Comment by dfabulich | Hacker News Reader

Comment by dfabulich | Hacker News Reader

Parent Full thread

Facebook does NOT have to follow this rule today in its zero-rated India service.

https://developers.facebook.com/docs/internet-org/platform-t...

> Your service will be proxied by Internet.org. Since we cannot support SSL, TLS, or HTTPS as part of proxying, your content or service should not rely on passing or collecting encrypted information — resources that do so will not be accessible within Internet.org or will be dropped altogether. While we would prefer to support fully encrypted connections between user and website in all cases, proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities.

Catch that? They can proxy HTTPS for themselves, but they won't proxy HTTPS for "third-party sites."

Thus, Internet.org isn't even neutral between Facebook and other developers; Facebook gets special HTTPS treatment that nobody else can get!

Related, in an interview on Scroll.in: http://scroll.in/article/724975/facebook-opens-up-internet-o...

> Q: Isn’t it strange that Internet.org wants to offer free basic services but has no email?

> A: If an email provider wants to comply with the platform guidelines that we are announcing, Internet.org would be glad to have it.

Well, yeah, but if that means someone would have to offer email service without HTTPS, so anybody can read my email unencrypted or even send email as me, is that even useful?

> proxying for third-party sites does not allow for this in its current implementation without introducing man-in-the-middle capabilities

Since they're just proxying, it makes sense to abandon encryption all together, not? I mean after all, HTTPS is supposed to protect from man-in-the-middle attacks, but aren't they themselves exactly that?

You can have HTTPS proxies which only connect to a predefined list of IPs if you want. Because this is a surveillance-value-based product, they don't want to do that.

(Given the Indian govt vs Blackberry, I wouldn't be surprised to hear that they had a hand in this somewhere. Very convenient if all mass political organisation goes through unencrypted facebook...)

You would be amazed by the number of webmails that still offer plain HTTP on their login page, and yet people use them. I'd say it's better than no Internet.

> and yet people use them

People won't know the difference but we should. We need to find the root of the problem. So far, it seems the root of the problem is that developing nations do not have access to a fat enough pipe to the Internet backbone. Now, why do developing nations not have a fat enough pipe to the Internet backbone? What's the reason here? We should try to fix that at the same time as we try to improve connectivity.

Just because I'm doing something for free does not mean I can half-ass it. People see my commitment and motivation in all things I do. So far, Facebook seems to really be interested in growth for itself as well as an effective shield against an upstart from upsetting them in the developing world.

My apologies for being cynical but we really need to make the infrastructure issue a bigger priority.

The pipe's fat enough. There's plenty of dark fiber. It's the last mile (wireless) that isn't cheap enough yet, because telcos want to protect themselves from being turned into dumb pipes before the users arrive -- internet.org is their smart pipe card (among similar, competing plans).

so anybody can read my email unencrypted or even send email as me

For webmail login it'd be a problem, but email is almost always sent over the Internet in plaintext; those who want encryption and authentication will be using something like PGP.

No, the vast majority uses opportunistic encryption in transit.

http://www.google.com/transparencyreport/saferemail/

Reply on news.ycombinator.com