Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

251–260 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#251

Post by AnthonyMouse »

noduerme wrote: post #228
gruez wrote: post #71

Earlier quoted context omitted.

>The website wants to connect to another computer|another app on your computer. "website wants to connect to another computer" basically describes all websites. Do you really expect the average user to understand the difference? The exploit is also non-trivial either. SDP and TURN aren't privacy risks in and of themselves. They only pose risks when the server is set to localhost and with a cooperating app.

Pardon my ignorance, but modern browsers won't even load assets or iframes over plain http within an SSL page. So under normal circumstances you cannot open so much as an iframe to "localhost" from an https url unless you've configured https locally. Regardless of crossdomain perms. Wouldn't you want to require a special security permission from an app that was trying to setup a local server, AND require confirmation…

HTTP isn't allowed on secure pages because the security of HTTP is known to be non-existent. WebRTC uses datagram TLS, which is approximately on par with HTTPS.

The thing that's happening here isn't really a problem with WebRTC. Compare this to having an app on your phone that listens on an arbitrary port and spits out a unique tracking ID to anything that connects. Does it matter if the connection is made using HTTP or HTTPS or WebRTC or something else? Not really. The actual problem is that you installed malware on your phone.

Re: Covert web-to-app tracking via localhost on Android

#252

Post by FuckButtons »

dan15 wrote: post #246
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

The majority of internet users are either unwilling or unable to pay for content, and so far advertising has been the best business model to allow these users to access content without paying. Do you have a better suggestion?

Sure, this entire business model has been cataclysmic for traditional media organizations and news outlets and peoples trust in institutions has plummeted in correlation, so, let’s just fucking scrap it and go back to payed media.

Re: Covert web-to-app tracking via localhost on Android

#253

Post by microtonal »

pkaeding wrote: post #217
microtonal wrote: post #183

Earlier quoted context omitted.

I would recommend everyone who wants a clean Android to look into Google Pixel phones. Aside from being mostly bloat-free (and most bloat can be uninstalled), it is one of the few phones that supports unlocking/relocking and a secure open source alternative (GrapheneOS).

Does grapheneos prevent this? In what way? I know apps like ShareViaHTTP [1] are able to open ports (listening not just on the loopback address). If I installed a meta app, could it still run its listener that scripts on webpages could talk to? [1]: https://f-droid.org/packages/com.MarcosDiez.shareviahttp

I didn't say that. Only that GrapheneOS does not come with any adware/malware preinstalled. That said, their default browser did block one of the attack vectors:

https://grapheneos.social/@GrapheneOS/114620254209885149

Re: Covert web-to-app tracking via localhost on Android

#254

Post by geoffpado »

FuckButtons wrote: post #252
dan15 wrote: post #246

Earlier quoted context omitted.

The majority of internet users are either unwilling or unable to pay for content, and so far advertising has been the best business model to allow these users to access content without paying. Do you have a better suggestion?

Sure, this entire business model has been cataclysmic for traditional media organizations and news outlets and peoples trust in institutions has plummeted in correlation, so, let’s just fucking scrap it and go back to payed media.

"Traditional media organizations" have been primarily funded by advertising longer than anyone on HN has been alive.

Re: Covert web-to-app tracking via localhost on Android

#255

Post by evilos »

paxys wrote: post #59
GrantMoyer wrote: post #23

Would an individual using this technique to collect information from someone else's computer possibly face prosecution under the Computer Fraud and Abuse act?

People have been prosecuted under that act for clicking "view source" on their web browser. The crime itself is irrelevant. It's more about who you are/what connections you have/who you piss off.

Has there actually been a conviction purely for "viewing source"?

Re: Covert web-to-app tracking via localhost on Android

#256

Post by microtonal »

SchemaLoad wrote: post #221
microtonal wrote: post #151

Earlier quoted context omitted.

I am not sure which Meta apps open ports, but e.g. Samsung phones come with a bunch of Meta apps pre-shipped. IIRC just removing the Facebook app is is not enough, there is another service installed that is not visible as an app (com.facebook.services etc.), which you can only uninstall from the data partition with something like ADB/UAD. Or buy an iPhone or a Pixel.

Samsung devices are loaded with malware and AI slop in general. I'd avoid them if you at all care about privacy. Since Google is still missing end to end encryption for cloud data, iOS seems like the only good choice currently.

iOS sends data to metrics.apple.com, metrics.icloud.com, iadsdk.apple.com, etc. a lot. They are much better than Samsung (who send data to Samsung and other parties), but I am not convinced they are much better than Google devices. It's more who you prefer sending your data to.

In the end something like GrapheneOS is the only good choice. Has all the security features of Pixel (which is similar to iPhone) and the tracking of neither.

Re: Covert web-to-app tracking via localhost on Android

#257

Post by n2h4 »

deepsun wrote: post #166
afavour wrote: post #98

Earlier quoted context omitted.

That feels pretty useless. You might as well do what happens today: enable it by default and allow knowledgable power users to disable it. If it's disabled, show a message to the user explaining why it's needed.

Today there's no way to disable it, I searched through my Firefox Mobile settings. So I'd say it's for very "power" users. And why enable it by default, why not disable by default? Also, sibling comments say iOS is already asking for the permission, why not just copy it?

it does exist in `about:config`, which could be made as a UI setting instead:

`media.peerconnectin.enabled`.

on cromite[1], a hardened chromium fork, there is such a setting, both in the settings page, as well as when you click on the lock icon in the address bar.

[1]: https://cromite.org

Re: Covert web-to-app tracking via localhost on Android

#258

Post by n2h4 »

orbital-decay wrote: post #3

Actual report: https://localmess.github.io/ >Google says it's investigating the abuse That's a bit ironic, considering how they're using any side channel they could lay their hands on (e.g. Wi-Fi AP names) to track everyone. Basically every large app vendor with multiple apps does something similar to circumvent OS restrictions as well.

if it were a small company, it'd have been dilisted from google's play store in an instant.

Re: Covert web-to-app tracking via localhost on Android

#259

Post by microtonal »

fluidcruft wrote: post #33
merek wrote: post #31

This is the overall process used by Meta as I understand it, taken from https://localmess.github.io/ : 1. User logged into FB or IG app. The app runs in background, and listens for incoming traffic on specific ports. 2. User visits website on the phone's browser, say something-embarassing.com, which happens to have a Meta Pixel embedded. From the article, Meta Pixel is embedded on over 5.8 million websites. Even in I…

Not totally following but it sounds like you are saying one of the things they have been doing involves abusing mandated GDPR cookie notices to secretly track people?

IANAL, but it's not GDPR-conformant consent in any way. Consent needs to be informed, unambiguous, and freely given to be valid and should be easy to reject. The only way for this to be valid would be a consent form with something like:

Allow Meta tracking to connect the Facebook or Instagram app on your device to associate visits to this website with your Meta account. Yes/No (With No selected as a default.)

I am pretty sure that this is a grave violation of the GDPR.

Re: Covert web-to-app tracking via localhost on Android

#260

Post by bandrami »

dan15 wrote: post #246
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

The majority of internet users are either unwilling or unable to pay for content, and so far advertising has been the best business model to allow these users to access content without paying. Do you have a better suggestion?

I don't pay for network TV but it still gets produced
Post reply on HN