News for hackers. Stuff that matters.
Re:Facebook has been paying people to install a “Research” VPN by minimaxir on Tuesday January 29, 2019 @06:50PM (#19031130)
The HN title/article is slightly misleading with its use of "root access"; the iOS Enterprise Root certs give increased data access outside of an app (e.g. decrypted SSL traffic, like what this app was doing), but not "root access" in the Unix sense.

You can play with them using mitmproxy to generate a Cert and intercept SSL traffic.

Re:Facebook has been paying people to install a “Research” VPN by merlincorey on Tuesday January 29, 2019 @07:20PM (#19031345)
It is "root" in the sense of "root certificate"[0] which allows, potentially, the ability to MITM essentially any TLS connection transparently to the user.

[0] https://en.wikipedia.org/wiki/Root_certificate

Re:Facebook has been paying people to install a “Research” VPN by threeseed on Tuesday January 29, 2019 @07:32PM (#19031413)
"root access" has a different meaning than "root certificate"
Re:Facebook has been paying people to install a “Research” VPN by merlincorey on Tuesday January 29, 2019 @08:37PM (#19031784)
Yes, I'm aware of that, which is why I "translated" for the article.
Re:Facebook has been paying people to install a “Research” VPN by saagarjha on Tuesday January 29, 2019 @07:22PM (#19031363)
Any non-pinned connection, since some apps employ certificate pinning on iOS and can't be intercepted without modifying their application binary. This is uncommon, though.
Re:Facebook has been paying people to install a “Research” VPN by minimaxir on Tuesday January 29, 2019 @07:30PM (#19031403)
A notable app that uses certificate pinning is Facebook.
Re:Facebook has been paying people to install a “Research” VPN by Skunkleton on Tuesday January 29, 2019 @07:46PM (#19031491)
Phew, I was worried that facebook would scrape my confidential communication with facebook.
Re:Facebook has been paying people to install a “Research” VPN by 11sdmb8m on Tuesday January 29, 2019 @07:49PM (#19031516)
We all know what "root access" means, and this is not it.
Re:Facebook has been paying people to install a “Research” VPN by joshstrange on Tuesday January 29, 2019 @08:00PM (#19031579)
Agreed, I thought this must be Android then I saw Apple in the article and got really confused. I understood later when I got the root certificate but I've installed a number of those and would never call it "root access". This just allows them to MitM all traffic even TLS.
Re:Facebook has been paying people to install a “Research” VPN by dang on Tuesday January 29, 2019 @08:08PM (#19031626)
Ok, we changed the title to use representative language from the article, which is hopefully more accurate. (Submitted title was "Facebook pays teens to download research app with root access outside App Store".)
Re:Facebook has been paying people to install a “Research” VPN by userbinator on Tuesday January 29, 2019 @08:08PM (#19031632)
Indeed, for a second I thought Facebook had figured out a jailbreak and were paying people to try it out. That would certainly be very interesting news (and provoke even more divisiveness in the comments.)

Fortunately, the title has been edited now to remove "root access".