After Free Basics Program, Facebook launches 'Discover' - a Secure Proxy

Facebook, after Free Basics program, is back again with new zero-rating initiative called Discover. The service, available as a mobile web and Android app, allows users to browse the internet using free daily data caps.

Facebook Discover is currently being tested in Peru in partnership with local telecom companies such as Bitel, Claro, Entel, and Movistar.

Unlike the regular rich-content browsing, Facebook's latest connectivity project only provides low-bandwidth text-only based browsing; meaning other forms of data-intensive content such as audio and video are not supported.

Another key differentiator is that it treats all websites equally, whereas users of Free Basics are limited to a handful of sites that are submitted by developers and meet technical criteria set by Facebook.

The move, ultimately, drew criticism for violating principles of net neutrality, leading to its ban in India in 2016.

A lot similar to Free Basics in that all traffic is routed through a proxy, the device only interacts with the proxy servers, which acts as a "client" to the website users have requested for.

This web-based proxy service runs within a whitelisted domain under "freebasics.com" that the operator makes the service available for free which then fetches the webpages on behalf of the user and deliver them to their device.

The tag, which is embedded in every proxy response, is then compared with the 'ickt' on the client-side to check for any signs of tampering. If there's a mismatch, the cookies are deleted. It also makes use of a "two-frame solution" that embeds the third-party site within an iframe that's secured by an outer frame, which makes use of the aforementioned tag to ensure the integrity of the content.

But for websites that disable the loading of the page in a frame to counter clickjacking attacks, Discover works by removing that header from the HTTP response, but not before validating the inner frame.

Furthermore, to prevent impersonation of the Discover domain by phishing sites, the service blocks navigation attempts to such links by sandboxing the iframe, thus preventing it from executing untrusted code.

 "This architecture has been through substantial internal and external security testing. We believe we have developed a design that is robust enough to resist the types of web application attacks we see in the wild and securely deliver the connectivity that is sustainable for mobile operators," concluded ," Facebook's engineering team.