exchanged between your device and those websites) and your use of other online services. There are some instances when our client will collect this information even where the app uses encryption, or from within secure browser sessions.”

And, of course, the setup required you to keep the app running and spying on everything if you wanted to keep getting paid.

Facebook, in response to the TechCrunch story, did its standard PR tap dance, insisting that they weren't hiding anything (Apple's response suggests otherwise, as does the fact that Facebook specifically used these 3rd party services). But, once again, like with so many other Facebook privacy scandals, the reason why so many people get upset about this is because they were not open and transparent about what was going on, and that's why it's so surprising to everyone.

The only "good" news is that on the same day all of this came out, it was announced that Facebook has just hired two of its biggest privacy critics to work on privacy issues at the company: EFF's Nate Cardozo and Open Technology Institute's Robyn Greene (*Disclosure: I know both Nate and Robyn, and Nate did, very helpfully, represent us on one issue while he was at EFF.) I know some may cynically see this as Facebook trying to co-opt some of its critics, but both Nate and Robyn have incredibly strong track records on privacy, including being vocally critical of Facebook and its policies. Hopefully this is a sign that the company is actually taking these issues seriously (better a decade too late than never).

Filed Under: apps, friendly fraud, kids, onavo, privacy, research, vpn
Companies: facebook

Facebook's 'Privacy Protecting' VPN Booted From Apple Store For Snooping Too Much

from the ill-communication dept

Back in February we noted how Facebook had launched a new security tool the company promised would "help keep you and your data safe when you browse and share information on the web." The product was effectively just reconstituted version of the Onavo VPN the company acquired back in 2013. We also noted how some reports were quick to point out that instead of making Facebook users' data more private and secure, Facebook used the VPN to track users around the internet -- specifically what users were doing when they visited other platforms and services.

From a report in the Wall Street Journal just about a year ago:

"Interviews with more than a dozen people familiar with Facebook’s use of Onavo data show in detail how the social-media giant employs it to measure what people do on their phones beyond Facebook’s own suite of apps. That information shapes Facebook’s product and acquisition strategy—furthering its already formidable competitive edge, the people said."

At the time, Facebook spokespeople attempted to claim that this was no big deal because "websites and apps have used market-research services for years," and that the data collected by its nosy VPN helped the company improve its products.

But that response ignored the obvious problem: that Facebook has been pitching a product it claimed "protected" people's privacy but did the exact opposite. During a massive, global privacy scandal. With regulators and media outlets around the world contemplating vast new privacy guidelines that could massively impact Facebook's entire data-hoovering business model.

That anybody at Facebook thought this was a good idea is pretty remarkable.

This week, Facebook was forced to pull the company's "data security app" from the Apple Store after the company found that the service violated its data-collection policies:

"Earlier this month, Apple officials informed Facebook that the app violated new rules outlined in June designed to limit data collection by app developers, the person familiar with the situation said. Apple informed Facebook that Onavo also violated a part of its developer agreement that prevents apps from using data in ways that go beyond what is directly relevant to the app or to provide advertising, the person added."

Admittedly, Apple's app store approval process is certainly its own type of terrible. But the report notes that Apple demanded that Facebook "voluntarily" remove the app, and Facebook complied. As such, iOS users can no longer download the app, and users that have already installed it will no longer receive updates for it. It is, however, still available over at the Google Play store, if giving Facebook even greater insight into your online activity is a prospect that excites you.

The whole kerfuffle only punctuated our repeated point that VPN's aren't some kind of mystical privacy panacea. In the wake of the GOP killing broadband privacy rules and the myriad other privacy and hacking scandals, countless people have been flocking to VPNs under the mistaken belief that a VPN is some kind of silver bullet. But a VPN is only as good as the people running it on the other end. And if the people on the other end are running scams or lying about what data is collected and stored (which is incredibly common in the VPN realm) you're not a whole lot better off.

In short, who you get your VPN from is incredibly important, and if the person pitching you said VPN has a rich history of privacy abuses (be it Facebook or a giant, incumbent ISP like Verizon), you should probably know better than to trust the integrity of their promises, whatever form they take.

Filed Under: apps, onavo, privacy, security, vpn
Companies: apple, facebook

Verizon Launched A VPN Without Bothering To Write A Real Privacy Policy

from the whoops-a-daisy dept

As we've noted for a while, a VPN isn't some kind of magic bullet. While it might help you hide some of your online activity from snoopy governments, nosy ISPs, or a packet sniffing dudebro at the coffee shop, it's not some mystical panacea. Unfortunately, in the wake of seemingly endless privacy scandals and a federal apathy to any meaningful privacy rules of the road, many people have been flocking to VPNs without understanding that many VPNs are scams, poorly configured (making you less secure, not more), and that promises made about data retention are often hollow.

Ironically, many of the companies most responsible for our privacy problems have now jumped into the VPN business to capitalize on consumer worries they themselves helped create. Like Facebook, which, in the shadow of the Cambridge Analytica scandal, thought it might be a good idea to launch a VPN that pretends to protect consumers from online harm, but actually exists solely to track your behavior online when you're not visiting Facebook.

Verizon, fresh off of its successful efforts to kill net neutrality and FCC broadband privacy protections, also recently launched a new VPN service dubbed Safe WiFi. Safe WiFi, you'll be happy to learn, "protects your privacy and blocks ad-tracking." But when I began digging into Verizon's VPN for Motherboard, I found that the company had rushed the service to market so quickly, it failed to even write an actual privacy policy for the service. Instead, the company informed me it had simply copied a placeholder privacy policy lifted from McAfee, the company that actually built its VPN. According to this privacy policy, Verizon's VPN collects, well, pretty much everything:

"Details about your computers, devices, applications, and networks, including internet protocol (IP) address, cookie identifiers, mobile carrier, Bluetooth device IDs, mobile device ID, mobile advertising identifiers, MAC address, IMEI, Advertiser IDs, and other device identifiers that are automatically assigned to your computer or device when you access the Internet, browser type and language, language preferences, battery level, on/off status, geo-location information, hardware type, operating system, Internet service provider, pages that you visit before and after using the Services, the date and time of your visit, the amount of time you spend on each page, information about the links you click and pages you view within the Services, and other actions taken through use of the Services such as preferences."

When I pressed Verizon on how it could sell a "privacy and security" product that actively makes its users less private and secure, the company acknowledged that employees had simply copied the McAfee privacy policy and didn't bother to write one of its own for the product, something the company wasn't aware of until I brought it to their attention. That means that when you use Verizon's VPN, you have zero real assurance that they won't collect your data. Verizon, for its part, was quick to inform me that once it finishes actually writing a privacy policy, it will assure users that no private data is collected:

"We're working with McAfee to post their privacy policy specific to Safe WiFi and will send you a link as soon as it posts,” Verizon said, acknowledging that it wasn't aware of the problem until Motherboard “alerted us to this discrepancy." Whenever the actual privacy policy is posted, it will “reflect that fact that neither Verizon nor McAfee collects any personal data regarding users or use of the Safe WiFi VPN,” the company promises."

In the interim, you just apparently have to trust Verizon that it's not using the VPN to snoop on you. A sizable ask since, you'll recall, Verizon was busted in 2016 modifying wireless packets to track users around the internet without providing opt out tools or even informing anybody. The same company that just got done gutting FCC broadband privacy protections and is part of an industry that's the poster child for nontransparent and anti-consumer privacy practices.

There's a certain irony in Verizon trying to cash in on privacy worries it itself caused by rushing a VPN product to market so quickly -- it couldn't be bothered to include a real privacy policy for it. There might be a lesson in there somewhere. Meanwhile, if you do need a VPN, you're probably better off picking one of numerous options that don't have a several-decade history actively trying to undermine consumer privacy and real privacy guidelines.

Filed Under: privacy, trust, vpn
Companies: verizon

Facebook 'Security': A New VPN That's Spyware And Two-Factor Authentication That Spams You

from the insecurity dept

Facebook's definition of protection isn't quite up to snuff. Last week, some Facebook users began seeing a new option in their settings simply labeled "Protect." Clicking on that link in the company's navigation bar will redirect Facebook users to the “Onavo Protect – VPN Security” app’s listing on the App Store. There, they're informed that "Onavo Protect helps keep you and your data safe when you browse and share information on the web." You're also informed that the "app helps keep your details secure when you login to websites or enter personal information such as bank accounts and credit card numbers."

What you're not told is that Facebook acquired the company back in 2013, and is now using it as little more than glorified spyware, allowing Facebook to track and monetize your travels around the internet (especially time spent wandering around competing social media platforms). That is, understandably, upsetting some people who believe that security tools should, well, actually protect you from surveillance, not open up an entirely new avenue for it:

"Facebook, however, purchased Onavo from an Israeli firm in 2013 for an entirely different reason, as described in a Wall Street Journal report last summer. The company is actually collecting and analyzing the data of Onavo users. Doing so allows Facebook to monitor the online habits of people outside their use of the Facebook app itself. For instance, this gave the company insight into Snapchat’s dwindling user base, even before the company announced a period of diminished growth last year."

Amusingly, as one Facebook team was busy pushing a VPN service that spies on you, other parts of the company have been busy pushing a new two-factor authentication system (good) that the company also thought should be co-opted for marketing purposes (not so good). Ideally, two-factor authentication should use your phone number exclusively to send you authentication codes via SMS. But Facebook apparently got the nifty idea to immediately take that number and spam customers in the hopes this would drive additional engagement at the website:

On a positive note, Facebook was quick to acknowledge that the SMS spam isn't intentional, and that it would be rolling out out a fix shortly (hopefully before too many people get disgusted by 2FA):

"It was not our intention to send non-security-related SMS notifications to these phone numbers, and I am sorry for any inconvenience these messages might have caused. We are working to ensure that people who sign up for two-factor authentication won't receive non-security-related notifications from us unless they specifically choose to receive them, and the same will be true for those who signed up in the past. We expect to have the fixes in place in the coming days. To reiterate, this was not an intentional decision; this was a bug."

While Facebook was quick to own its 2FA problem, the company has been somewhat mute regarding the backlash to its "VPN" service offering. That effort likely began with good intentions among Facebook's security team, then got hijacked by company higher ups nervous about the fact Facebook's engagement and subscriber numbers have begun a precipitous dive. The solution to that problem is making Facebook better and more secure, not pushing security and privacy services whose real agenda is monetization and, apparently, annoyance.

Filed Under: 2fa, marketing, security, sms, spam, tracking, two factor authentication, vpn
Companies: facebook

China's Solution To The VPN Quandary: Only Authorized, And Presumably Backdoored, Crypto Links Allowed

from the will-Russia-follow-suit? dept

Two of the most important developments in China's clampdown on the digital world took place last year, when the country's Ministry of Industry and Information Technology declared that all VPN providers needed prior government approval to operate, and then apps stores were forced to remove the many VPNs on offer there. In some parts of China, VPNs were banned completely, but such a total shutdown is not really an option for cities with many businesses that require secure overseas communication channels. That put the Chinese authorities in something of a quandary: how could they reconcile their desire to prevent VPNs being used to circumvent online controls, while ensuring that the country's increasingly important corporate sector had access to the encryption tools it needed for operating globally? An article in the FT provides us with the answer (paywall). In recent months, international companies and organizations have found their VPNs blocked more frequently:

regulators have been pushing multinationals to buy and use state-approved VPNs. The state-approved versions can cost tens of thousands of dollars a month and expose users' communications to Beijing's scrutiny.

"China's intention is to control the flow of information entirely, making people use only government-approved VPNs by making it difficult, if not impossible, to use alternatives," said Lester Ross, partner at legal firm WilmerHale in Beijing.

The great thing about state-approved VPNs is that they can include backdoors for the government to use, and can be to shut down quickly if really serious problems arise that require even more stringent controls.

Backdoored crypto is inherently vulnerable to attacks against those built-in weaknesses, but the Chinese authorities are doubtless willing to let companies run that risk for the sake of maintaining overall control. Since Russia's views on VPNs are closely aligned with those of China, it will be interesting to see if it decides to adopt Beijing's solution to the VPN dilemma to tidy up its own rather clumsy approach.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: backdoors, china, encryption, vpn