Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Facebook tracks you on Android [video]

media.ccc.de

Post reply on HN
Print view View original

71–80 of 213 posts

Re: How Facebook tracks you on Android [video]

#71

Post by jniedrauer »

nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

Using local storage/hardware to track devices is easy mode, but removing those options won't come even close to limiting per-device tracking. You can track clients using entirely serverside techniques. You can also leverage legitimate security features (like HSTS headers) to track clients.

Re: How Facebook tracks you on Android [video]

#72

Post by JimDabell »

sfifs wrote: post #34
nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

> The Android platform API should simply never allow apps to obtain global system identifiers When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs. Thr fact that Apple which…

> Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to

They restrict access to most of the things listed above, giving randomised fakes where necessary. The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Privacy > Advertising > Limit Ad Tracking / Reset Advertising Identifier…). They improve things every year, e.g. Safari's intelligent tracking prevention.

I'm not really sure how you can arrive at the conclusion that Apple are holding back; they seem clearly committed to improving privacy as demonstrated by their continuous work in the area.

Re: How Facebook tracks you on Android [video]

#73

Post by izacus »

scarface74 wrote: post #60
lern_too_spel wrote: post #58

Earlier quoted context omitted.

Because there are some applications that have a real need for knowing the actual MAC address or the IMEI.

Which applications would that be? I’m sure there are applications that need unlimited access to your file system, read your text messages, and read your call logs. How has that worked out for the privacy and security of Android users?

For example any kind of Bluetooth companion app, including sensor readers, watch companion apps and pretty much anything there requires access to MAC to complete pairing. Any kind of mDNS and direct WiFi apps. Any kind of Wifi scanning and environment survey apps. Any kind of Wifi helper apps to setup other devices.

Are you seriously claiming that our portable computers should lock us out from creating these kind of new application experiences permanently and give ONLY Google and Apple the ability to create them? You want innovation in use of our portable computers to be permanently owned and controlled by Google and Apple exclusively?

Come on, think for a while about what you're asking.

Re: How Facebook tracks you on Android [video]

#74

Post by awinter-py »

Is anyone grounded enough in the tech/law here to explain why the app vendor doesn't funnel user data to FB from their backend? Connecting directly to FB seems like an unnecessary giveaway.

Is it just about ease of implementation or are there legal implications? People have quoted the wiretap act to me but the argument doesn't make sense.

Re: How Facebook tracks you on Android [video]

#76

Post by ejcx »

awinter-py wrote: post #74

Is anyone grounded enough in the tech/law here to explain why the app vendor doesn't funnel user data to FB from their backend? Connecting directly to FB seems like an unnecessary giveaway. Is it just about ease of implementation or are there legal implications? People have quoted the wiretap act to me but the argument doesn't make sense.

It has nothing to do with law. That's just the easiest way to send them data, especially when some apps might not have back ends

Re: How Facebook tracks you on Android [video]

#77

Post by beefield »

I'd like to have an app that creates virtual android environments that I can run my apps in. And the possibility to spoof the sensor data for the environment with configurable profiles. Like "rich geek in Silicon Valley traveling occasionally to Caribbean" or maybe "suburban middleclass housewife in Florida".

Re: How Facebook tracks you on Android [video]

#78

Post by em3rgent0rdr »

nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

You can run the Facebook mobile site inside Firefox browser and do all those things. Or use an open source wrapper app like FaceSlim so that the mobile site can feel like an app.

Re: How Facebook tracks you on Android [video]

#79

Post by ephesee »

pavanred wrote: post #69

I am surprised that on opting out of ad tracking in Android, they found that the opt-out flag was set to true, but the size of the tracking payload shot up i.e. more attributes being tracked. Not sure what to make of it? Is it possible its a legal thing that once you opt-out of ads, it enables less risk for the company and therefore more tracking, perhaps?

That would need to be reproduced. I suppose the app itself could also have been put in a different state / with different settings between the two events.

Re: How Facebook tracks you on Android [video]

#80

Post by vageli »

bubblethink wrote: post #70
jklinger410 wrote: post #62

Earlier quoted context omitted.

Tracking may be reduced, but being in F-Droid doesn't really mean anything. Take this on a per-case basis. You would need to check the traffic of each app that you use.

Being on official f-droid categorically means no proprietary sdks. The app could still make calls to random servers, but that would be in the open since the app needs to be open source.

Is that true? F-Droid usually lists apps that I "won't like" because they include non-free software.
Post reply on HN