> Fortify’s inclusion of Facebook’s Pixel isn’t just a privacy issue, it’s a security problem. While testing the app, we also noticed that the password to our account was sent in plaintext to Facebook in the URL of the tracking requests. Facebook claims to have filtering mechanisms to prevent its systems from storing this type of personal information, but Fortify’s apparent oversight is still concerning to experts like Galperin. “That’s a huge vulnerability,” she says. “It’s the sort of behavior that makes me feel like they don’t have security experts reviewing the app or its policies.”
> After being notified of the password issue, Olsen said Fortify would stop transmitting users’ unencrypted passwords to Facebook. As we went to press, the issue had not yet been addressed.
Oftentimes lost in these discussions (even in the posts here so far), is the fact that what is discussed is often done so under the implicit assumption that these tools are written perfectly. But a key consideration with regard to privacy is precisely that that is rarely the case. Even if you think these tools are hypothetically useful, you have to bake into the equation the relatively high probability that all this information will end up hacked and leaked to the public. Under those conditions I feel that it becomes pretty hard to defend these apps.