Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

271–280 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#271

Post by pona-a »

evilos wrote: post #255
paxys wrote: post #59

Earlier quoted context omitted.

People have been prosecuted under that act for clicking "view source" on their web browser. The crime itself is irrelevant. It's more about who you are/what connections you have/who you piss off.

Has there actually been a conviction purely for "viewing source"?

That was a real news story. A journalist looked at the state's educator-credentials checker, viewed the source and saw it had teacher's SSNs in base64 somewhere in the plaintext. Missouri Governor Mike Parson then tried to legally threaten the journalist. Honestly, if this case wasn't as high-profile, I think he might have got a conviction, at least in state court.

https://www.theregister.com/2022/02/15/missouri_html_hacking...

Re: Covert web-to-app tracking via localhost on Android

#272

Post by dwaite »

josephcsible wrote: post #171

Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?

There's effort to define standard behavior here. See https://wicg.github.io/private-network-access/ (although I suspect this document may make a significant shift soon)

Re: Covert web-to-app tracking via localhost on Android

#273

Post by dominicrose »

codedokode wrote: post #34
merek wrote: post #31

This is the overall process used by Meta as I understand it, taken from https://localmess.github.io/ : 1. User logged into FB or IG app. The app runs in background, and listens for incoming traffic on specific ports. 2. User visits website on the phone's browser, say something-embarassing.com, which happens to have a Meta Pixel embedded. From the article, Meta Pixel is embedded on over 5.8 million websites. Even in I…

So main application for WebRTC is de-anonymisation of users (for example getting their local IP address). Why it is not hidden behind permission I don't understand.

Because the decision makers don't care about privacy, they only want you to think that you have privacy, thus enabling even more spying. One solution is to not use the apps and websites from companies that are known to abuse WebRTC or something else.

Re: Covert web-to-app tracking via localhost on Android

#274

Post by _Algernon_ »

n2h4 wrote: post #257
deepsun wrote: post #166

Earlier quoted context omitted.

Today there's no way to disable it, I searched through my Firefox Mobile settings. So I'd say it's for very "power" users. And why enable it by default, why not disable by default? Also, sibling comments say iOS is already asking for the permission, why not just copy it?

it does exist in `about:config`, which could be made as a UI setting instead: `media.peerconnectin.enabled`. on cromite[1], a hardened chromium fork, there is such a setting, both in the settings page, as well as when you click on the lock icon in the address bar. [1]: https://cromite.org

IIRC the standard mobile firefox version no longer makes about:config available. You need to be on a beta or nightly build to access it.

Re: Covert web-to-app tracking via localhost on Android

#275

Post by saagarjha »

geoffpado wrote: post #254
FuckButtons wrote: post #252

Earlier quoted context omitted.

Sure, this entire business model has been cataclysmic for traditional media organizations and news outlets and peoples trust in institutions has plummeted in correlation, so, let’s just fucking scrap it and go back to payed media.

"Traditional media organizations" have been primarily funded by advertising longer than anyone on HN has been alive.

Some of them; perhaps even a vast majority. But this isn't the only option nor do we have to continue for it to be so.

Re: Covert web-to-app tracking via localhost on Android

#276

Post by thevinter »

bandrami wrote: post #260
dan15 wrote: post #246

Earlier quoted context omitted.

The majority of internet users are either unwilling or unable to pay for content, and so far advertising has been the best business model to allow these users to access content without paying. Do you have a better suggestion?

I don't pay for network TV but it still gets produced

And it is funded by ads, what's your point?

Re: Covert web-to-app tracking via localhost on Android

#277

Post by impossiblefork »

SchemaLoad wrote: post #222
like_any_other wrote: post #64

Earlier quoted context omitted.

There should also be fines, but individuals have gone to jail for less.

I agree they should. But I don't think the EU has any real ability to send American tech execs to jail. At most they can stop them doing business in the EU.

I think mutual criminality is satisfied, so extradition is definitely possible.

Re: Covert web-to-app tracking via localhost on Android

#278

Post by pmontra »

fc417fc802 wrote: post #101
pmontra wrote: post #16

Earlier quoted context omitted.

It still works very well. I'm using it on both Linux and Android. The UI is far better than its replacement inside uBO.

The uBO functionality isn't a legitimate replacement. I don't understand how that came to pass.

Those extensions are from the same author. I don't know the details but maybe gorhill didn't have the time to maintain uMatrix anymore and added the very minimum uMatrix functionality to uBO and settled for that. Luckily uMatrix keeps working.

Re: Covert web-to-app tracking via localhost on Android

#279

Post by cyberax »

_Algernon_ wrote: post #274
n2h4 wrote: post #257

Earlier quoted context omitted.

it does exist in `about:config`, which could be made as a UI setting instead: `media.peerconnectin.enabled`. on cromite[1], a hardened chromium fork, there is such a setting, both in the settings page, as well as when you click on the lock icon in the address bar. [1]: https://cromite.org

IIRC the standard mobile firefox version no longer makes about:config available. You need to be on a beta or nightly build to access it.

It is still enabled, just a bit hidden: chrome://geckoview/content/config.xhtml

Re: Covert web-to-app tracking via localhost on Android

#280

Post by iforgotpassword »

n_plus_1_acc wrote: post #269
afavour wrote: post #45

Earlier quoted context omitted.

The main application for WebRTC is peer to peer data transfer. I think you can make the argument that it should be behind a permission prompt these days but it's difficult. What would the permission prompt actually say, in easy to understand layman's terms? "This web site would like to transfer data from your computer to another computer in a way that could potentially identify you"? How many users are going to be ab…

What about "This website would like to connect to the Instagram App and may share your browsing history and other personal details."

Why should that message show up when I'm trying to make a video call in my browser? I'm just trying to call my nephew.
Post reply on HN