10

I read a TechCrunch article today describing a program Facebook has been running since 2016 where they pay users $20 in exchange for installing a root certificate run by Facebook.

This immediately struck me as a massive privacy risk, especially if this ever transitioned into an 'opt-out' policy rather than an 'opt-in'. However, when trying to describe this issue to some friends, they didn't seem to share my privacy concerns. One friend told me 'they know Facebook has a creepy reputation, but if it was a company they trusted, they would be okay with it, because they have nothing to hide'.

I'd like to be able to articulate some real-world potential consequences from granting anyone this level of access to your device, let alone a large corporation. However, I also don't want to blow something out of proportion if it's not really that troublesome. What are some realistic risks/worst case outcomes that could result from this type of activity?

  • 1
    That's not really root access, which most phones wouldn't allow a user to do anyway, at-least not easily. It's more like allowing Facebook to see all internet to/from the phone. – Alexander O'Mara Jan 30 at 4:18
  • 2
    Installing a root certificate, while certainly a big deal from a privacy/security standpoint, isn't even remotely similar to granting root access. – Joseph Sible Jan 30 at 4:37
  • Basically, installing Facebook's root certificate is saying that you trust them to vouch for everyone they feel is trustworthy, and you trust those parties completely in every way that Facebook tells you to trust them. It might make me really nervous to install Facebook's root certificates if I thought about it. I mean, it puts them right up there with Verisign. Who the heck is Facebook, to say they're as trustworthy in checking identities as well as Verisign... and, um, who the hell is Verisign, anyway? I just know they're one of the first companies whose root certs I had in my trust store. – Ed Grimm Jan 30 at 4:42
  • 1
    It’s worse than that, Ed. They’re not tying to serve the function of a Certificate Authority as one would do with a corporate certificate used to protect intranet sites. They’re intentionally using it to decrypt traffic and re-sign the communications so that the receiving end still thinks it’s trusted. They’re rendering the trust you place on the original certificate void. Not only do you have the issues with Facebook collecting your data, you have all the potential issues that came up with Lenovo’s SuperFish incident. – nbering Jan 30 at 4:48
  • 2
    @nbering: no. The worst part of SuperFish was that they exposed the privatekey, so anybody and everybody could use it to MitM. Facebook's method 'only' allows Facebook to MitM -- FWTW. – dave_thompson_085 Feb 1 at 9:58
12

Do you trust that Facebook and everyone they sell the data to will not use it for evil?

Allowing Facebook to install a root certificate on your phone makes it possible for them to intercept any and all communications, even encrypted ones. They will be able to view everything from arbitrary private conversations to banking transactions or online purchases. They will be able to record every password you use on every service if they so wish, even if the password is being sent to a secure website using HTTPS for encryption. You have no way of knowing how they will use this data or who they sell it to.

Facebook makes money not just through advertisements, but by collecting personal information and selling it to the highest bidder. This includes advertising and profiling companies as well as "foreign" governments. The information can be used to formulate the best ways to manipulate you in the future, either to buy a product or to vote in a certain way, as has been done by Cambridge Analytica.

Do you trust that the security of this app is sufficient that hackers cannot exploit it?

Even if you trust Facebook and everyone they sell to not to use this power for evil, there are countless hackers who would love to take advantage of this fact. Normally, your system only trusts root certificates that have gone through extreme scrutiny, having gone through a key ceremony for improved security:

The actual root key-pair generation is normally conducted in a secure vault that has no communication or contact with the outside world other than a single telephone line or intercom. Once the vault is secured, all personnel present must prove their identity using at least two legally recognized forms of identification. Every person present, every transaction and every event is logged by the lawyer in a root key ceremony log book and each page is notarized by the notary. From the moment the vault door is closed until it is re-opened, everything is also video recorded. The lawyer and the organization's two signatories must sign the recording and it too is then notarized.

Web browsers will not accept root certificates from any entity which has not gone through such extensive measures to ensure the root certificate is secure, but by installing this "Facebook research VPN" and root certificate, you are completely bypassing this process. How much security do you think Facebook has actually put into guarding the root certificate that they are asking you to install?

  • I definitely don't approve of installing Facebook's root certificate but I think it's worth mentioning that simply installing Facebook's app and root certificate is not enough for them to intercept any of your communications. You would also have to connect to a network controlled by Facebook and Facebook would have to conduct an active (assuming a DH key exchange) MiTM attack. – catanman Jan 31 at 19:32
  • As catanman says, a simple root certificate would not be enough to read all the traffic. They would also need to mess with the DNS, so every request ends up on their servers. So what does this app do exactly, other than installing a root certificate? – reed Jan 31 at 22:37
  • @reed It markets itself as a "research VPN". I take that to mean it can intercept all traffic. – forest Jan 31 at 23:16
2

It's really less about what you have to hide and more about the chilling effect that happens when one corporate giant gets an unfair share of information - like the WhatsApp purchase mentioned in that article indicated. Any mega corp knowing exactly who their biggest competitor at every point in time is a scary thought. It would be one thing if everyone knew it, or even if all of the fortune 500 knew it. But having that kind of information in the hands of a very few companies is frightening.

That is, incidentally, what I feel the scariest thing is about Google, because knowing everything at every point in time is kind of their shtick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.