"Facebook expects partner services to be optimized for smartphones and feature phones, and be free from JavaScript or SSL/TLS/HTTPS elements"
No HTTPS? Really??
No HTTPS? Really??
https://developers.facebook.com/docs/internet-org/platform-t...
> Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities.
Catch that? They can proxy HTTPS for themselves, but they won't proxy HTTPS for "third-party sites."
Thus, Internet.org isn't even neutral between Facebook and other developers; Facebook gets special HTTPS treatment that nobody else can get!
Related, in an interview on Scroll.in: http://scroll.in/article/724975/facebook-opens-up-internet-o...
> Q: Isn’t it strange that Internet.org wants to offer free basic services but has no email?
> A: If an email provider wants to comply with the platform guidelines that we are announcing, Internet.org would be glad to have it.
Well, yeah, but if that means someone would have to offer email service without HTTPS, so anybody can read my email unencrypted or even send email as me, is that even useful?
People won't know the difference but we should. We need to find the root of the problem. So far, it seems the root of the problem is that developing nations do not have access to a fat enough pipe to the Internet backbone. Now, why do developing nations not have a fat enough pipe to the Internet backbone? What's the reason here? We should try to fix that at the same time as we try to improve connectivity.
Just because I'm doing something for free does not mean I can half-ass it. People see my commitment and motivation in all things I do. So far, Facebook seems to really be interested in growth for itself as well as an effective shield against an upstart from upsetting them in the developing world.
My apologies for being cynical but we really need to make the infrastructure issue a bigger priority.
For webmail login it'd be a problem, but email is almost always sent over the Internet in plaintext; those who want encryption and authentication will be using something like PGP.
Since they're just proxying, it makes sense to abandon encryption all together, not? I mean after all, HTTPS is supposed to protect from man-in-the-middle attacks, but aren't they themselves exactly that?
(Given the Indian govt vs Blackberry, I wouldn't be surprised to hear that they had a hand in this somewhere. Very convenient if all mass political organisation goes through unencrypted facebook...)
Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities.
[0]: https://developers.facebook.com/docs/internet-org/platform-t...
“Websites that require high-bandwidth will not be included. Services should not use VoIP, video, file transfer, high resolution photos, or high volume of photos.” — Facebook points out that operators are giving up resources for the project for free, so this is a limit to prevent them totally being taken to the cleaners.
Perhaps HTTPS is too heavy for the large number of users on such crippled networks?
In some developing countries the internet connection costs of an operator can be very significant. High enough that it's been profitable to deploy expensive caches even for non-HTTP protocols, which account for a very small proportion of traffic. In the most extreme cases it's not just that the connectivity is expensive, it's that there's an absolute hard cap on bandwidth for a whole country, which is rationed among all the operators. No amount of money could buy a bigger portion in a sensible amount of time.
https://news.ycombinator.com/item?id=9203946
Although I suppose a bit of steganography is enough...
Edit: steganography, not stenography.