7 ms·

I just don't buy this theory until I see some evidence. It wouldn't be hard for a talented individual to reverse engineer the Facebook client app to find out if

I just don't buy this theory until I see some evidence. It wouldn't be hard for a talented individual to reverse engineer the Facebook client app to find out if it's either a) continuously recording and uploading raw audio to their servers, or b) continuously recording and locally processing audio before sending information about the content to their servers. Until I see an analysis of their code that indicates either of those things is happening, I have to believe that this is a conspiracy theory perpetuated by people posting these suspicious anecdotes all over the internet.

deleted 9y ago
[deleted]
sergiotapia 9y ago
I had it happen to me too. Why would I lie about something like this? This is my real account, I'm a real guy. My wife and I were talking about celebrating my kids birthday party at Arcade Foobar. A day later she started seeing ads on Facebook about Arcade Foobar. It's grotesque and one of the many reasons why my wife and I no longer have facebook accounts.
- Sacho 9y ago
  You don't have to be lying about it, but consider that we often incorrectly detect patterns where none exist.
- dx034 9y ago
  Probably because people in your area often celebrate birthdays there. You would've seen it without the conversation as well. And it was one of probably 100 ads you and your wife saw over the days, you didn't notice the ones that were targeted badly.
- Kiro 9y ago
  Complete nonsense. That you actually believe this instead of the much more plausible explanations are beyond me.
  - colordrops 9y ago
    Why is it not plausible?
    - Kiro 9y ago
      Because if Facebook was actually listening to your mic we would know it. They wouldn't be able to hide and it would be a massive scandal. It's simply too conspiratorial to take seriously when there is no evidence other than anecdotal stories like this.
      - colordrops 9y ago
        Is this non-anecdotal enough for you? I'm tired of using the "conspiracy" label to shut down valid discussion. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://www.cnet.com/news/samsungs-warning-our-smart-tvs-record-your-living-room-chatter/ https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec... https://www.washingtonpost.com/news/the-switch/wp/2017/03/09/can-amazon-echo-help-solve-a-murder-police-will-soon-find-out/?utm_term=.a2d72ff05c6e https://www.washingtonpost.com/news/the-switch/wp/2017/03/09...
        Kiro 9y ago
        You don't see any difference between Alexa (which wouldn't work without listening to everything) and Facebook secretly listening without your consent to use it for ad targeting? None of your links provide any evidence this would be the case, or even mention Facebook.
- adrow 9y ago
  Two words, "lookalike modelling", or as FB calls it Lookalike Audiences: https://www.facebook.com/business/help/164749007013531 https://www.facebook.com/business/help/164749007013531 Arcade Foobar want to draw in new customers, and so generate a lookalike audience based on data they have from existing customers. The modelling algo then compares data points for people who 'look like' their customers, and those people can then be targeted with a high probability that they will also be interested in the same thing. This is a perfectly plausible explanation that doesn't require FB to be listening to you through your phone mic.
seanp2k2 9y ago
The tools are there for you to try it: https://www.charlesproxy.com/documentation/faqs/using-charles-from-an-iphone/ https://www.charlesproxy.com/documentation/faqs/using-charle... http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForAndroid http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Conf... You could probably also do it with the emulator. You may need to do something like https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/ https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/ or it could be even harder: http://docs.mitmproxy.org/en/stable/certinstall.html#certificate-pinning http://docs.mitmproxy.org/en/stable/certinstall.html#certifi... There are of course ways around this: https://serializethoughts.com/2016/08/18/bypassing-ssl-pinning-in-android-applications/ https://serializethoughts.com/2016/08/18/bypassing-ssl-pinni... If you need some more hints: https://github.com/ac-pm/SSLUnpinning_Xposed https://github.com/ac-pm/SSLUnpinning_Xposed https://forum.xda-developers.com/showthread.php?t=3034811 https://forum.xda-developers.com/showthread.php?t=3034811 https://eaton-works.com/2016/07/31/reverse-engineering-and-removing-pokemon-gos-certificate-pinning/ https://eaton-works.com/2016/07/31/reverse-engineering-and-r... If you do this, please write it up. I'm sure that many people would be interested in this research if it hasn't already been done. EDIT: In the spirit of POC||GTFO, I got curious and did it myself. I don't see any evidence of any mic uploads. The worst thing I see is it posting your current location. Here's a screenshot of the typical stuff I was seeing (this particular one is for the messenger portion of the app, and it looks like it's pulling in assets for stickers. I have the Pusheen pack because it's hella adorbs): https://i.imgur.com/dVekldx.png https://i.imgur.com/dVekldx.png It's POSTing to graph.facebook.com as you scroll to get more data. It's just JSON and pretty easy to figure out what's going on. I just followed http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForAndroid http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Conf... . I guess they're not pinning their certs, at least on my Nexus 7 and the version of the FB app that I used (v26.0.0.22.16 on Android 5.1.1 on the 2012 Nexus 7, since that's what I had laying around to mess with easily). This literally took about 5 minutes to set up and get working. I encourage those curious to try it and see for themselves. I just read http://www.portero.com/blog/a-brief-history-of-gucci-infographic/ http://www.portero.com/blog/a-brief-history-of-gucci-infogra... aloud (I never shop for Gucci handbags, so seeing ads for them would be the tell) to test. I'm not some forensics expert but again, looks like nothing I wouldn't expect, definitely not uploading audio streams to Facebook as I'm speaking or +/- 5 minutes. Again though, check it out for yourself. EDIT 2: I searched for a few unique strings from some of the decoded JSON my N7 was sending to FB and found https://github.com/macliu010/android_facebook_decomplied https://github.com/macliu010/android_facebook_decomplied , which should be interesting for those following along at home.
mcguire 9y ago
Should be reasonably easy to check with your favorite network monitoring tool.

deleted 9y ago

[deleted]

sergiotapia 9y ago

I had it happen to me too. Why would I lie about something like this? This is my real account, I'm a real guy. My wife and I were talking about celebrating my kids birthday party at Arcade Foobar. A day later she started seeing ads on Facebook about Arcade Foobar. It's grotesque and one of the many reasons why my wife and I no longer have facebook accounts.

Sacho 9y ago
You don't have to be lying about it, but consider that we often incorrectly detect patterns where none exist.
dx034 9y ago
Probably because people in your area often celebrate birthdays there. You would've seen it without the conversation as well. And it was one of probably 100 ads you and your wife saw over the days, you didn't notice the ones that were targeted badly.
Kiro 9y ago
Complete nonsense. That you actually believe this instead of the much more plausible explanations are beyond me.
- colordrops 9y ago
  Why is it not plausible?
  - Kiro 9y ago
    Because if Facebook was actually listening to your mic we would know it. They wouldn't be able to hide and it would be a massive scandal. It's simply too conspiratorial to take seriously when there is no evidence other than anecdotal stories like this.
    - colordrops 9y ago
      Is this non-anecdotal enough for you? I'm tired of using the "conspiracy" label to shut down valid discussion. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://www.cnet.com/news/samsungs-warning-our-smart-tvs-record-your-living-room-chatter/ https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec... https://www.washingtonpost.com/news/the-switch/wp/2017/03/09/can-amazon-echo-help-solve-a-murder-police-will-soon-find-out/?utm_term=.a2d72ff05c6e https://www.washingtonpost.com/news/the-switch/wp/2017/03/09...
      - Kiro 9y ago
        You don't see any difference between Alexa (which wouldn't work without listening to everything) and Facebook secretly listening without your consent to use it for ad targeting? None of your links provide any evidence this would be the case, or even mention Facebook.
adrow 9y ago
Two words, "lookalike modelling", or as FB calls it Lookalike Audiences: https://www.facebook.com/business/help/164749007013531 https://www.facebook.com/business/help/164749007013531 Arcade Foobar want to draw in new customers, and so generate a lookalike audience based on data they have from existing customers. The modelling algo then compares data points for people who 'look like' their customers, and those people can then be targeted with a high probability that they will also be interested in the same thing. This is a perfectly plausible explanation that doesn't require FB to be listening to you through your phone mic.

seanp2k2 9y ago

The tools are there for you to try it: https://www.charlesproxy.com/documentation/faqs/using-charles-from-an-iphone/ https://www.charlesproxy.com/documentation/faqs/using-charle... http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForAndroid http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Conf... You could probably also do it with the emulator. You may need to do something like https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/ https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/ or it could be even harder: http://docs.mitmproxy.org/en/stable/certinstall.html#certificate-pinning http://docs.mitmproxy.org/en/stable/certinstall.html#certifi... There are of course ways around this: https://serializethoughts.com/2016/08/18/bypassing-ssl-pinning-in-android-applications/ https://serializethoughts.com/2016/08/18/bypassing-ssl-pinni... If you need some more hints: https://github.com/ac-pm/SSLUnpinning_Xposed https://github.com/ac-pm/SSLUnpinning_Xposed https://forum.xda-developers.com/showthread.php?t=3034811 https://forum.xda-developers.com/showthread.php?t=3034811 https://eaton-works.com/2016/07/31/reverse-engineering-and-removing-pokemon-gos-certificate-pinning/ https://eaton-works.com/2016/07/31/reverse-engineering-and-r... If you do this, please write it up. I'm sure that many people would be interested in this research if it hasn't already been done. EDIT: In the spirit of POC||GTFO, I got curious and did it myself. I don't see any evidence of any mic uploads. The worst thing I see is it posting your current location. Here's a screenshot of the typical stuff I was seeing (this particular one is for the messenger portion of the app, and it looks like it's pulling in assets for stickers. I have the Pusheen pack because it's hella adorbs): https://i.imgur.com/dVekldx.png https://i.imgur.com/dVekldx.png It's POSTing to graph.facebook.com as you scroll to get more data. It's just JSON and pretty easy to figure out what's going on. I just followed http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForAndroid http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Conf... . I guess they're not pinning their certs, at least on my Nexus 7 and the version of the FB app that I used (v26.0.0.22.16 on Android 5.1.1 on the 2012 Nexus 7, since that's what I had laying around to mess with easily). This literally took about 5 minutes to set up and get working. I encourage those curious to try it and see for themselves. I just read http://www.portero.com/blog/a-brief-history-of-gucci-infographic/ http://www.portero.com/blog/a-brief-history-of-gucci-infogra... aloud (I never shop for Gucci handbags, so seeing ads for them would be the tell) to test. I'm not some forensics expert but again, looks like nothing I wouldn't expect, definitely not uploading audio streams to Facebook as I'm speaking or +/- 5 minutes. Again though, check it out for yourself. EDIT 2: I searched for a few unique strings from some of the decoded JSON my N7 was sending to FB and found https://github.com/macliu010/android_facebook_decomplied https://github.com/macliu010/android_facebook_decomplied , which should be interesting for those following along at home.

mcguire 9y ago

Should be reasonably easy to check with your favorite network monitoring tool.