Live data from Hacker News

How Facebook tracks you on Android [video]

media.ccc.de

181–190 of 213 posts

Re: How Facebook tracks you on Android [video]

#181

Earlier quoted context omitted.

The existence proof is both Windows and Android and all of the spyware, malware, ransomware, and privacy invasion apps. Yes, powerful tools can be abused....You're effectively ceding full control of EVERYTHING you do on your computing device to Google and Apple forever because you're afraid that powerful tool, drivers of innovation and progress, might hurt someone occasionally. You’re speaking as if this is hypotheti…

> The existence proof is both Windows and Android and all of the spyware, malware, ransomware, and privacy invasion apps. But... the existence proof is also Windows and Android and the massive market share and staggering amount of innovation that's happened on those platforms. You're forgetting that many of the capabilities that Apple eventually caved on and added to iOS came directly as a result of Android's "we'll…

But... the existence proof is also Windows and Android and the massive market share and staggering amount of innovation that's happened on those platforms.

The massive market share is because of cheap phones. The average selling price of an Android phone is a 3rd of an iPhone.

And where is this “massive innovation” that is leading to profit either by app makers making apps that can only be made on Android or by device makers? As the old saying goes - “if they are so smart, why aren’t they rich?” The whole Android ecosystem is a race to the unprofitable bottom.

The same can be said about Windows PC makers - thin margins and low profits. Not exactly what I would consider a “success”.

There was a period of time where you couldn't have custom keyboards on iOS. There was a period of time where 3rd party apps on iOS couldn't even multitask.

And when Apple did it, it did it more securely. You can’t just press a confirmation button, the user has to be purposeful and go into settings, the keyboard runs out of process, and even then by default the keyboard doesn’t have network access. The user has to go out of their way to go back into settings to give the keyboard network access and they get a huge warning. Also, when you enter a password, it changes back to the system keyboard.

As far as multitasking, again Apple was more thoughtful and limited multitasking in iOS 4 to not allow a third party app to drain the battery. Even now that they have opened it up more, the user can still granularly control what apps are allowed to run in the background.

There is huge difference between the thoughtfulness of how Apple implements features and how Google implements features.

Re: How Facebook tracks you on Android [video]

#182
post #127

Earlier quoted context omitted.

>On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS. Do you go audit every line of source code in the apps and OS you install? Do you then verify that the binary blobs you're installing were built from the same source? Do you somehow audit the source for the firmware on you…

I trust the community (including the security community) to do a better job at this than a handful of proprietary hardware and software vendors. Yes, it would be nice to have more openness on the hardware side too (and the Librem 5 phone is a worthwhile answer to that) but let's focus on the lowest-hanging fruit first.

How did that work out for HeartBleed bug that was in open source code for over two years?

Even worse, this 11 year old bug in the Linux kernel?

https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...

Re: How Facebook tracks you on Android [video]

#183

Android also had an issue where an app could deceive a user by requesting the permission to manage WiFi (CHANGE_WIFI_STATE) which is considered non-dangerous ("normal") [1] and is granted automatically without any prompts [2]: > If your app lists normal permissions in its manifest (that is, permissions that don't pose much risk to the user's privacy or the device's operation), the system automatically grants those pe…

That's the state of privacy protection on Android. It is difficult to believe that Google developers who are very smart people couldn't foresee it for years.

“It’s difficult to get a man to understand something when his salary depends on him not understanding it”.

Re: How Facebook tracks you on Android [video]

#184

Earlier quoted context omitted.

I trust the community (including the security community) to do a better job at this than a handful of proprietary hardware and software vendors. Yes, it would be nice to have more openness on the hardware side too (and the Librem 5 phone is a worthwhile answer to that) but let's focus on the lowest-hanging fruit first.

How did that work out for HeartBleed bug that was in open source code for over two years? Even worse, this 11 year old bug in the Linux kernel? https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...

Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?

Re: How Facebook tracks you on Android [video]

#185
post #184

Earlier quoted context omitted.

How did that work out for HeartBleed bug that was in open source code for over two years? Even worse, this 11 year old bug in the Linux kernel? https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...

Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?

After two years? How is that better than closed source?

Re: How Facebook tracks you on Android [video]

#186

Earlier quoted context omitted.

> And we have 30+ years of user behavior of computer users and almost 10 years of mobile user behavior with Android to know that most users aren’t going to give “extra scrutiny” to those applications and are just going to click “allow”. A much better example is the massive XCodeGhost infection on the app store. Apple relies entirely on users for figuring out if things are misbehaving, while Android also has automated…

By having the app removed from the store. Which Apple is unable to do because it doesn't allow third party security researchers to scrutinize its app store. This resulted in the massive XCodeGhost infection, which Apple couldn't fully remove from their store for weeks after. XCodeGhost was first found by Alibaba - a third party.

It was first found by Chinese developers who found it in their own apps. Neither they nor Ali Baba had any idea what other apps were affected. Ali Baba did some additional research to track down how the apps were infected. The malware was disclosed by Chinese iOS developers and analyzed by Alibaba researchers

Re: How Facebook tracks you on Android [video]

#187

Earlier quoted context omitted.

> The existence proof is both Windows and Android and all of the spyware, malware, ransomware, and privacy invasion apps. But... the existence proof is also Windows and Android and the massive market share and staggering amount of innovation that's happened on those platforms. You're forgetting that many of the capabilities that Apple eventually caved on and added to iOS came directly as a result of Android's "we'll…

But... the existence proof is also Windows and Android and the massive market share and staggering amount of innovation that's happened on those platforms. The massive market share is because of cheap phones. The average selling price of an Android phone is a 3rd of an iPhone. And where is this “massive innovation” that is leading to profit either by app makers making apps that can only be made on Android or by devic…

> The massive market share is because of cheap phones.

The cheap phones are because Google allows 3rd-party OEMs to install Android on their own devices, even though that carries an extra risk of having an outdated phone, or a 3rd-party back door, or just a crappy experience that degrades the overall Android brand. It's the exact same thing we're talking about -- Apple doesn't do that because they think giving random device makers that much control is insecure and hurts their brand. It doesn't mean that Apple's approach is wrong. But I'm glad that both exist.

> And when Apple did it, it did it more securely.

This isn't an iOS vs Android contest. It doesn't matter who has the better implementation.

Apple started from a perspective of "You don't need multitasking." Consumers widely said, "Yeah, we do. Those phones have it and we want it." Apple said, "fine, but we'll do it our way." Everybody won, because some people went out and did the experimental hacky thing, and Apple looked at them and said, "you know what, it has issues, but I guess that is worth supporting."

> And where is this “massive innovation” that is leading to profit either by app makers making apps that can only be made on Android or by device makers?

Innovation != profit. Otherwise, Open Source communities would be a lot richer. My metrics for user success are not primarily based on corporate profit margins, but the short answer to why people aren't getting rich on Android is because the app market as a whole on both iOS and Android is a race to the bottom. It just so happens that Android's bottom is slightly lower than Apple's is.

There certainly are apps on Android that can't exist on iOS though, if that's what you're getting at. Off the top of my head, the iOS equivalents of Tasker are way underpowered next to what's being offered on Android. 3rd-party non-Gecko web browsers still aren't supported on iOS, which actually does matter because the iOS browser engine is lagging on multiple web standards. Look backwards a little ways, and you have the swipe keyboard style, which started out as a 3rd-party app on Android and (I suspect) was a big part of Apple deciding to back-down on their 3rd-party keyboard restrictions. Go back even farther and you had 3rd-party tethering apps. On the OEM side, there are people who still swear by the Note series, and Apple seems pretty adamant that they're not interested in pursuing phone styluses. They're probably not gonna ever break on that, but I am about 65-75% sure that within 5-7 years Apple's gonna break down on touchscreen laptops; I feel like the convertible market is going to eventually be too big for them to ignore.

One big thing for me personally is that I use a file manager on Android to handle syncing -- I basically treat my phone like a USB drive. A really nice part of that is it's all web-based. I don't have anything installed on my computer, I can boot up essentially a local server from my phone and drag videos/music into or out of any app's data storage from any computer with a web browser. Even from other phones :)

Again, this doesn't mean that Android is better than iOS. It means iOS and Android serve different niches. If you like the iOS niche, that's great. Some people genuinely like the Android niche; they're not just buying Google phones because they're poor. The high-end Pixel phones sell.

Re: How Facebook tracks you on Android [video]

#188
post #184

Earlier quoted context omitted.

Heartbleed was found and fixed, and diagnostic tools quickly followed. OSS isn’t a panacea, but it’s something, no?

After two years? How is that better than closed source?

Try 15 years. https://www.v3.co.uk/v3-uk/news/3023669/happy-new-year-heres...

Re: How Facebook tracks you on Android [video]

#189

Earlier quoted context omitted.

But... the existence proof is also Windows and Android and the massive market share and staggering amount of innovation that's happened on those platforms. The massive market share is because of cheap phones. The average selling price of an Android phone is a 3rd of an iPhone. And where is this “massive innovation” that is leading to profit either by app makers making apps that can only be made on Android or by devic…

> The massive market share is because of cheap phones. The cheap phones are because Google allows 3rd-party OEMs to install Android on their own devices, even though that carries an extra risk of having an outdated phone, or a 3rd-party back door, or just a crappy experience that degrades the overall Android brand. It's the exact same thing we're talking about -- Apple doesn't do that because they think giving random…

This isn't an iOS vs Android contest. It doesn't matter who has the better implementation.

In a thread about how Facebook invades users’ privacy because of lax security controls on Android, it does matter that one method of allowing third party keyboards is “secure” and the other isn’t.

Innovation != profit. Otherwise, Open Source communities would be a lot richer. This is like saying, "well if newspapers have such good reporting, why aren't they making money?" Because the app market as a whole on both iOS and Android is a race to the bottom. It just so happens that Android's bottom is slightly lower than Apple's is.

One of the posts in this thread was talking about “entrepreneurship” a Nd business opportunities that can’t exist because of Apple’s policy. If that were true, you should see a blossoming of business opportunities that exist on Android.

Go back even farther and you had 3rd-party tethering apps.

Tethering restrictions was the one thing that Apple did to cowtow to phone providers. Why would Apple care about third party tethering otherwise?

One big thing for me personally is that I use a file manager on Android to handle syncing -- I basically treat my phone like a USB drive. A really nice part of that is it's all web-based. I don't have anything installed on my computer, I can boot up essentially a local server from my phone and drag videos/music into or out of any app's data storage from any computer with a web browser. Even from other phones :

There are plenty of apps that do that with the iPhone. But, all of the cloud storage apps have web interfaces that you can copy files to and from.

The high-end Pixel phones sell.

Barely....

Estimates are that Google sells about 4 million phones in a year - the same number Apple sells in a week.

https://www.theverge.com/2018/2/13/17007104/google-pixel-tot...

And if Andy Rubin can’t convince people to buy high end Android phones - the Essentisl phone - who can?

Re: How Facebook tracks you on Android [video]

#190

Earlier quoted context omitted.

Tracking may be reduced, but being in F-Droid doesn't really mean anything. Take this on a per-case basis. You would need to check the traffic of each app that you use.

Being on official f-droid categorically means no proprietary sdks. The app could still make calls to random servers, but that would be in the open since the app needs to be open source.

Okay but "proprietary sdks" are not the only thing that tracks you in an app.
Post reply on HN