Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Facebook tracks you on Android [video]

media.ccc.de

Post reply on HN
Print view View original

141–150 of 213 posts

Re: How Facebook tracks you on Android [video]

#141

Post by lucb1e »

rock_hard wrote: post #61
IshKebab wrote: post #51

Earlier quoted context omitted.

TL;DR seems to be that lots of apps include the Facebook SDK and when you initialise the SDK it always sends your device ID back to Facebook. Most negative news about Facebook is nonsense but this does seem to be pretty shady on Facebook's part.

Just speculating, but they might just need this information to combat bots actually. Think about it, they already know who you are because you are logged in with your account. They don’t need more info than that to run targeted ads.

But I'm not logged in to Facebook? I don't use their platform but apps on my phone have the Facebook sdk. What bot protection?!

Re: How Facebook tracks you on Android [video]

#142

Post by username223 »

freedomben wrote: post #86
Santosh83 wrote: post #33

Earlier quoted context omitted.

Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.

This 100%. It will also make your web experience a lot better because so much of the javascript out there just does things you don't want anyway, such as loading ads and displaying popups. If you are a web developer or are familiar with web terminology like origins, domains, frames, XHR, etc on the web, and are willing to put in some time learning how to use it (15 mins for a seasoned web dev, maybe 30-60 mins otherw…

> so much of the javascript out there just does things you don't want

JavaScript developers should ask themselves if they want JS to become the popup of the 2010s: initially well-intentioned, shamelessly abused, universally loathed, and ultimately killed.

Re: How Facebook tracks you on Android [video]

#143

Post by pointillistic »

Spooky23 wrote: post #123
pointillistic wrote: post #81

I don't have a FB app on my phone, I have a FB account that has no posts. I look at it occasionally to track my "likes". Last week I was a conference in downtown Boston. I have no connection to the conference, I was there to meet my friend's daughter who lives oversees. While standing in line, people watching, I couldn't help but notice an extravagant fellow, I later discovered he was a an out of town PHD student the…

They use geolocation extensively. You probably were in proximity long enough to have triggered something. You never know — your friends daughter may have been in the same line somewhere at the airport or a lounge as well. I used to get this a lot as I’m 1-2 degrees of separation from some highish profile people. FB seems to adapt and move on to a different strategy over time.

I don't have the app on my phone so how do they use geolocation? Perhaps as this article describes?

Re: How Facebook tracks you on Android [video]

#144

Post by codedokode »

Android also had an issue where an app could deceive a user by requesting the permission to manage WiFi (CHANGE_WIFI_STATE) which is considered non-dangerous ("normal") [1] and is granted automatically without any prompts [2]:

> If your app lists normal permissions in its manifest (that is, permissions that don't pose much risk to the user's privacy or the device's operation), the system automatically grants those permissions to your app.

But the app could use it to determine user's location (by scanning for WiFI access points identifiers) without any notification. So the user wouldn't realise that the app now knows their location.

You can see it in the docs [3]:

> Android 8.0 and Android 8.1:

> A successful call to WifiManager.getScanResults() requires any one of the following permissions:

> CHANGE_WIFI_STATE

So this issue was fixed only on Android 9, and had been working for years. Any application could secretly determine your location. That's the state of privacy protection on Android. It is difficult to believe that Google developers who are very smart people couldn't foresee it for years.

I googled a little and found a confirmation that this method was working: [4]

[1] https://developer.android.com/reference/android/Manifest.per...

[2] https://developer.android.com/guide/topics/permissions/overv...

[3] https://developer.android.com/guide/topics/connectivity/wifi...

[4] https://blog.trustlook.com/2015/06/02/how-apps-tracking-your...

Re: How Facebook tracks you on Android [video]

#145

Post by codedokode »

JimDabell wrote: post #103
samt wrote: post #99

Earlier quoted context omitted.

Where do you get that IDFA is unique to the publisher?

Apologies, I'm conflating two slightly different things there. There's the identifierForVendor [0] which is unique to the publisher. This is pretty safe to use however you see fit (within reason). Then there's the advertisingIdentifier [1], which is not unique, but can easily be permanently zeroed out by the user. Apple also have some fairly stringent rules about how it can be used [2], not to mention further rules a…

Cannot these restrictions be lifted if you write that the user agrees to sharing all of their data for any purposes somewhere between the lines of a 20-page Privacy Policy?

Re: How Facebook tracks you on Android [video]

#146

Post by trishmapow2 »

nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

For the power-users out there there is a solution, install Xposed[0] on your device (root and custom recovery required of course) and then XPrivacyLua[1] which provides fine controls allowing you to hide identifiers (ad IDs etc), tracking, activity, applications installed, network info, analytics and much more for each app. Best part is it sends fake data to make sure apps don't crash or complain.

[0]: https://forum.xda-developers.com/showthread.php?t=3034811

[1]: https://github.com/M66B/XPrivacyLua

Re: How Facebook tracks you on Android [video]

#147

Post by lern_too_spel »

scarface74 wrote: post #88
lern_too_spel wrote: post #66

Earlier quoted context omitted.

Much better than the privacy and security of iOS, which has had hundreds of millions of users infected with XCodeGhost. All while allowing much more useful applications to be built. The fact that the application must request permission to see that data gets those applications extra scrutiny from not only the user but the app store and third party security researchers as well.

And we have 30+ years of user behavior of computer users and almost 10 years of mobile user behavior with Android to know that most users aren’t going to give “extra scrutiny” to those applications and are just going to click “allow”. And even if “security researchers” do find an issue with an Android app, how does that information get disseminated to users? Even if Google decides to close the hole, Android doesn’t e…

> And we have 30+ years of user behavior of computer users and almost 10 years of mobile user behavior with Android to know that most users aren’t going to give “extra scrutiny” to those applications and are just going to click “allow”.

A much better example is the massive XCodeGhost infection on the app store. Apple relies entirely on users for figuring out if things are misbehaving, while Android also has automated detection and the third party security ecosystem, as I pointed out in the comment you replied to.

> And even if “security researchers” do find an issue with an Android app, how does that information get disseminated to users?

By having the app removed from the store. Which Apple is unable to do because it doesn't allow third party security researchers to scrutinize its app store. This resulted in the massive XCodeGhost infection, which Apple couldn't fully remove from their store for weeks after.

> Even if Google decides to close the hole, Android doesn’t exactly have a great track record of getting updates to users.

The whole point is that it's not a hole. It's an app abusing an API. The correct thing to do is to simply remove the app from the store, which is exactly what happens.

Re: How Facebook tracks you on Android [video]

#148

Post by lern_too_spel »

scarface74 wrote: post #129
lern_too_spel wrote: post #54

Earlier quoted context omitted.

The Android advertising ID is exactly the same as the iOS IDFA. Both companies enforce policies on using those identifiers for apps published on their app stores. https://support.google.com/googleplay/android-developer/answ... https://www.businessinsider.com/ifa-apples-iphone-tracking-i...

You're responsible for ensuring your apps are in compliance with policies regarding its usage, as well as all Play policies. And the developer will pinky promise that they won’t abuse it....

As the comment you're replying to pointed out, it's exactly the same as on iOS. In both cases, rogue publishers get banned.

Re: How Facebook tracks you on Android [video]

#149

Post by megous »

ziont wrote: post #112
jradd wrote: post #105

Wrangling 3rd party application access to platform providers' suite (ios, android, browser extensions). Cookies seem to be the majority of the aggregate identity/behavior data, which you can use various rules in the protocol to limit tracking to some extent. I've found that opting out on a regular basis of the large adverts for a little extra peace of mind. uBlock/uMatrix Origin, ghostery, duck.com, dns encryption, v…

one thing that irks me is ppl blindly suggesting duckduckgo over google DDG is fucking horrible It doesn't work. I'm almost always going back to Google. There should be a service that searches Google for you behind 7 proxies.

DDG is unusable from keyboard alone. Whenever battery in my mouse runs out, I have to switch to something else. It's one of those web apps where designers disabled focus outlines, because they don't find them pretty.

Re: How Facebook tracks you on Android [video]

#150

Post by detaro »

megous wrote: post #149
ziont wrote: post #112

Earlier quoted context omitted.

one thing that irks me is ppl blindly suggesting duckduckgo over google DDG is fucking horrible It doesn't work. I'm almost always going back to Google. There should be a service that searches Google for you behind 7 proxies.

DDG is unusable from keyboard alone. Whenever battery in my mouse runs out, I have to switch to something else. It's one of those web apps where designers disabled focus outlines, because they don't find them pretty.

They have their own shortcuts for the basics: j/k or arrows for jumping between entries, (ctrl+)enter to open (in background tab). Doesn't excuse hiding focus outlines though.
Post reply on HN