HOW DID FACEBOOK INTERCEPT ITS COMPETITOR'S ENCRYPTED MOBILE APP TRAFFIC?

Summary from the TLDR Web Dev newsletter

A technical investigation revealed that a decade ago, Facebook, through its Onavo Protect app, intercepted encrypted mobile traffic from users' devices. This was achieved by exploiting a vulnerability in Android's security controls, which allowed Facebook to install a custom certificate authority (CA) certificate on users' devices, enabling it to decrypt HTTPS traffic. This practice, dubbed "SSL bump," was used to target competitor analytics domains like Snapchat, YouTube, and Amazon, granting Facebook insights into their in-app actions.