Well, this is a transcendent level of evil: Facebook bought a VPN company and deployed it, in part, to spy on its competitor's users.
https://techcrunch.com/2024/03/26/facebook-secret-project-snooped-snapchat-user-traffic/
It's a reminder that VPNs have their own risks, beyond technical ones if operated incompetently -- namely, that you have to trust the VPN company itself.
UPDATED to reflect which users were being spied on.
Yeah, it doesn't make sense to me either, unless snapchat is downloading encryption keys dynamically? Then you can MITM the key download, give the snapchat app your key, while storing the snapchat server key for your middleman use. Then the app sends you traffic encrypted with your key, your MITM server decrypts it to plaintext, makes a copy for "research", then re-encryps the plaintext with the snapchat-supplied key and sends it off to snapchat.
Dan Gillmor
charlag
Artemesia