Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Three quarters of Android apps track users with third party tools

theguardian.com

Post reply on HN
Print view View original

71–80 of 102 posts

Re: Three quarters of Android apps track users with third party tools

#71

Post by jtmcmc »

lightswitch05 wrote: post #38
guelo wrote: post #24

This is a bit alarmist. I develop a popular app that has no advertising but I still ship mixpanel and crashlytics. I do that because I need to know how people are using the app in order to make the app better. That's it. If the app crashes and I don't know about it then I can't fix it and my users would hate me. Without these tools the apps would be worse.

I believe the point of the article is that the data belongs in 3rd party hands. You might not be doing anything nefarious with the data, but that data does not belong to you and it is outside of your control to protect your users. Given IP addresses, device identifiers, application identifiers, and timestamps - these 3rd party applications now have some pretty valuable signals that can be aggregated with other signal…

many of those third parties do not own the data - the data is owned by whoever's account (will obviously vary).

Re: Three quarters of Android apps track users with third party tools

#72

Post by shostack »

devmunchies wrote: post #65
shostack wrote: post #62

Earlier quoted context omitted.

I'm a good example of this. I'm an ad guy and a marketer, and as such I'm much more intimately familiar with how this stuff works, what it collects, and how it is used than most. I'm also going to expand what I say beyond just the world of apps, because it is really applicable to anything digital these days, whether it is in an app or on the web, because I hate thinking of those things in silos. To be a successful ma…

I worked on a growth team so I confirm that you need data, but you can do a lot with agregate data. For example, you can run a campaign and see how that influences high-level metrics like total pagelands (using some kind of first-touch attribution model) and stuff like that. You don't always need individual user data points.

I agree that most of what I care about is typically aggregate anonymous (to me) data.

The nuance here though is that this data is often NOT anonymous or aggregate to the 3rd parties providing this tracking and collecting this data. Google and FB absolutely apply this data to an individual profile level. So while I might only see the anonymous aggregate data, my decision to include their tracking means I am making a decision on behalf of my users/visitors to share that data to parties for whom it will not be anonymous or aggregate, and it isn't a decision I take lightly.

There is obviously legal protection in the form of Privacy Policies and ToS, but I feel there's an implicit social contract here as well.

Re: Three quarters of Android apps track users with third party tools

#73

Post by kitsunesoba »

I can’t say I’m thrilled with using Crashlytics in my own iOS apps, but I’m not aware of any better options when it comes to crash tracking. A handful of crashes come in through Apple’s opt in crash report sharing but when compared to the data I’m getting from Crashlytics, it’s clear that a lot of info is missing. If I relied only on manually submitted bug reports and what Apple is telling me, I never would’ve come to know about many of the bugs I’ve fixed. Better testing could’ve caught some of them, but many just won’t surface in any other place except out in the wild.

Is increased privacy worth decreased stability? I won’t claim to know the answer to that question, but I suspect it’s more murky than some think, especially when you have paid customers who expect a throughly solid product for their money.

Re: Three quarters of Android apps track users with third party tools

#74

Post by ryuuchin »

nucleartacos wrote: post #5

I don't get it. If you're in IT in any role, you know this is happening. I install zero apps on my iPhone. I don't need them. Banking and other secure things are more properly done on a desktop or laptop running some form of nix with proper security in place. I would never access my bank or other secure website with crucial information via a mobile phone. Call me an anachronism should you wish, but I've never had the…

For most users though you actually get better security guarantees if you do that stuff on an iPhone/iPad (or Chromebook I suppose).

Re: Three quarters of Android apps track users with third party tools

#75

Post by pdkl95 »

shostack wrote: post #72
devmunchies wrote: post #65

Earlier quoted context omitted.

I worked on a growth team so I confirm that you need data, but you can do a lot with agregate data. For example, you can run a campaign and see how that influences high-level metrics like total pagelands (using some kind of first-touch attribution model) and stuff like that. You don't always need individual user data points.

I agree that most of what I care about is typically aggregate anonymous (to me) data. The nuance here though is that this data is often NOT anonymous or aggregate to the 3rd parties providing this tracking and collecting this data. Google and FB absolutely apply this data to an individual profile level. So while I might only see the anonymous aggregate data, my decision to include their tracking means I am making a d…

> I am making a decision on behalf of my users/visitors to share that data to parties for whom it will not be anonymous or aggregate, and it isn't a decision I take lightly.

A suggestion: that decision should be evaluated under the assumption that:

1) data doesn't go away (any data collected or sent to a 3rd party is usually permanent)

2) theft and accidental leaks happen, and

3) we don't know the worst ways data - of any type - can be abused, because those techniques haven't been invented yet (powerful analysis techniques are being invented at an incredible rate).

The combination of these properties means that collecting and storing data creates unbounded risk. At any point in the future someone might invent a truly horrific way to abuse the stored data that was collected perhaps decades earlier.

Humans are used to information being transient. Information decayed over time as memories were forgotten, paper/parchment/etc decayed over time. Books had to be copied to they risked being lost forever when the library burned. Claude Shannon's digital signals fundamentally changed all of that as they made it possible to automatically preserve information perfectly. Unfortunately, human intuition hasn't caught up to the idea of permanent data.

The question "Should I trust $THIRD_PARTY with this data?" misses the full nuance of what is actually being risks. A better question is "Should we trust $THIRD_PARTY and anybody who buys/steals/subpoenas/etc it from $THIRD_PARTY with this data? What if they have analysis capabilities far more advanced than current techniques?".

Re: Three quarters of Android apps track users with third party tools

#76

Post by j_s »

What alternatives are out there for mobile developers?

Is there an open source Android and/or iOS equivalent allowing self-hosting analytics like Piwik does for web (without a 3rd party)? Piwik does ship an Android SDK; anyone have experience to compare to 3rd party options?

https://github.com/piwik/piwik-sdk-android

Hat tip to user johnny_and1 for mentioning ACRA for Android crash reporting elsewhere in this thread. Are there any similar libraries for iOS?

https://github.com/ACRA/acra

Re: Three quarters of Android apps track users with third party tools

#77

Post by harryf »

johnny_and1 wrote: post #44
marpstar wrote: post #19

Earlier quoted context omitted.

Exactly this. We're constantly told not to "roll our own X", making paid offerings like Azure App Insights, which is more robust than any hand-rolled solution we could ever develop, so appealing. We're not trying to sell the user, or their data. We just want to know which features are being used and whether or not it's meeting our performance criteria, thus doing the user a favor by meeting those criteria.

The problem is not informing the user that you use SDKs from third party providers, although using them for login services (Facebook, Google+, twitter) or tracking (Crashlytics, Microsoft App Insights). The other problem is not knowing exactly what these SDKs can collect. They basically have the same permissions as the apps that include them. Crashlytics will collect and send location data alongside bug reports if th…

This is certainly a good move. The Facebook SDK for example is widely used by many apps for Facebook ad performance tracking and analytics and that's something he public should be aware of.

See https://medium.com/ios-os-x-development/libraries-used-in-th... for example

Re: Three quarters of Android apps track users with third party tools

#78

Post by JumpCrisscross »

cageface wrote: post #48
sixbrx wrote: post #15

"Many of these trackers are also available in the Apple iOS app store, though technical and legal barriers limit privacy and security analysis ." https://law.yale.edu/yls-today/news/isp-privacy-lab-publishe... And from https://boingboing.net/2017/11/25/la-la-la-cant-hear-you.htm... : "As Exodus and Yale note, these trackers are almost certainly also present in iOS: the companies that make them advertise their iOS com…

In four years of developing iOS apps I can't think of a single client that didn't want some kind of third party analytics service installed. This is SOP for pretty much anybody trying to drive user growth on mobile and isn't specific to one platform or the other.

Would it be more pro-privacy than anti-developer if Apple sensible integrated such analytics into its platform?

Re: Three quarters of Android apps track users with third party tools

#79

Post by unethical_ban »

aesh2Xa1 wrote: post #55
unethical_ban wrote: post #23

I wish I could edit the hosts file of Android devices without root. Barring that, I wish I could force a DNS server for both wi-fi and mobile data links, which I believe also requires root. Either one of these options would allow the use of DNS blackholing for adware/malware domains. Without it, protecting yourself on mobile is that much more difficult.

I think you can use DNS66 for WiFi and LTE. It creates a VPN, which is really just a local proxy that you have on all the time. All traffic goes thru it.

Shoutout to this service - from what I can tell it is the least concerning of several options in terms of data leakage and trust. At the least, it seems to work after testing several domains blacklisted through Steven Black's host file on Github.

Re: Three quarters of Android apps track users with third party tools

#80

Post by cageface »

JumpCrisscross wrote: post #78
cageface wrote: post #48

Earlier quoted context omitted.

In four years of developing iOS apps I can't think of a single client that didn't want some kind of third party analytics service installed. This is SOP for pretty much anybody trying to drive user growth on mobile and isn't specific to one platform or the other.

Would it be more pro-privacy than anti-developer if Apple sensible integrated such analytics into its platform?

Apple does now offer integrated analytics in iOS but it's pretty limited compared to what the third party services offer so it's not really a viable replacement for most people yet.
Post reply on HN