EFF: Powerful Permissions, Wimpy Warnings: Installing a Root Certificate Should be Scary
Powerful Permissions, Wimpy Warnings: Installing a Root Certificate Should be Scary More lessons from “Facebook Research” Last week, Facebook was caught using a sketchy market research app to gobble large amounts of sensitive user activity after instructing users to alter the root certificate store on their phones. A day after, Google pulled a similar iOS “research program” app. Both of these programs are a clear breach of user trust that we have written about extensively . This news also drew attention to an area both Android and iOS could improve on. Asking users to alter root certificate stores gave Facebook the ability to intercept network traffic from users’ phones even when that traffic is encrypted, making users’ otherwise secure Internet traffic and communications available to Facebook. How the devices alert users to this possibility—the “UX flow”—on both Android and iOS could be improved dramatically. To be clear, Android and iOS should not ban these ...