Certificate pinning is a hurdle to reverse engineering, but a surmountable one, at least on Android. Since the app is running on a phone where you may potentially have root, you can pick it apart with a debugger and see the traffic before it leaves the phone. This is technically challenging, but it is something that people do sometimes.

If you're the reverse engineer and I'm the app author, you find/replace my CA file. Then I respond (or anticipate!) by checksumming the file to detect tampering. Then you respond by find/replace on the checksum.

Then I obfuscate the checksum string. Then you respond by faking out the platform's checksum API so that it always returns true. Then I respond by computing a checksum that I know should fail and verifying that the checksum API isn't just always returning true. Then you respond by faking out the platform checksum API with a whitelist of blobs whose checksum it should lie about.

Then I respond by statically linking my own checksum verification code into my binary instead of calling the platform's. Then you respond by patching my binary to jump around the code. Then I respond by using code obfuscation techniques.

And on and on. Given enough time and resources, any implementation I create can be subverted. But if I'm a huge tech company, I can afford a lot of time and resources too, if I want to. I can't eliminate it, but maybe I can make it something that rarely happens.

The whole cracking scene can afford far more time and resources than any one tech company. All adding protections does is make a more valuable target, because crackers love a good challenge.

"There's always a crack in everything. It's how the light gets in."

Can? Sure! Would?

Security is one of those things that most people say they care about, but they are really not willing to pay for. Big companies have resources, but they are also in the business of making money, so they will put most of those resources to work on features that produce a ROI. Security is a huge cost center, and even when taken seriously it will be pursued only to the degree that it addresses/mitigates risks enough to conduct business.

http://www.cnn.com/TECH/computing/9908/20/aolbug.idg/index.h...

From the point of view of software, it's impossible in principle to tell whether or not the code being executed does what the user wants it to, and only what the user wants it to. Half of that is the halting problem, the other half is that "what user wants" is an General-AI-complete problem. Moreover, the software can't even tell the difference between "the user" and "a malicious third party".

In meatspace we solve this problem with rules and laws. Software, for better or worse, moves around too fast.

I gave it a thought, and decided I don't need apps to be able to obtain highly elevated privileges, root or similar. This is, indeed, dangerous, esp. regarding ADB root access (a rogue "charger" + an accidental wrong tap[1] = totally compromised device that can be only fixed by full re-flashing). I needed my own firmware that does things my way, signed with the keys I control.

So I did. Now all the "secure" apps are happy, and I still have the control over my device's behavior.

( Okay, I've cheated - I had to sanitize androidboot.verifiedbootstate when kernel initializes, because I can't control the bootloader :( )

[1] Hm, maybe password-authenticated root access is okay, though... But not a typical "tap to allow" dialog.

https://serializethoughts.com/2016/08/18/bypassing-ssl-pinni...

http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-...

It would likely be a blip in the news, and then people would move on, as usual.

Remember the Sony rootkit fiasco? People still buy Sony, and most people probably either never heard of that incident, don't remember, or don't care. Buying whatever the new Sony gizmo of the day is is more important to them.

Microsoft has had endless spyware fiascos, and people still routinely buy Windows, as long as they can play their games or run Office, that's all that matters to most of them.

Then there have been scandals like Enron, where the execs knew that they were doing something that was clearly illegal, and that their company really would be devastated if what they did was ever revealed. These "smartest people in the room" did it anyway.

Corporate history is full of just such deceptive and destructive practices. I'm not sure I'd put Facebook above that sort of thing, a priori.

I can see that happening again with voice recordings.

But it's an interesting question: if someone credibly proved that FB was "wiretapping" on such a massive scale, would they get prosecuted? How much could they do in their own defense? Are they so enmeshed that prosecutors wouldn't bother?

Feels like a case of "unstoppable force meets immovable object".

Your relative probably installed something and pressed "Next" through all the dialogs including the ones asking if they want to install super helpful bundled software.

I think you wildly overestimate how angry users get about privacy violations. For examples, Target, Yahoo, Home Depot, and Equifax have not been screamed into rubble.

So not literally everyone... but still many.

It was the second to go, just after Facebook.

For what it's worth, this public opinion backlash has not appeared with other companies: "Of course we're not working on leaked project [x]". "Look at project [x] we're working on!"

Even Facebook's own under-disclosed psychological experiments have been largely forgotten; Facebook has suffered few if any long-term ill effects from it.

is uber still the most hated company or has the magnifying glass moved onto somewhere else?

There are some shady companies out there [1] that use the mic to listen to what shows are being played real time. [TVs in the US are on all the time] (Check out their customer list). These companies need this pinning.

[1] https://www.audiblemagic.com/

I suspect I'm overlooking something, as surely some security researcher would have done some of this already.

...and if the signing code is also signed, then patch that.

It's patches all the way down. ;-)

There are couple ways out, from revers engineering the binaries, through jailbroken/rooted phones, running apps in simulators, etc.

The idea that Facebook is doing this is just ridiculous.

Some companies do "highly illegal" things all of the time. It all comes down to the fact that whoever is in charge:

1) doesn't hold to a moral system that restrains them from doing said illegal things (or at least doesn't hold to one consistently)

and

2) thinks they can do said illegal things without getting caught, or if they are caught, thinks they'll be able to recover reasonably well from any punishment (if there is any) that is handed down.

Personally, I do not know whether Facebook is recording/transmitting data like this, but I guess if I found out they were, I would not be surprised -- given the things the company has done in the past, and the things their leadership has said and done in the past.

Facebook invading our privacy by recording persons of interest or the people en masse would be horrible and in many ways unprecedented, but it wouldn’t be beyond the levels of abuse we have seen from powerful people in the past. I can easily imagine that the app supports hot mic capabilities and that they do turn it on sometimes at least at the request of law enforcement. And then the question is... when else would they turn it on? And would that program ever grow? Would they ever fork the program so each team involved thinks there working on a small project? This is all speculation but I can imagine a situation where it starts small and then grows until it seems like an insane program but everyone involved is accustomed to it.

When you read their responses to this controversy, pay more attention to what they don’t say. Whomever aggregates your viewing habits by listening to audio from your TV may be listening, for example, Facebook just Hoovers up the data.

Also, storing the data until it's plugged in would require an unusually large amount of storage, and that would be detectable.

That aside, speech recognition isn't that heavy of a process these days if all you're looking to do is extract keywords. We used to do industry-leading large vocabulary continuous speech recognition on a Pentium 133... phones these days are way beyond that without breaking a sweat. Detectable? Sure. But remember, I was talking about this person's plan to look at network data.

Furthermore you don't need to store all data. You can store only when the phone is hearing stuff, as determined by a super lightweight measure of magnitude that does no speech recognition whatsoever. Is the storage detectable? Sure. But again, what was I responding to? Network traffic monitoring.

In other words, any reason that the user should not be able to "disable" it? (Use own root CA.)

Consider that in this case, the data being transferred to Facebook belongs to the user.

Is it unreasonable for a user to require that they be able to see what data is being transferred before they agree to transfer it?

As for transparency, look to GDPR and friends to see what rights are being declared.

Even if it's an issue, a security researcher could recompile Chromium or Firefox with certificate pinning turned off and test with that.

[1] https://groups.google.com/a/chromium.org/d/msg/blink-dev/he9...