Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

21–30 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#21

Post by jeroenhd »

A quite obvious attack mechanism, I'm surprised browsers permitted this in the first place. I can't think of a reason to STUN/TURN to localhost. Aside from localhost, trackers can also use all other IP addresses available to the browser to bind their apps/send traffic to.

Now that the mechanism is known (and widely implemented), one could write an app to notify users about attempted tracking. All you need to do is to open the listed UDP ports and send a notification when UDP traffic comes in.

For shit and giggles I was pondering if it was possible to modify Android to hand out a different, temporary IPv6 address to every app and segment off any other interface that might be exposed just because of shit like this (and use CLAT or some fallback mechanism for IPv4 connectivity). I thought this stuff was just a theoretical problem because it would be silly to be so blatant about tracking, but Facebook proves me wrong once again.

I hope EU regulators take note and start fining the websites that load these trackers without consent, but I suspect they won't have the capacity to do it.

Re: Covert web-to-app tracking via localhost on Android

#24

Post by gdwatson »

sklargh wrote: post #8
Xiol32 wrote: post #6

Crap like this is why I haven't had the Facebook or Instagram apps installed for years. I still have accounts, but I only visit them via the browser.

[flagged]

If unethical behavior is more lucrative than ethical, it will always be tempting. But that doesn't make it ethical.

Re: Covert web-to-app tracking via localhost on Android

#25

Post by numpad0 »

crowcroft wrote: post #11
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

The question is how do you ban it, and then how do you prove that people are breaking those rules?

By defining the $thing, banning the $thing per definition by law, and then tasking FBI-like organization enforce the law? It won't completely go away but it will subside, like how gambling on Internet is divided binary and confined into lootbox games without cashing features and straight up scam underground casinos.

Personally I think we should start from separating good old ads(that existed before I was 15) and Internet "ads". The old ads were still somewhat heavily targeted, but less than it is now. There probably would be an agreeable line up to which level advertisement efforts can be perverted.

Re: Covert web-to-app tracking via localhost on Android

#26

Post by pseudocomposer »

voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

The deprecation of third-party cookies, that all browsers were at one point on track to implement, was pretty much the most realistic first step to that. Which is why Google killed it last year by leveraging their control over Chrome.

While not technically a crime, it was a disgusting, unethical market manipulation move that never really got the public outrage it deserved.

Google execs’ initial support for it was also telling: leadership at Google must literally thought they would find another way to stay as profitable as they are without third-party cookies. Put another way: Google leadership didn’t understand cookies as well as someone who’s taken a single undergrad web dev class. (Or they were lying all along, and always planned to “renege” on third-party cookie deprecation.)

Re: Covert web-to-app tracking via localhost on Android

#27

Post by kentm »

sklargh wrote: post #8
Xiol32 wrote: post #6

Crap like this is why I haven't had the Facebook or Instagram apps installed for years. I still have accounts, but I only visit them via the browser.

[flagged]

It’s not our responsibility to do so. A company doesn’t have some inherent right to exist such that we must accept unethical behavior.

Re: Covert web-to-app tracking via localhost on Android

#29

Post by kstrauser »

sklargh wrote: post #8
Xiol32 wrote: post #6

Crap like this is why I haven't had the Facebook or Instagram apps installed for years. I still have accounts, but I only visit them via the browser.

[flagged]

That’s their problem, not mine. I don’t need Facebook’s or Yandex’s continued existence to enjoy life.

Re: Covert web-to-app tracking via localhost on Android

#30

Post by footlose_3815 »

pseudocomposer wrote: post #26
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

The deprecation of third-party cookies, that all browsers were at one point on track to implement , was pretty much the most realistic first step to that. Which is why Google killed it last year by leveraging their control over Chrome. While not technically a crime, it was a disgusting, unethical market manipulation move that never really got the public outrage it deserved. Google execs’ initial support for it was al…

Insidiously calling it "Privacy sandbox", and now setting everything opt-in every time I login to Chrome is really not Googly.
Post reply on HN