On: Is Facebook eavesdropping on phone conversations?

[eric_h]

Would a jailbreak really be necessary for this? Couldn't you just install a certificate on the phone and MitM the https traffic?

[superuser2 → eric_h]

Not if the app is certificate pinning (and from a security perspective, it ought to).

[eric_h → superuser2]

Is this a common thing for apps to do, yet? I was under the impression that there are some corporate networks which treat MitMing ssl connections as a business necessity. Would Facebook et. al. allow their apps to stop functioning on networks like that?

[superuser2 → eric_h]

I can't imagine an enterprise which would MITM employee web browsing but not block Facebook. Come to think of it, I can't imagine an enterprise that would MITM employee web traffic but allow personal smartphones on the network.

[eric_h → superuser2]

Ha. Yes, fair enough. But, presuming they didn't, would it not be in facebook's best interest to allow their app to still work, perhaps with a visible warning?

[madmax96 → eric_h]

That would be a lot simpler:)