Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

181–190 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#181

Post by dylan604 »

robin_reala wrote: post #90

Can you imagine the mental hoops you’d need to jump through as a developer to persuade yourself that this is a valid thing to implement?

I mean, it is kind of a cool work around. There's a lot of motivation in telling someone they can't do something where "hide and watch" is a pretty typical response. The creative thinking that comes up with ideas like this is not something to discourage. It is a shame that the effort is for such a shit purpose, but these "people" are not stupid, and not many other areas offer these kind of challenges.

Re: Covert web-to-app tracking via localhost on Android

#182

Post by genewitch »

nickphx wrote: post #180
lucianbr wrote: post #164

Earlier quoted context omitted.

Unauthorized access to a computer system. I'm sure if I connected to some port on a computer belonging to Meta without them wanting it, that would be the crime I would be charged with. But somehow if Meta connects to a port on my phone without me agreeing to it, it's not a crime?

Yes.. and that listening service is their software that you installed on your device... So caveat emptor.

Software that came preloaded with what sounds suspiciously like a rootkit to keep the background service running on some phones.

Please don't "don't that phone then" because it's the same all the way down to rotary telephones.

I still didn't consent to meta tracking me on my telephone. I understand the shadow profiles and tracking pixels and whatnot, but cmon.

Next year "actually meta was listening to conversations captured by android devices and using it to target ads"

Don't use a cellphone? Meta and Google track desktop web use. Don't use a computer? Okay, that's cool.

Re: Covert web-to-app tracking via localhost on Android

#183

Post by microtonal »

johnisgood wrote: post #168
microtonal wrote: post #151

Earlier quoted context omitted.

I am not sure which Meta apps open ports, but e.g. Samsung phones come with a bunch of Meta apps pre-shipped. IIRC just removing the Facebook app is is not enough, there is another service installed that is not visible as an app (com.facebook.services etc.), which you can only uninstall from the data partition with something like ADB/UAD. Or buy an iPhone or a Pixel.

I tend to buy stock Android, e.g. Motorola moto g30, etc. It still has lots of Google stuff, but you can get rid of them, and I have a work profile specifically designed for Google-related stuff, and my personal profile is de-Googled as much as possible.

I would recommend everyone who wants a clean Android to look into Google Pixel phones. Aside from being mostly bloat-free (and most bloat can be uninstalled), it is one of the few phones that supports unlocking/relocking and a secure open source alternative (GrapheneOS).

Re: Covert web-to-app tracking via localhost on Android

#184

Post by arunkant »

easterncalculus wrote: post #173
josephcsible wrote: post #171

Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?

For one I think it would break all those "update your BIOS via your motherboard website" apps that probably shouldn't exist anyways. There probably are some legitimate uses, but I'm straining to come up with them.

Maybe just ask for confirmation

Re: Covert web-to-app tracking via localhost on Android

#185

Post by chedabob »

josephcsible wrote: post #171

Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?

I thought they did for resources and JS, which is why Meta have to use WebRTC instead?

I think the Yandex one slips through because CORS does a naive check against just what's in the header, not what it resolves to?

Re: Covert web-to-app tracking via localhost on Android

#186

Post by chedabob »

Does the Yandex HTTPS one mean they're shipping the private key for their cert in the app, therefore anything running on localhost (or on a network with poisoned DNS) can spoof the yandexmetrica site?

There is a cert for it in the logs: https://crt.sh/?q=yandexmetrica.com

Re: Covert web-to-app tracking via localhost on Android

#188

Post by Hilift »

voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

Reddit has fairly extensive device fingerprinting. And they are selling data for training AI models. It's only a matter of time before there is some premium phone app that monetizes data that otherwise isn't available/for sale.

Re: Covert web-to-app tracking via localhost on Android

#189

Post by bravesoul2 »

lxgr wrote: post #175
d4mi3n wrote: post #174

Earlier quoted context omitted.

While I agree with your reasoning, in my experience any statement where I prepend "hopefully" usually ends up being the worst possible interpretation in practice.

What I mean is: If a corporate internal website regularly connects to unauthenticated local ports and leaks sensitive data out , that's fully on them. If they are trying to fingerprint the "private compartment" of a BYOB device, that seems roughly as bad as a non-corporate side doing the same.

You can easily click a link e.g. to a blog post on Chrome inside your profile.

E.g. a Jira ticket links to a post on how to do something concurrency related in Python.

I get your point thought that maybe this is no worse than if they visit the site on the personal side.

However I wouldn't trust out lack of imagination on how to exploit this to be happy about the security gap!

Re: Covert web-to-app tracking via localhost on Android

#190

Post by Hilift »

kriro wrote: post #44

The EU should set some record breaking fines for this. Maybe it's time to invent a tax that starts at 0% and goes up 1-X% every time your hand is cought in the cookie jar. And add a corresponding website where you can clearly see all violations by company.

Meta makes $70 billion net per year, after fines.
Post reply on HN