Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

241–250 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#241

Post by hulitu »

afavour wrote: post #45
codedokode wrote: post #34

Earlier quoted context omitted.

So main application for WebRTC is de-anonymisation of users (for example getting their local IP address). Why it is not hidden behind permission I don't understand.

The main application for WebRTC is peer to peer data transfer. I think you can make the argument that it should be behind a permission prompt these days but it's difficult. What would the permission prompt actually say, in easy to understand layman's terms? "This web site would like to transfer data from your computer to another computer in a way that could potentially identify you"? How many users are going to be ab…

> The main application for WebRTC is peer to peer data transfer.

But not for the user.

Re: Covert web-to-app tracking via localhost on Android

#243

Post by zdragnar »

account42 wrote: post #104
miloignis wrote: post #57

Earlier quoted context omitted.

The existing killer app for WebRTC is video chat without installing an app, which is huge. Other P2P uses are very cool and interesting as well - abusing it for fingerprinting is just that, abusing a user-positive feature and twisting it for identification, just like a million other browser features.

You mean just like a million other "user-positive" browser features pushed by the biggest tracking company there is.

The technique doesn't actually rely on webrtc though, does it? Not showing up in the default view of chrome's network inspector obfuscates it a bit, but it's not like there aren't other ways to do what they're achieving here.

Re: Covert web-to-app tracking via localhost on Android

#244

Post by SquareWheel »

turtletontine wrote: post #233
SquareWheel wrote: post #229

Earlier quoted context omitted.

This is very misleading. Google was prevented from disabling third-party cookies due to intervention by the CMA, who felt it would provide an unfair advantage over other advertisers. Google argued their case for years, proposed competing standards to act as a replacement (see Topics API), and eventually gave up on the endeavour altogether and simply made it a user toggle.

Google gets no competitive advantage from removing third party cookies from chrome. The anticompetitive monopolistic tactic was the plan to replace third party cookies with FLoC/Privacy Sandbox/Topics AI, and THAT is what they were not prevented from doing. No one is trying to stop google from removing third party cookies. Google is just unwilling to remove them without introducing a new anticompetitive tracking tool…

> No one is trying to stop google from removing third party cookies.

That's simply not true. As I already mentioned, the CMA presented a legal challenge which you can read about online. Please review the history, as it's been going on for years now.

https://www.gov.uk/government/news/cma-to-have-key-oversight...

https://www.marketing-beat.co.uk/2024/02/06/cma-cookies-goog...

Re: Covert web-to-app tracking via localhost on Android

#245

Post by 1vuio0pswjnm7 »

mmwelt wrote: post #232
1vuio0pswjnm7 wrote: post #204

Firefox about:config toggle media.peerconnection.enabled from true to false Further, Netguard plus Nebulo in non-VPN mode can stop unwanted connections to Meta servers

Does about:config work on Firefox Android?

It works on Fennec from F-Droid.

What are some reasons to use Firefox Android instead of Firefox Nightly. The later is availlable from Aurora Store.

IME, Nightly has better add-on support. For example, uMatrix works.

Re: Covert web-to-app tracking via localhost on Android

#246

Post by dan15 »

voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

The majority of internet users are either unwilling or unable to pay for content, and so far advertising has been the best business model to allow these users to access content without paying. Do you have a better suggestion?

Re: Covert web-to-app tracking via localhost on Android

#247

Post by wpm »

charcircuit wrote: post #219
SecretDreams wrote: post #84

Earlier quoted context omitted.

Yes, we need ads for a free internet, today. And, as a result, we also have our privacy eroded - eroded in ways we may not care about today, but will probably regret tomorrow. If we must pay for the internet, give me an option to pay to use it where I see no ads and my privacy is preserved. Let me know what that cost is and I'll decide what I want to do. Right now, the actual pricing is obscured so we just "accept" t…

>give me an option to pay This will depress ad revenue as the people with the most money will be the people who pay to remove ads. This will make less sites and content viable.

Ok?

Not every site needs to reach 1 billion people.

Plus Wikipedia seems to be doing ok occasionally asking for donations.

Re: Covert web-to-app tracking via localhost on Android

#248

Post by AnthonyMouse »

salawat wrote: post #206
account42 wrote: post #99

Earlier quoted context omitted.

TFA list tens of thousands of websites using WebRTC for deanonymization. How many websites using it for P2P data transfer can you list?

Any Jitsi deployment? Let's be clear here. Meta/other sites are abusing the technology TURN/WebRTC for a purpose it was never intended for, way beyond the comfortable confines of innocent hackery, and we all know it. That's asshole behavior, and worth naming, shaming, and ostracizing over.

More than that, talking about TURN or WebRTC is really missing the issue. If you lock everything down so that no one can do anything you wouldn't want a malicious actor to be able to do, then no one can do anything.

The real issue is, why are we putting up with having these apps on our devices? Why do we have laws that prohibit you from e.g. using a third party app from a trusted party or with published source code in order to access the Facebook service, instead of the untrustworthy official app which is evidently actual malware?

Re: Covert web-to-app tracking via localhost on Android

#249

Post by tonyhart7 »

nuker wrote: post #224
merek wrote: post #31

This is the overall process used by Meta as I understand it, taken from https://localmess.github.io/ : 1. User logged into FB or IG app. The app runs in background, and listens for incoming traffic on specific ports. 2. User visits website on the phone's browser, say something-embarassing.com, which happens to have a Meta Pixel embedded. From the article, Meta Pixel is embedded on over 5.8 million websites. Even in I…

> 1. User logged into FB or IG app. The app runs in background, and listens for incoming traffic on specific ports. I happened to be immune, I disabled Background App Refresh in iOS settings. All app notifications still work, except WhatsApp :( https://forums.macrumors.com/threads/any-reason-to-use-backg...

> except whatsapp

> company checks out

Post reply on HN