Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Localhost tracking" explained. It could cost Meta €32B

zeropartydata.es

Post reply on HN
Print view View original

41–50 of 286 posts

Re: "Localhost tracking" explained. It could cost Meta €32B

#41

Post by brookst »

ryukoposting wrote: post #18
ceejayoz wrote: post #4

Earlier quoted context omitted.

The EU doesn’t play around in this realm. 1.2 billion fine for an earlier incident: https://www.edpb.europa.eu/news/news/2023/12-billion-euro-fi...

1.2B is less than 1% of Meta's revenue in FY2024. Maximum fines for infractions like these should exist on a sliding scale, as some percentage of prior revenue.

Probably best indexed to profit rather than revenue. 10% of revenue would be a one quarter’s profit for meta, but more than a year’s profit for Amazon and about 9 years of profit for Otto. Higher margins / profits should mean higher fines.

Re: "Localhost tracking" explained. It could cost Meta €32B

#42

Post by brookst »

fidotron wrote: post #20

The same European intellegentsia that is progressively forcing Apple to tear down the walled garden simultaneously fails to understand that this is exactly why they had it in the first place: > You’re not affected if (and only if) . . . > You browse on desktop computers or use iOS (iPhones) At the very least they should step back and allow companies to enforce safeguards because they clearly lack the understanding or…

It is kind of funny that EU may well require these kinds of vulns to be present, while reacting with outrage when used.

Re: "Localhost tracking" explained. It could cost Meta €32B

#43

Post by joshstrange »

frenchmajesty wrote: post #15

Very impressive but not surprising coming from Meta. They have an history of doing this kind of things. Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets. At this point, I think the race for Zuckerberg is, can Meta survive long enough for the next platf…

> Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular.

They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent.

Unlike this case, it required users to jump through a number of hoops/scary iOS warnings. Many still did, for a gift card or less.

Re: "Localhost tracking" explained. It could cost Meta €32B

#44

Post by rsynnott »

ryukoposting wrote: post #18
ceejayoz wrote: post #4

Earlier quoted context omitted.

The EU doesn’t play around in this realm. 1.2 billion fine for an earlier incident: https://www.edpb.europa.eu/news/news/2023/12-billion-euro-fi...

1.2B is less than 1% of Meta's revenue in FY2024. Maximum fines for infractions like these should exist on a sliding scale, as some percentage of prior revenue.

They actually do; max GDPR penalty is 4% global revenue, say.

Of course the concern would be that even at that rate some companies might see it as a cost of doing business.

Re: "Localhost tracking" explained. It could cost Meta €32B

#45

Post by naniwaduni »

ranguna wrote: post #12

Tldr because this article has way too much fillers to my taste (but I'm sure there are people out there that enjoy reading that kind of thing): The native Instagram and meta apps start a server listening on predefined ports when you launch said apps, they eventually run on the background as well. When you are on your browser, whether in private more, not logged, refused or disabled cookies, or anything else that migh…

The technical details roughly boil down to "your browser lets internet sites talk to local services"; in this case if they cooperate they can identify each other, but cf. https://mrbruh.com/asusdriverhub/

In practical terms this is a privacy leak a couple bits more informative but slightly less robust than "these requests are coming from the same IP address."

Re: "Localhost tracking" explained. It could cost Meta €32B

#46

Post by joshstrange »

geerlingguy wrote: post #11

Sounds like you're affected if you have either Facebook or Instagram app installed on an Android phone, you're signed into your account, and you don't have anything set up to block tracking pixels and the like (though that last part I'm not as sure of). Getting through VPNs and incognito mode are the most egregious parts of this offense, though. I think some people are under the impression that's a way to act like yo…

> I think some people are under the impression that's a way to act like you're in total privacy... but it's not.

It should be for the average person. VPN and private browsing should be enough for what most people use it for. I don’t think it’s fair to expect people to think that the browser is secretly communicating with apps on their phone, tying all behavior to their identity.

Re: "Localhost tracking" explained. It could cost Meta €32B

#47

Post by genocidicbunny »

throwawayqqq11 wrote: post #40
genocidicbunny wrote: post #21

Earlier quoted context omitted.

> I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to. Which is why I don't think punishing just the company itself is enough. The engineers, designers, PM's that implemented this should also receive punishment, sufficient enough to make anyone think…

LLC - Limited liability company GmbH - Society with limited liability (german, translated) This liability shield is by design.

And yet, we still have the ability to pierce the liability veil. Heck, it's even in the name, "limited liability". Not "no liability".

Re: "Localhost tracking" explained. It could cost Meta €32B

#48

Post by grues-dinner »

Waterluvian wrote: post #5

Every story like this has me thinking about two things: 1. Companies have no soul. They are, by design, just chasing revenue. Everything else is just a risk to be factored. 2. There are real humans at these companies who choose to take part in the business and design and engineering, etc. I don’t think these humans have no soul (though some won’t), and I don’t think they’re stupid (though some are). I think it’s just…

There are multiple entire industries built around diluting and proxying accountability.

I suppose since diluting accountability aligns well with making more money by allowing shadier activities it naturally happens "by accident", but I also think it's quite deliberate in many cases.

Re: "Localhost tracking" explained. It could cost Meta €32B

#49

Post by joshstrange »

Thorrez wrote: post #23

>You’re not affected if (and only if) ... >You always used the Brave browser or the DuckDuckGo search engine on mobile How does choice of search engine protect from this?

> How does choice of search engine protect from this?

I don’t use android or either of those browsers but my guess is that either block the tracking pixel from loading in the first place or they’re more locked down on what they allow websites to reach out to (aka no Localhost access).

Re: "Localhost tracking" explained. It could cost Meta €32B

#50

Post by zufallsheld »

throwawayqqq11 wrote: post #40
genocidicbunny wrote: post #21

Earlier quoted context omitted.

> I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to. Which is why I don't think punishing just the company itself is enough. The engineers, designers, PM's that implemented this should also receive punishment, sufficient enough to make anyone think…

LLC - Limited liability company GmbH - Society with limited liability (german, translated) This liability shield is by design.

The ceo (Geschäftsführer) is liable when they when they intentionally break the law so the limited liability is not applicable then.
Post reply on HN