Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Facebook tracks you on Android [video]

media.ccc.de

Post reply on HN
Print view View original

31–40 of 213 posts

Re: How Facebook tracks you on Android [video]

#31

Post by Daniel_sk »

nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

They are removing the ability to get any device identifiers in newer Android versions - unless you ask the user for a permission. https://developer.android.com/training/articles/user-data-id... There are advertising IDs and these can be reset. But I am not saying it's ideal in Android - up until recently you could easily fingerprint a device and you can do it today if you ask the users for permission (which the average user doesn't read or you can trick him into accepting the permission request).

Re: How Facebook tracks you on Android [video]

#32

Post by blfr »

nly wrote: post #24
blfr wrote: post #15

Earlier quoted context omitted.

While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs. EFF has had a proof of concept online for quite a while https://panopticlick.eff.org/ And HN users are probably even more vulnerable since we will have customized our software making…

I know you're not disagreeing with me, but the issue you raise only distracts and lends ammo to the defenders of these prolific tracking mechanisms. It's the Nirvana fallacy. I'm sure there's a Google rep somewhere that will tell you that their "advertising ID" is better than the status quo on the web because the user can rotate it and, because it's reliable and easy for app devs to use, they are discouraged from bei…

I didn't disagree with your original comment by I do disagree with the follow-up. It's neither a distraction, nor a fallacy.

First, our computing devices do not protect our privacy and security sufficiently. It's a general problem, not limited or even particularly affecting Android. And you deal with general problems differently than with incidental ones. You don't tell people in an epidemic to "just go see a doctor."

Second, I do more sensitive computing in the browser on my computer than I do on my phone. It's the bigger issue.

Finally, the way we dealt with Internet worms and viruses was not by strongly stating how unacceptable infecting other people's computers is. We patched our software, kept it up to date, and even completely changed its design. Later shamed Microsoft into doing the same.

Re: How Facebook tracks you on Android [video]

#33

Post by Santosh83 »

bagsvaerd70 wrote: post #27
blfr wrote: post #15

Earlier quoted context omitted.

While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs. EFF has had a proof of concept online for quite a while https://panopticlick.eff.org/ And HN users are probably even more vulnerable since we will have customized our software making…

Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.

Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.

Re: How Facebook tracks you on Android [video]

#34

Post by sfifs »

nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

> The Android platform API should simply never allow apps to obtain global system identifiers

When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs.

Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to do so suggests they want to keep the possibility of re-entering the advertising business (or at least portray so to their shareholders)

Re: How Facebook tracks you on Android [video]

#35

Post by scarface74 »

Daniel_sk wrote: post #31
nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

They are removing the ability to get any device identifiers in newer Android versions - unless you ask the user for a permission. https://developer.android.com/training/articles/user-data-id... There are advertising IDs and these can be reset. But I am not saying it's ideal in Android - up until recently you could easily fingerprint a device and you can do it today if you ask the users for permission (which the avera…

“asking users for permission” never works. You end up with Vista style UAC. What about not allowing it all? Even before iOS and Android were a thing, Windows Mobile had a way for apps to uniquely identify a device but that unique identifier was per app/per user.

Re: How Facebook tracks you on Android [video]

#36

Post by homero »

Daniel_sk wrote: post #31
nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

They are removing the ability to get any device identifiers in newer Android versions - unless you ask the user for a permission. https://developer.android.com/training/articles/user-data-id... There are advertising IDs and these can be reset. But I am not saying it's ideal in Android - up until recently you could easily fingerprint a device and you can do it today if you ask the users for permission (which the avera…

Most apps will just force you to accept it

Re: How Facebook tracks you on Android [video]

#37

Post by scarface74 »

dvfjsdhgfv wrote: post #17
nly wrote: post #8

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a sha…

> The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Of course. On the other hand, Google's global attitude is that user tracking is fine, their core business is based on that. So it would be hypocritical on their part if they decided to block user tracking on their devices.

So it’s better not to buy your device based on a operating system created by an advertising company...

Re: How Facebook tracks you on Android [video]

#38

Post by j1elo »

It's been years since I banned Facebook apps from my phone.

m.facebook.com for the casual check, and mbasic.facebook.com for an admittely crippled but functional access to read the seldom chat message.

I'm happy that Fb Messenger is the tool of choice for 0,0% of people around here...

Re: How Facebook tracks you on Android [video]

#39

Post by crtasm »

blfr wrote: post #29
bagsvaerd70 wrote: post #27

Earlier quoted context omitted.

Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.

I don't. The only one I know is using Tor Browser without any customization, without even changing the windows size, because it makes you look like every other Tor Browser user. However, it comes with a fairly long list of downsides: less secure than Chrome, less secure than even Firefox it's based on because it's not updated as often and quickly, and you MITM yourself by default, and it's slow, it doesn't block ads.…

It's fast enough to be my main browser and plays e.g. YouTube at lower resolutions fine. I chose to install ublock origin, makes me stand out more from other users but I'm on Linux which is now revealed directly in the useragent string so I decided it wasn't a concern for me as I'm already not in the larger group of Windows users.

Re: How Facebook tracks you on Android [video]

#40

Post by product50 »

This is not unique to Facebook and is true for almost all SDKs, which can track the same events (which this talks mentions), that the app has. Google tracks exactly the same events which FB does as well. Also, the same thing happens on iOS too - not sure why the talk avoided it. Once the app has the SDK for a third party (regardless of OS), tracking all events within the app is fair game.
Post reply on HN