Facebook’s Onavo VPN, a Fraudulent App to Steal Yet More User Data

However, even though creating a Facebook account is equivalent to throwing away any hopes of privacy, using a VPN is still one of the best methods to protect the little that’s left of it. This is true not only when accessing social media but other online services, too.

Deceitful products from a mistrustful company

Facebook has surely done many things right over the years as it was a true game changer for the industry when it was launched. It allowed people to connect to each other, find and reunite with childhood friends and provided a new means for companies to advertise their businesses. However, before creating an account on Facebook or on other services that it also owns – like WhatsApp or Instagram – everyone should think about whether it’s worth paying the price of their privacy, as nowadays mobile apps also play an important role in collecting user information.

Onavo was acquired by Facebook in 2013 and the social media company now uses it as a free VPN for mobile, promising full anonymity and protection. However, even when not in use this iOS app collects information about the device it’s installed on, including data about other apps, when they’re used, any cellular information, mobile network codes, daily data usage, websites visited and much more. Moreover, this privacy invasion goes further, detecting and notifying Facebook when a device’s screen turns on or off. The irony is that all this is stated within Onavo’s terms of service as a feature for protecting users’ personal information, not to mention that in the actual Facebook app this VPN is the option for “protect”.

And if this wasn’t bad enough already, in the beginning of March 2018 Facebook released Bolt App Lock, an app that was created by the same team behind Onavo VPN that let users set additional security measures for other apps so that no one else can access them. This included PIN codes, fingerprint recognition and other methods, but after only three days and 50 downloads later it was removed from the app stores after it was discovered that not only did it report device and network information but also tracked how often users were unlocking the ‘protected’ apps. Facebook said that it was just a brief test.

On top of all this, some of the apps even have poor security features that can be exploited by wrongdoers to infect them with all sorts of malware, which is the case with Facebook Messenger, for instance.

The problem of free VPNs

It’s vital to only access Facebook – and its many complementary services – when using a reliable VPN. While it’s true that it doesn’t help much in hiding your personal identifiable information that is handed over to the company as soon as an account is created, doing so would still allow for increased privacy by obfuscating users’ real location and connection information. Likewise, other general measures can be adopted to avoid this large-scale snooping, such as by logging out when visiting websites outside of Facebook or actively cleaning user history and cookies.