Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Facebook tracks you on Android [video]

media.ccc.de

Post reply on HN
Print view View original

91–100 of 213 posts

Re: How Facebook tracks you on Android [video]

#91

Post by intrasight »

Santosh83 wrote: post #33
bagsvaerd70 wrote: post #27

Earlier quoted context omitted.

Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.

Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.

May as well just go buy physical newspapers and magazines then since few web sites today work without javascipt

Re: How Facebook tracks you on Android [video]

#93

Post by guntars »

ronyfadel wrote: post #82
pointillistic wrote: post #81

I don't have a FB app on my phone, I have a FB account that has no posts. I look at it occasionally to track my "likes". Last week I was a conference in downtown Boston. I have no connection to the conference, I was there to meet my friend's daughter who lives oversees. While standing in line, people watching, I couldn't help but notice an extravagant fellow, I later discovered he was a an out of town PHD student the…

Is there a definitive answer on how these suggestions happen? (Other example: talk about X with someone; start seeing internet ads for X afterwards). Is it coincidence?

For every ad or suggestion that elicits that kind of response, how many are completely unremarkable and immediately forgotten? It’s largely explained by the survivorship bias.

Re: How Facebook tracks you on Android [video]

#94

Post by mic47 »

rock_hard wrote: post #61
IshKebab wrote: post #51

Earlier quoted context omitted.

TL;DR seems to be that lots of apps include the Facebook SDK and when you initialise the SDK it always sends your device ID back to Facebook. Most negative news about Facebook is nonsense but this does seem to be pretty shady on Facebook's part.

Just speculating, but they might just need this information to combat bots actually. Think about it, they already know who you are because you are logged in with your account. They don’t need more info than that to run targeted ads.

> Just speculating, but they might just need this information to combat bots actually.

That would be actually quite useful for fighting bots, but I doubt that is the reason.

My guess would be just gathering telemetry to how how API is used, and what type of android devices are there (you know, like to know what you should support and test on).

Re: How Facebook tracks you on Android [video]

#95

Post by 0xADEADBEE »

intrasight wrote: post #91
Santosh83 wrote: post #33

Earlier quoted context omitted.

Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.

May as well just go buy physical newspapers and magazines then since few web sites today work without javascipt

I've been blocking JS for the last 6 months or so and I've found it to be a greatly improved experience overall. I can enable at the click of a button JS for a website that fails to load properly but the majority of sites I view are fine without this. It was refreshing to learn that not as many websites as I suspected are JS abominations!

Re: How Facebook tracks you on Android [video]

#96

Post by expertentipp »

I seriously loathe the people hating on the web. On the web one can preview, debug, and block stuff at each application and network layer. Use Lynx, disable JS, install ad and tracking blockers, edit hosts file - you are the king. Want to see the true evil? Native Android and iOS applications, there doesn’t exist an alternative platform anymore. You think that app is free? Not even web-style in-app advertisements give you a second thought?

Re: How Facebook tracks you on Android [video]

#97

Post by tokyodude »

blfr wrote: post #15
nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs. EFF has had a proof of concept online for quite a while https://panopticlick.eff.org/ And HN users are probably even more vulnerable since we will have customized our software making…

I'm not totally convinced panopticlick is as real as they claim. Try you're on the west or east coast of the USA and own an 1 or 2 year old iphone try visiting. It will likely tell you you're identifible 1 out of 500k or so. But except for time zone all iPhones of the same model should have the same fingerprint. Pretty much any calcluation on how many iphones 1 or 2 years old in the same time zone will make it clear that 500k is several orders of magnitude off.

I'm not saying you can't finger print, and like you pointed out it's easier on desktop. I'm only pointing out that panopticlick needs some work to be more accurate.

Re: How Facebook tracks you on Android [video]

#98

Post by ucarion »

rock_hard wrote: post #61
IshKebab wrote: post #51

Earlier quoted context omitted.

TL;DR seems to be that lots of apps include the Facebook SDK and when you initialise the SDK it always sends your device ID back to Facebook. Most negative news about Facebook is nonsense but this does seem to be pretty shady on Facebook's part.

Just speculating, but they might just need this information to combat bots actually. Think about it, they already know who you are because you are logged in with your account. They don’t need more info than that to run targeted ads.

Perhaps it has use in bot detection, but:

1. Facebook's "need" to prevent bots ought to be subservient to their need to acquire consent. GDPR requires such consent.

2. It seems quite likely that the persons giving this talk aren't on Facebook.

Re: How Facebook tracks you on Android [video]

#99

Post by samt »

JimDabell wrote: post #72
sfifs wrote: post #34

Earlier quoted context omitted.

> The Android platform API should simply never allow apps to obtain global system identifiers When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs. Thr fact that Apple which…

> Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to They restrict access to most of the things listed above, giving randomised fakes where necessary. The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Pr…

Where do you get that IDFA is unique to the publisher?

Re: How Facebook tracks you on Android [video]

#100

Post by robertAngst »

JimDabell wrote: post #72
sfifs wrote: post #34

Earlier quoted context omitted.

> The Android platform API should simply never allow apps to obtain global system identifiers When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs. Thr fact that Apple which…

> Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to They restrict access to most of the things listed above, giving randomised fakes where necessary. The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Pr…

>I'm not really sure how you can arrive at the conclusion that Apple are holding back; they seem clearly committed to improving privacy as demonstrated by their continuous work in the area.

Given the Apple phone was successfully hacked in the FBI case, I'm not sure why HN seems to think they are the bastion of privacy.

Given the other anti-consumer and anti-developer practices at Apple, I wouldn't trust them to protect privacy(today, and in the future when their stock price takes a hit).

Post reply on HN