Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Covert web-to-app tracking via localhost on Android

localmess.github.io

Post reply on HN
Print view View original

281–290 of 356 posts

Re: Covert web-to-app tracking via localhost on Android

#281

Post by iforgotpassword »

codedokode wrote: post #266
NoahZuniga wrote: post #235

Earlier quoted context omitted.

This is not unique to WebRTC. The same result could be achieved by sending a http request to localhost. The only difference in this case is that using WebRTC doesn't log a http request

The browser could refuse to connect to localhost. I think there are browsers that refuse (i.e. to prevent attacking a router config interface).

I doubt anyone is running a browser on their router.

But still, you could do the same for stun, turn, sdp. Disallow local host.

Re: Covert web-to-app tracking via localhost on Android

#282

Post by voidUpdate »

udev4096 wrote: post #238
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

It's impossible and we all know it. Instead, donate or help with the huge adblock lists that are being maintained by a lot of people

As said in a reply to a sibling comment, I am very aware. This is wishful thinking

Re: Covert web-to-app tracking via localhost on Android

#284

Post by Yizahi »

And with all that tracking and spying on me, plus a boatload of voluntarily submitted data, and Facebook still can't/won't show me any relevant advertising. I mean, even from the corpo point of view. Whenever I open my feed to read something, I see a boatload of complete garbage ads. Like, they are neither enticing to me nor they are promoting something corpos may want to shove in my fae so I would remember, like some Coca-Cola or whatever product. But no, they have nothing.

I've just opened my feed in FB and let's see what ads will be today:

Group Dull Men's Club - some garbage meme dump, neither interesting nor selling any product or service.

Women emigrant group - I'm a male and in different location.

Rundown - some NN generated slop about NN industry

Car crash meme group from a different location.

Math picture meme group

LOTR meme group

Photo group with a theme I'm not interested

Repeat of the above

Another meme group

Roland-Garros page - I've never watched tennis or wrote about it. My profile has follows of a different sport pages altogether. None of those rise in the ads.

Another fact/meme group

Repeat

Repeat

Another fact/meme group

Expat group from incorrect location

And so on it goes. Like, who pays for all this junk? Who coordinates targeting? Why do they waste both their and mine capacity for something that useless both for me and Facebook? I would understood if FB had ads of products/services, or something that loosely follows by likes. But what they have is a total 100% miss. It's mindboggling.

Re: Covert web-to-app tracking via localhost on Android

#285

Post by lozenge »

Yizahi wrote: post #284

And with all that tracking and spying on me, plus a boatload of voluntarily submitted data, and Facebook still can't/won't show me any relevant advertising. I mean, even from the corpo point of view. Whenever I open my feed to read something, I see a boatload of complete garbage ads. Like, they are neither enticing to me nor they are promoting something corpos may want to shove in my fae so I would remember, like som…

I guess the meme group ads are to draw you in, once you follow them they get to push you actual ads and it costs them less because Facebook doesn't charge them, thinking you want to see the group's posts. It must work to some extent.

Re: Covert web-to-app tracking via localhost on Android

#287

Post by nedt »

voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

It's already enough to just have plain ads. Like we have them on the streets, at the bus station, newspapers, etc. No tracking needed at all, just give out the message. If you need to target people to it in the context of the place or content you are showing it with. But you don't need to know anything about the user seeing the ad. Targeting by user doesn't work anyway.

Re: Covert web-to-app tracking via localhost on Android

#288

Post by gbalduzzi »

nedt wrote: post #287
voidUpdate wrote: post #4

I wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht

It's already enough to just have plain ads. Like we have them on the streets, at the bus station, newspapers, etc. No tracking needed at all, just give out the message. If you need to target people to it in the context of the place or content you are showing it with. But you don't need to know anything about the user seeing the ad. Targeting by user doesn't work anyway.

> Targeting by user doesn't work anyway.

How did you reach this conclusion? The main problem is that it works way better than traditional marketing medium.

It's the reason Google and Facebook are so massive, why would publishers choose to pay them if it doesn't work?

Re: Covert web-to-app tracking via localhost on Android

#289

Post by etherealG »

paxys wrote: post #59
GrantMoyer wrote: post #23

Would an individual using this technique to collect information from someone else's computer possibly face prosecution under the Computer Fraud and Abuse act?

People have been prosecuted under that act for clicking "view source" on their web browser. The crime itself is irrelevant. It's more about who you are/what connections you have/who you piss off.

exactly, the more interesting question: would anyone be willing to prosecute a Meta executive over this? Sadly, I expect no.

Re: Covert web-to-app tracking via localhost on Android

#290

Post by SideburnsOfDoom »

merek wrote: post #31

This is the overall process used by Meta as I understand it, taken from https://localmess.github.io/ : 1. User logged into FB or IG app. The app runs in background, and listens for incoming traffic on specific ports. 2. User visits website on the phone's browser, say something-embarassing.com, which happens to have a Meta Pixel embedded. From the article, Meta Pixel is embedded on over 5.8 million websites. Even in I…

> User logged into FB or IG app. The app runs in background

So a takeaway is to avoid having Facebook or Instagram apps on your phone. I'm happy to continue to not have them.

Any others? e.g. WhatsApp. Sadly, I find this one a necessary communication tool for family and business in certain countries.

Post reply on HN