10 ms·

Three quarters of Android apps track users with third party tools

174 points by dberhane 9y ago

thisisit 9y ago
I wonder if there is a comparable study for iOS apps? Or are there iOS versions of "Tinder, Spotify, Uber and OKCupid" better than the Android counterparts. > Both of these trackers have been profiled by Privacy Lab and can be identified by Exodus scans. I have tried looking up Exodus but can't find any info. Anyone knows what this tool and how does it work?
- ickwabe 9y ago
  https://exodus-privacy.eu.org/ https://exodus-privacy.eu.org/ https://github.com/exodus-privacy/exodus https://github.com/exodus-privacy/exodus https://github.com/YalePrivacyLab/tracker-profiles https://github.com/YalePrivacyLab/tracker-profiles
  - GrayShade 9y ago
    Does anyone know why Firefox uses DoubleClick? https://reports.exodus-privacy.eu.org/reports/177/ https://reports.exodus-privacy.eu.org/reports/177/
    - ickwabe 9y ago
      My suspicion is that this is a false-positive. If you go to about:config and search for doubleclick there is an entry called: browser.urlbar.doubleClickSelectsAll Use is self-explanitory in the name. This twitter thread indicates same: https://twitter.com/rnewman/status/934861503630643204 https://twitter.com/rnewman/status/934861503630643204 Also, LeanPlum is explained here: https://support.mozilla.org/en-US/kb/send-usage-data-firefox-mobile-devices https://support.mozilla.org/en-US/kb/send-usage-data-firefox... Quote: Firefox for Android, Firefox for iOS, Firefox Rocket and Firefox Focus collect data about installations and retention using a third-party tracking framework called Adjust and Leanplum. This helps Mozilla determine the origin of the installation by answering the question, "Did this user on this device install the application in response to a specific advertising campaign performed by Mozilla?"
- s73ver_ 9y ago
  Having worked in a few agencies and departments that do both iOS and Android apps, whenever possible, they want parity between the two. So if the Android app is doing it, odds are better than not that the iOS app is also doing it to the extent allowed by Apple.
- on_and_off 9y ago
  mobile dev here. From my anecdotal experience I can tell you that whatever data we collect on Android we collect on iOS too (crashes, usage, etc) .
dmitriid 9y ago
3/4 of apps? I'm surprised it's not higher. Probably similar thing for iOS: everyone installs ads, translations, google analytics, data-mining and data-analysing tools, or feeds logs to such tools.
leroman 9y ago
The real price of "free"
- lern_too_spel 9y ago
  Nonsensical statement. Paid applications do this too.
nucleartacos 9y ago
I don't get it. If you're in IT in any role, you know this is happening. I install zero apps on my iPhone. I don't need them. Banking and other secure things are more properly done on a desktop or laptop running some form of nix with proper security in place. I would never access my bank or other secure website with crucial information via a mobile phone. Call me an anachronism should you wish, but I've never had the tracking worries or data leak worries others do. On my nix desktops, I block all ads, all tracking cookies, no third-party cookies, I whitelist my bank and Fastmail account for cookies, and I block coin mining, HTML canvassing, HTTP/S referrer, CSS history lookups, and so much more. In addition, I surf through a VPN. Why risk it?
- __sha3d 9y ago
  I'm not sure why you are being downvoted here. I learned a lot from your post! I set up my cookies to stop 3rd party and delete at the end of a session. I also learned about /etc/hosts and blocked a ton of bad stuff at the system level. You are awesome, thank you!
  - wfo 9y ago
    It will never be reasonable, feasible, or worth discussing that e.g. every day users run a linux only locked down desktop and never use their mobile phones. Every time a privacy topic comes up, there is always someone to come in and say "uninstall windows and OSX, delete all of your social media accounts and block the entire Internet, quit your job that requires you to use these devices and services, run your own mail server, if you REALLY care about privacy you'll essentially stop using the Internet, cut yourself off from all of society and make your devices unusable" -- which can offer advice for people looking to do this but adds little to the discussion around tracking, privacy, data security. If you try to fight against advertisers and privacy-invading trackers and malware alone you will always lose. They are huge companies. They bribe your computer manufacturers to auto-install malware. They infect your operating systems. They have CAs. They have millions to spend on thousands of brilliant engineers who will work around anything you come up with to attack your security and privacy. An answer must be feasible for almost everybody so that we can all enact it collectively, technical or not, or it is no answer at all.
eagsalazar2 9y ago
This is such a non-story.
- ThrowawayR2 9y ago
  How so? Everybody screams bloody murder whenever the topic of telemetry is brought up and this is telemetry on a massive scale.
  - tonymet 9y ago
    You're right, but I guess it seems to be a non-story to developers because the first thing you do prior to launch is add telemetry for user behavior and app performance.
    - eagsalazar2 9y ago
      Exactly. Every website and every mobile app, android and iOS, where the devs and/or product management are competent at all, are tracking your behaviors. That is how they know whether each and every feature is working well or not. The articles on this recently are just making a stink over nothing. Imagine trying to run any kind of business without being able to observe how your customers are interacting with your product? I get that it is surprising and creepy but people just need to get over it because it isn't going anywhere and it is actually very valuable and good. If there is anything to be upset about here it is that that tracked information is frequently sold to 3rd parties without user consent which I'm all for legal restrictions on.
      - rhizome 9y ago
        That is how they know whether each and every feature is working well or not. How does this explain the "quality" of Snapchat and Tinder?
whoopdedo 9y ago
"Third party tools." Ads. They're called ads. Don't beat around the bush. Google won't fix the problem because their business is selling ads.
- lern_too_spel 9y ago
  And Apple won't even let you know this is going on. https://news.ycombinator.com/item?id=15809283 https://news.ycombinator.com/item?id=15809283
- eli 9y ago
  Crashlytics isn't ads. It's crash reporting. Mixpanel isn't ads, it's analytics.
  - sjbase 9y ago
    Quote in the article, directly from Crashlytics: > "and get insight into your users, what they’re doing, and inject live social content to delight them." It's also analytics, and ads.
    - eli 9y ago
      I guess that's a feature it offers, but like most people I've used it solely for crash reporting.
harryf 9y ago
The surprising part to me is that it's only 3/4. I assume the rest are not doing any real analytics. Of course they are using 3rd party tools, because the software and infrastructure required to do meaningful analytics on a large user base is way beyond what any startup or independent developer can afford to invest. There aren't even decent Open Source options - Google Analytics long ago sucked the air out of Open Source in this space and choosing Open Source means running your own infrastructure, which is non-trival the moment you start having Gigabytes+ of usage data.
- marpstar 9y ago
  Exactly this. We're constantly told not to "roll our own X", making paid offerings like Azure App Insights, which is more robust than any hand-rolled solution we could ever develop, so appealing. We're not trying to sell the user, or their data. We just want to know which features are being used and whether or not it's meeting our performance criteria, thus doing the user a favor by meeting those criteria.
  - johnny_and1 9y ago
    The problem is not informing the user that you use SDKs from third party providers, although using them for login services (Facebook, Google+, twitter) or tracking (Crashlytics, Microsoft App Insights). The other problem is not knowing exactly what these SDKs can collect. They basically have the same permissions as the apps that include them. Crashlytics will collect and send location data alongside bug reports if the crashed app has this permission. (Source: Study on the most popular 200 apps in Germany done on real network traffic. We don't know if the study will be available for the public.) We are currently pushing for legislation changes in Europe. Users should be informed about SDKs and data destination. Europe has 3 main data sinkholes, Ireland (EU data centres for US companies), Netherlands (Akamai) and Germany (probably selection bias). Nobody knows where the data ends up afterwards and under which legislation it falls.
    - harryf 9y ago
      This is certainly a good move. The Facebook SDK for example is widely used by many apps for Facebook ad performance tracking and analytics and that's something he public should be aware of. See https://medium.com/ios-os-x-development/libraries-used-in-the-top-100-ios-apps-5b845ad927b7 https://medium.com/ios-os-x-development/libraries-used-in-th... for example
paulcole 9y ago
Am I the only person who doesn't mind being tracked? I don't use an ad-blocker or VPN and allow all cookies. I see it as a fair trade for reading articles, watching videos, playing games, etc. without paying any money out of my own pocket. EDIT: Why the down votes with no replies on this?
- KozmoNau7 9y ago
  Why do you think it's a fair trade? Your personal information, privacy and security is worth so much more than a few measly videos or games.
  - tabeth 9y ago
    If the two parties engaged in a transaction know all of the information about the transaction and the transactions consequences and still agree, then by definition, it must be a "fair" trade, where "fair" means fair to both parties engaging in the transaction.
    - KozmoNau7 9y ago
      Only if both parties have perfect and complete information about the true costs. In this example, he's selling himself way short, his entire online privacy for a few silly videos.
      - paulcole 9y ago
        Is there a way to get more value in exchange for my online privacy? Would be interested to find out a way to get more value out of an asset I don't value highly.
        KozmoNau7 9y ago
        No. It's a flawed premise, since you are not actually part of the negotiation. You are not the customer, you are the product being traded. The only way you can change this is to insist on your privacy being respected, by using tools to inhibit tracking, and by voting with your wallet, by choosing services and vendors who respect your right to privacy.
sixbrx 9y ago
"Many of these trackers are also available in the Apple iOS app store, though technical and legal barriers limit privacy and security analysis." https://law.yale.edu/yls-today/news/isp-privacy-lab-publishes-research-hidden-trackers https://law.yale.edu/yls-today/news/isp-privacy-lab-publishe... And from https://boingboing.net/2017/11/25/la-la-la-cant-hear-you.html https://boingboing.net/2017/11/25/la-la-la-cant-hear-you.htm...: "As Exodus and Yale note, these trackers are almost certainly also present in iOS: the companies that make them advertise their iOS compatibility, for one thing. But iOS is DRM-locked and it’s a felony – punishable by a 5-year prison sentence and a $500,000 fine for a first offense in the USA under DMCA 1201, and similar provisions of Article 6 of the EUCD in France where Exodus is located – to distribute tools that bypass this DRM, even for the essential work of discovering whether billions of people are at risk due to covert spying from the platform."
- dep_b 9y ago
  The data the trackers can gather is more restricted but the principle remains the same. I've installed various of different kinds for my customers. Most of them are simply tracking what users do in an application to see how they can be improved but I've seen an app that uploaded your whole contacts book immediately (when it was still allowed, not the case anymore). I'm not too much in the know about Android permissions. I know it improved a lot lately but I think still some permissions are still accepted silently on install. Gathering data about the movements of your users within your application can really be helpful, I draw the line where things get shared with third parties or excessive data is gathered.
- cageface 9y ago
  In four years of developing iOS apps I can't think of a single client that didn't want some kind of third party analytics service installed. This is SOP for pretty much anybody trying to drive user growth on mobile and isn't specific to one platform or the other.
  - JumpCrisscross 9y ago
    Would it be more pro-privacy than anti-developer if Apple sensible integrated such analytics into its platform?
tonymet 9y ago
Only 3/4? That only means the "researchers" didn't try hard enough on the remaining 1/4. 100% of every app you use, mobile or web, has user behavior tracking.
- jstanley 9y ago
  Nonsense. Here are some of the apps I use: - AOSP email client - Silence - F-droid - Simon Tatham's Portable Puzzle Collection I don't think any of those are tracking my behaviour.
- TheCapn 9y ago
  Oh common, even you have to believe your statement is hyperbolic. What about the little crud apps people write for convenience? I wrote a weather app that scrapes data that I look at but made it faster so I don't need to load the entire website every time I want to review it. 0 tracking what-so-ever. I've come across several apps published by friends that do the same and couldn't imagine it's hardly a strange thing to write an app and not want to see it as some sort of monetization scheme.
unethical_ban 9y ago
I wish I could edit the hosts file of Android devices without root. Barring that, I wish I could force a DNS server for both wi-fi and mobile data links, which I believe also requires root. Either one of these options would allow the use of DNS blackholing for adware/malware domains. Without it, protecting yourself on mobile is that much more difficult.
- lern_too_spel 9y ago
  You can do this with the VpnService API, and there are multiple apps that do this for you. Example (not an endorsement — do your own research): https://github.com/x-falcon/Virtual-Hosts https://github.com/x-falcon/Virtual-Hosts
- mrguyorama 9y ago
  I wish root were easier to get on my own damn phone
  - enobrev 9y ago
    Agreed. I don't mind the requirement of root, just as I'm glad my desktop has a root account that's not the default account. That said, the effort required to obtain root on my own device is silly. It should simply be a switch in the "Dev Tools" settings screen, which is already hidden from plain consumers.
- nucleartacos 9y ago
  I've long thought about setting up a service that people can connect to with their mobiles or other devices (who don't want or can't root) that basically sanitizes their connection: strips out ads, beacons, tracking cookies, etc. Or, set up virtual desktops that people can connect to that also use VPNs that could allow people to originate their traffic from a given region. I'm primarily interested in created a sanitized stream more than anything. People have a right to surf without being tracked.
  - shabble 9y ago
guelo 9y ago
This is a bit alarmist. I develop a popular app that has no advertising but I still ship mixpanel and crashlytics. I do that because I need to know how people are using the app in order to make the app better. That's it. If the app crashes and I don't know about it then I can't fix it and my users would hate me. Without these tools the apps would be worse.
- robbyking 9y ago
  Yep, I agree completely. I work on a relatively well known app, and we use Crashlytics to monitor crashes (duh), and other tracking software to reduce friction in the app. We don't care who tapped button A instead of button B, we just want to know how many people tapped button A instead of button B.
  - GrinningFool 9y ago
    You don't care, but we can be reasonable sure that Crashlytics has access to that data. Even if they don't use it that with ill intent themselves (there's really no way to know one way or the other), we can also be reasonably sure that it won't stay secure with them forever.
    - robbyking 9y ago
      All the data is anonymous, though: the only identifying info we're sending them is an internal Customer ID.
- deleted 9y ago
  [deleted]
- lightswitch05 9y ago
  I believe the point of the article is that the data belongs in 3rd party hands. You might not be doing anything nefarious with the data, but that data does not belong to you and it is outside of your control to protect your users. Given IP addresses, device identifiers, application identifiers, and timestamps - these 3rd party applications now have some pretty valuable signals that can be aggregated with other signals from other tracking methods to create a detailed profile linking users across devices, browsers, and geo locations.
dep_b 9y ago
Something like a trackblocker could be the next step for privacy concerned companies. Or an opt-in variety.
- _up 9y ago
  That is already a thing. There are lists you can subscribe your adblocker to. They also cover Malware, Badware, Resource Abuse (Bitcoin Miners), Anti Cookie, Anti Social, Anti Adblock and more.
  - dep_b 9y ago
    Sorry for not being clear. I mean a track blocker that blocks applications from tracking you. Of course I've took measures in my browsers already.
SubiculumCode 9y ago
Spotify windows app. I wonder what it gets to spy on.
deltaprotocol 9y ago
To help mitigate this situation, users can and should start to use blockers just like we do on browsers. The best and less invasive I've found so far is Blokada[1]. It works as a fake VPN giving you the power use blocklists to filter all your connections. Downside is that I believe in doesn't work if you already use a VPN. So far it has helped me block 80.921 ads and trackers. As a bonus it saved me 242.79MB. By default it whitelists Google Analytics, so if you don't want that you should disable the whitelist or configure it. [1] http://blokada.org/index.html http://blokada.org/index.html
sjbase 9y ago
This thread is a really interesting example of how easily humans can simultaneously hold conflicting beliefs/opinions. I'm gathering that a lot of developers and businesspeople here: a) are very concerned about collection of their own data b) derive material value from Crashlytics, Mixpanel and other "tracking tools" for their work It's tricky to reconcile those two ideas.
- draw_down 9y ago
  The tracking I do of my users is good. The tracking others do to me, as their user, is bad.
- BLKNSLVR 9y ago
  As an avid amateur student of human behaviour, I appreciate your keen eye for this. I actually don't think it's tricky to reconcile the two. The people conducting the analytics are doing it 'for the right reasons'. The people being analysed don't trust anyone to do anything 'for the right reasons' or without some amount of scope creep around the edges of 'the right reasons'. Self versus someone else. I've got the best intentions, but I don't think anyone else has. It touches on the theory of: if a company was a person it would have the traits of a psychopath / sociopath. The ends justifies the means. Grow the business, and analytics is the best way to do it, or to visualise the progress and adjust the method. Human as part of the business: We gotta do these things to give ourselves the greatest chance of success Human as consumer of app: Why would they possibly need access to THAT? There are definitely multi-personalities involved. WHich seems increasingly normal. Wasn't there an HN article on that recently? The brain is a denial-machine. It enables hypocrisy, and I can only theorise that this is due to our inability to survive if that wasn't the case.
  - sjbase 9y ago
    Intuitively I'd agree that "best intentions of self vs. others" is probably the mechanism behind this type of cognitive dissonance. What I find harrowing is that in all likelihood, this is true for myself as well in ways that I'm not aware of! Your point about denial also reminded me of an article a read a couple years ago, attempting to explain why humans deceive themselves. The soft conclusion: we deceive ourselves in order to better deceive others. In this case, we convince ourselves that we have the best intentions in order to convince others of the same. I can't find the exact article, but this is similar and refers to the same research by Robert Trivers. It's an interesting read: https://www.scientificamerican.com/article/living-a-lie-we-deceive-ourselves-to-better-deceive-others/ https://www.scientificamerican.com/article/living-a-lie-we-d...
kitsunesoba 9y ago
I can’t say I’m thrilled with using Crashlytics in my own iOS apps, but I’m not aware of any better options when it comes to crash tracking. A handful of crashes come in through Apple’s opt in crash report sharing but when compared to the data I’m getting from Crashlytics, it’s clear that a lot of info is missing. If I relied only on manually submitted bug reports and what Apple is telling me, I never would’ve come to know about many of the bugs I’ve fixed. Better testing could’ve caught some of them, but many just won’t surface in any other place except out in the wild. Is increased privacy worth decreased stability? I won’t claim to know the answer to that question, but I suspect it’s more murky than some think, especially when you have paid customers who expect a throughly solid product for their money.
- blub 9y ago
  It's not privacy vs stability, that's a favourite red herring around here. The problem is your development process is not capable of producing stable enough software. I don't know why that's the case, but you should work on that first. Deming: "Inspection does not improve the quality, nor guarantee quality. Inspection is too late. The quality, good or bad, is already in the product. As Harold F. Dodge said, “You can not inspect quality into a product"". This goes even more for crash-reporting quality into a product.
  - kitsunesoba 9y ago
    I see what you’re getting at, but the reality is that there’s only so far massaging and rethinking your process can take you. No matter what you do, some number of bugs are going to find their way through. There’s going to be unforeseen combinations of variables and edge cases you’d never predict. The best one can ever do is reduce the frequency of occurrence to a minimum. Bugs are an inevitability, and I’d rather not be at the mercy of my users when it comes to finding out about them.
j_s 9y ago
What alternatives are out there for mobile developers? Is there an open source Android and/or iOS equivalent allowing self-hosting analytics like Piwik does for web (without a 3rd party)? Piwik does ship an Android SDK; anyone have experience to compare to 3rd party options? https://github.com/piwik/piwik-sdk-android https://github.com/piwik/piwik-sdk-android Hat tip to user johnny_and1 for mentioning ACRA for Android crash reporting elsewhere in this thread. Are there any similar libraries for iOS? https://github.com/ACRA/acra https://github.com/ACRA/acra
TeeWEE 9y ago
This is completely normal, just like any (web,ios) app, apps are generating analytics point to know how the app is doing, and where to improve. If an app doesnt have a 3rd party analytics tool, you can be almost certain they are using an inhouse tool. These tools never really track individual users outside of the app context.

174 points by dberhane 9y ago

I wonder if there is a comparable study for iOS apps? Or are there iOS versions of "Tinder, Spotify, Uber and OKCupid" better than the Android counterparts. > Both of these trackers have been profiled by Privacy Lab and can be identified by Exodus scans. I have tried looking up Exodus but can't find any info. Anyone knows what this tool and how does it work?

ickwabe 9y ago
https://exodus-privacy.eu.org/ https://exodus-privacy.eu.org/ https://github.com/exodus-privacy/exodus https://github.com/exodus-privacy/exodus https://github.com/YalePrivacyLab/tracker-profiles https://github.com/YalePrivacyLab/tracker-profiles
- GrayShade 9y ago
  Does anyone know why Firefox uses DoubleClick? https://reports.exodus-privacy.eu.org/reports/177/ https://reports.exodus-privacy.eu.org/reports/177/
  - ickwabe 9y ago
    My suspicion is that this is a false-positive. If you go to about:config and search for doubleclick there is an entry called: browser.urlbar.doubleClickSelectsAll Use is self-explanitory in the name. This twitter thread indicates same: https://twitter.com/rnewman/status/934861503630643204 https://twitter.com/rnewman/status/934861503630643204 Also, LeanPlum is explained here: https://support.mozilla.org/en-US/kb/send-usage-data-firefox-mobile-devices https://support.mozilla.org/en-US/kb/send-usage-data-firefox... Quote: Firefox for Android, Firefox for iOS, Firefox Rocket and Firefox Focus collect data about installations and retention using a third-party tracking framework called Adjust and Leanplum. This helps Mozilla determine the origin of the installation by answering the question, "Did this user on this device install the application in response to a specific advertising campaign performed by Mozilla?"
s73ver_ 9y ago
Having worked in a few agencies and departments that do both iOS and Android apps, whenever possible, they want parity between the two. So if the Android app is doing it, odds are better than not that the iOS app is also doing it to the extent allowed by Apple.
on_and_off 9y ago
mobile dev here. From my anecdotal experience I can tell you that whatever data we collect on Android we collect on iOS too (crashes, usage, etc) .

dmitriid 9y ago

3/4 of apps? I'm surprised it's not higher. Probably similar thing for iOS: everyone installs ads, translations, google analytics, data-mining and data-analysing tools, or feeds logs to such tools.

leroman 9y ago

The real price of "free"

lern_too_spel 9y ago
Nonsensical statement. Paid applications do this too.

nucleartacos 9y ago

I don't get it. If you're in IT in any role, you know this is happening. I install zero apps on my iPhone. I don't need them. Banking and other secure things are more properly done on a desktop or laptop running some form of nix with proper security in place. I would never access my bank or other secure website with crucial information via a mobile phone. Call me an anachronism should you wish, but I've never had the tracking worries or data leak worries others do. On my nix desktops, I block all ads, all tracking cookies, no third-party cookies, I whitelist my bank and Fastmail account for cookies, and I block coin mining, HTML canvassing, HTTP/S referrer, CSS history lookups, and so much more. In addition, I surf through a VPN. Why risk it?

__sha3d 9y ago
I'm not sure why you are being downvoted here. I learned a lot from your post! I set up my cookies to stop 3rd party and delete at the end of a session. I also learned about /etc/hosts and blocked a ton of bad stuff at the system level. You are awesome, thank you!
- wfo 9y ago
  It will never be reasonable, feasible, or worth discussing that e.g. every day users run a linux only locked down desktop and never use their mobile phones. Every time a privacy topic comes up, there is always someone to come in and say "uninstall windows and OSX, delete all of your social media accounts and block the entire Internet, quit your job that requires you to use these devices and services, run your own mail server, if you REALLY care about privacy you'll essentially stop using the Internet, cut yourself off from all of society and make your devices unusable" -- which can offer advice for people looking to do this but adds little to the discussion around tracking, privacy, data security. If you try to fight against advertisers and privacy-invading trackers and malware alone you will always lose. They are huge companies. They bribe your computer manufacturers to auto-install malware. They infect your operating systems. They have CAs. They have millions to spend on thousands of brilliant engineers who will work around anything you come up with to attack your security and privacy. An answer must be feasible for almost everybody so that we can all enact it collectively, technical or not, or it is no answer at all.

eagsalazar2 9y ago

This is such a non-story.

ThrowawayR2 9y ago
How so? Everybody screams bloody murder whenever the topic of telemetry is brought up and this is telemetry on a massive scale.
- tonymet 9y ago
  You're right, but I guess it seems to be a non-story to developers because the first thing you do prior to launch is add telemetry for user behavior and app performance.
  - eagsalazar2 9y ago
    Exactly. Every website and every mobile app, android and iOS, where the devs and/or product management are competent at all, are tracking your behaviors. That is how they know whether each and every feature is working well or not. The articles on this recently are just making a stink over nothing. Imagine trying to run any kind of business without being able to observe how your customers are interacting with your product? I get that it is surprising and creepy but people just need to get over it because it isn't going anywhere and it is actually very valuable and good. If there is anything to be upset about here it is that that tracked information is frequently sold to 3rd parties without user consent which I'm all for legal restrictions on.
    - rhizome 9y ago
      That is how they know whether each and every feature is working well or not. How does this explain the "quality" of Snapchat and Tinder?

whoopdedo 9y ago

"Third party tools." Ads. They're called ads. Don't beat around the bush. Google won't fix the problem because their business is selling ads.

lern_too_spel 9y ago
And Apple won't even let you know this is going on. https://news.ycombinator.com/item?id=15809283 https://news.ycombinator.com/item?id=15809283
eli 9y ago
Crashlytics isn't ads. It's crash reporting. Mixpanel isn't ads, it's analytics.
- sjbase 9y ago
  Quote in the article, directly from Crashlytics: > "and get insight into your users, what they’re doing, and inject live social content to delight them." It's also analytics, and ads.
  - eli 9y ago
    I guess that's a feature it offers, but like most people I've used it solely for crash reporting.

harryf 9y ago

The surprising part to me is that it's only 3/4. I assume the rest are not doing any real analytics. Of course they are using 3rd party tools, because the software and infrastructure required to do meaningful analytics on a large user base is way beyond what any startup or independent developer can afford to invest. There aren't even decent Open Source options - Google Analytics long ago sucked the air out of Open Source in this space and choosing Open Source means running your own infrastructure, which is non-trival the moment you start having Gigabytes+ of usage data.

marpstar 9y ago
Exactly this. We're constantly told not to "roll our own X", making paid offerings like Azure App Insights, which is more robust than any hand-rolled solution we could ever develop, so appealing. We're not trying to sell the user, or their data. We just want to know which features are being used and whether or not it's meeting our performance criteria, thus doing the user a favor by meeting those criteria.
- johnny_and1 9y ago
  The problem is not informing the user that you use SDKs from third party providers, although using them for login services (Facebook, Google+, twitter) or tracking (Crashlytics, Microsoft App Insights). The other problem is not knowing exactly what these SDKs can collect. They basically have the same permissions as the apps that include them. Crashlytics will collect and send location data alongside bug reports if the crashed app has this permission. (Source: Study on the most popular 200 apps in Germany done on real network traffic. We don't know if the study will be available for the public.) We are currently pushing for legislation changes in Europe. Users should be informed about SDKs and data destination. Europe has 3 main data sinkholes, Ireland (EU data centres for US companies), Netherlands (Akamai) and Germany (probably selection bias). Nobody knows where the data ends up afterwards and under which legislation it falls.
  - harryf 9y ago
    This is certainly a good move. The Facebook SDK for example is widely used by many apps for Facebook ad performance tracking and analytics and that's something he public should be aware of. See https://medium.com/ios-os-x-development/libraries-used-in-the-top-100-ios-apps-5b845ad927b7 https://medium.com/ios-os-x-development/libraries-used-in-th... for example

paulcole 9y ago

Am I the only person who doesn't mind being tracked? I don't use an ad-blocker or VPN and allow all cookies. I see it as a fair trade for reading articles, watching videos, playing games, etc. without paying any money out of my own pocket. EDIT: Why the down votes with no replies on this?

KozmoNau7 9y ago
Why do you think it's a fair trade? Your personal information, privacy and security is worth so much more than a few measly videos or games.
- tabeth 9y ago
  If the two parties engaged in a transaction know all of the information about the transaction and the transactions consequences and still agree, then by definition, it must be a "fair" trade, where "fair" means fair to both parties engaging in the transaction.
  - KozmoNau7 9y ago
    Only if both parties have perfect and complete information about the true costs. In this example, he's selling himself way short, his entire online privacy for a few silly videos.
    - paulcole 9y ago
      Is there a way to get more value in exchange for my online privacy? Would be interested to find out a way to get more value out of an asset I don't value highly.
      - KozmoNau7 9y ago
        No. It's a flawed premise, since you are not actually part of the negotiation. You are not the customer, you are the product being traded. The only way you can change this is to insist on your privacy being respected, by using tools to inhibit tracking, and by voting with your wallet, by choosing services and vendors who respect your right to privacy.

sixbrx 9y ago

"Many of these trackers are also available in the Apple iOS app store, though technical and legal barriers limit privacy and security analysis." https://law.yale.edu/yls-today/news/isp-privacy-lab-publishes-research-hidden-trackers https://law.yale.edu/yls-today/news/isp-privacy-lab-publishe... And from https://boingboing.net/2017/11/25/la-la-la-cant-hear-you.html https://boingboing.net/2017/11/25/la-la-la-cant-hear-you.htm...: "As Exodus and Yale note, these trackers are almost certainly also present in iOS: the companies that make them advertise their iOS compatibility, for one thing. But iOS is DRM-locked and it’s a felony – punishable by a 5-year prison sentence and a $500,000 fine for a first offense in the USA under DMCA 1201, and similar provisions of Article 6 of the EUCD in France where Exodus is located – to distribute tools that bypass this DRM, even for the essential work of discovering whether billions of people are at risk due to covert spying from the platform."

dep_b 9y ago
The data the trackers can gather is more restricted but the principle remains the same. I've installed various of different kinds for my customers. Most of them are simply tracking what users do in an application to see how they can be improved but I've seen an app that uploaded your whole contacts book immediately (when it was still allowed, not the case anymore). I'm not too much in the know about Android permissions. I know it improved a lot lately but I think still some permissions are still accepted silently on install. Gathering data about the movements of your users within your application can really be helpful, I draw the line where things get shared with third parties or excessive data is gathered.
cageface 9y ago
In four years of developing iOS apps I can't think of a single client that didn't want some kind of third party analytics service installed. This is SOP for pretty much anybody trying to drive user growth on mobile and isn't specific to one platform or the other.
- JumpCrisscross 9y ago
  Would it be more pro-privacy than anti-developer if Apple sensible integrated such analytics into its platform?

tonymet 9y ago

Only 3/4? That only means the "researchers" didn't try hard enough on the remaining 1/4. 100% of every app you use, mobile or web, has user behavior tracking.

jstanley 9y ago
Nonsense. Here are some of the apps I use: - AOSP email client - Silence - F-droid - Simon Tatham's Portable Puzzle Collection I don't think any of those are tracking my behaviour.
TheCapn 9y ago
Oh common, even you have to believe your statement is hyperbolic. What about the little crud apps people write for convenience? I wrote a weather app that scrapes data that I look at but made it faster so I don't need to load the entire website every time I want to review it. 0 tracking what-so-ever. I've come across several apps published by friends that do the same and couldn't imagine it's hardly a strange thing to write an app and not want to see it as some sort of monetization scheme.

unethical_ban 9y ago

I wish I could edit the hosts file of Android devices without root. Barring that, I wish I could force a DNS server for both wi-fi and mobile data links, which I believe also requires root. Either one of these options would allow the use of DNS blackholing for adware/malware domains. Without it, protecting yourself on mobile is that much more difficult.

lern_too_spel 9y ago
You can do this with the VpnService API, and there are multiple apps that do this for you. Example (not an endorsement — do your own research): https://github.com/x-falcon/Virtual-Hosts https://github.com/x-falcon/Virtual-Hosts
mrguyorama 9y ago
I wish root were easier to get on my own damn phone
- enobrev 9y ago
  Agreed. I don't mind the requirement of root, just as I'm glad my desktop has a root account that's not the default account. That said, the effort required to obtain root on my own device is silly. It should simply be a switch in the "Dev Tools" settings screen, which is already hidden from plain consumers.
nucleartacos 9y ago
I've long thought about setting up a service that people can connect to with their mobiles or other devices (who don't want or can't root) that basically sanitizes their connection: strips out ads, beacons, tracking cookies, etc. Or, set up virtual desktops that people can connect to that also use VPNs that could allow people to originate their traffic from a given region. I'm primarily interested in created a sanitized stream more than anything. People have a right to surf without being tracked.
- shabble 9y ago

guelo 9y ago

This is a bit alarmist. I develop a popular app that has no advertising but I still ship mixpanel and crashlytics. I do that because I need to know how people are using the app in order to make the app better. That's it. If the app crashes and I don't know about it then I can't fix it and my users would hate me. Without these tools the apps would be worse.

robbyking 9y ago
Yep, I agree completely. I work on a relatively well known app, and we use Crashlytics to monitor crashes (duh), and other tracking software to reduce friction in the app. We don't care who tapped button A instead of button B, we just want to know how many people tapped button A instead of button B.
- GrinningFool 9y ago
  You don't care, but we can be reasonable sure that Crashlytics has access to that data. Even if they don't use it that with ill intent themselves (there's really no way to know one way or the other), we can also be reasonably sure that it won't stay secure with them forever.
  - robbyking 9y ago
    All the data is anonymous, though: the only identifying info we're sending them is an internal Customer ID.
deleted 9y ago
[deleted]
lightswitch05 9y ago
I believe the point of the article is that the data belongs in 3rd party hands. You might not be doing anything nefarious with the data, but that data does not belong to you and it is outside of your control to protect your users. Given IP addresses, device identifiers, application identifiers, and timestamps - these 3rd party applications now have some pretty valuable signals that can be aggregated with other signals from other tracking methods to create a detailed profile linking users across devices, browsers, and geo locations.

dep_b 9y ago

Something like a trackblocker could be the next step for privacy concerned companies. Or an opt-in variety.

_up 9y ago
That is already a thing. There are lists you can subscribe your adblocker to. They also cover Malware, Badware, Resource Abuse (Bitcoin Miners), Anti Cookie, Anti Social, Anti Adblock and more.
- dep_b 9y ago
  Sorry for not being clear. I mean a track blocker that blocks applications from tracking you. Of course I've took measures in my browsers already.

SubiculumCode 9y ago

Spotify windows app. I wonder what it gets to spy on.

deltaprotocol 9y ago

To help mitigate this situation, users can and should start to use blockers just like we do on browsers. The best and less invasive I've found so far is Blokada[1]. It works as a fake VPN giving you the power use blocklists to filter all your connections. Downside is that I believe in doesn't work if you already use a VPN. So far it has helped me block 80.921 ads and trackers. As a bonus it saved me 242.79MB. By default it whitelists Google Analytics, so if you don't want that you should disable the whitelist or configure it. [1] http://blokada.org/index.html http://blokada.org/index.html

sjbase 9y ago

This thread is a really interesting example of how easily humans can simultaneously hold conflicting beliefs/opinions. I'm gathering that a lot of developers and businesspeople here: a) are very concerned about collection of their own data b) derive material value from Crashlytics, Mixpanel and other "tracking tools" for their work It's tricky to reconcile those two ideas.

draw_down 9y ago
The tracking I do of my users is good. The tracking others do to me, as their user, is bad.
BLKNSLVR 9y ago
As an avid amateur student of human behaviour, I appreciate your keen eye for this. I actually don't think it's tricky to reconcile the two. The people conducting the analytics are doing it 'for the right reasons'. The people being analysed don't trust anyone to do anything 'for the right reasons' or without some amount of scope creep around the edges of 'the right reasons'. Self versus someone else. I've got the best intentions, but I don't think anyone else has. It touches on the theory of: if a company was a person it would have the traits of a psychopath / sociopath. The ends justifies the means. Grow the business, and analytics is the best way to do it, or to visualise the progress and adjust the method. Human as part of the business: We gotta do these things to give ourselves the greatest chance of success Human as consumer of app: Why would they possibly need access to THAT? There are definitely multi-personalities involved. WHich seems increasingly normal. Wasn't there an HN article on that recently? The brain is a denial-machine. It enables hypocrisy, and I can only theorise that this is due to our inability to survive if that wasn't the case.
- sjbase 9y ago
  Intuitively I'd agree that "best intentions of self vs. others" is probably the mechanism behind this type of cognitive dissonance. What I find harrowing is that in all likelihood, this is true for myself as well in ways that I'm not aware of! Your point about denial also reminded me of an article a read a couple years ago, attempting to explain why humans deceive themselves. The soft conclusion: we deceive ourselves in order to better deceive others. In this case, we convince ourselves that we have the best intentions in order to convince others of the same. I can't find the exact article, but this is similar and refers to the same research by Robert Trivers. It's an interesting read: https://www.scientificamerican.com/article/living-a-lie-we-deceive-ourselves-to-better-deceive-others/ https://www.scientificamerican.com/article/living-a-lie-we-d...

kitsunesoba 9y ago

I can’t say I’m thrilled with using Crashlytics in my own iOS apps, but I’m not aware of any better options when it comes to crash tracking. A handful of crashes come in through Apple’s opt in crash report sharing but when compared to the data I’m getting from Crashlytics, it’s clear that a lot of info is missing. If I relied only on manually submitted bug reports and what Apple is telling me, I never would’ve come to know about many of the bugs I’ve fixed. Better testing could’ve caught some of them, but many just won’t surface in any other place except out in the wild. Is increased privacy worth decreased stability? I won’t claim to know the answer to that question, but I suspect it’s more murky than some think, especially when you have paid customers who expect a throughly solid product for their money.

blub 9y ago
It's not privacy vs stability, that's a favourite red herring around here. The problem is your development process is not capable of producing stable enough software. I don't know why that's the case, but you should work on that first. Deming: "Inspection does not improve the quality, nor guarantee quality. Inspection is too late. The quality, good or bad, is already in the product. As Harold F. Dodge said, “You can not inspect quality into a product"". This goes even more for crash-reporting quality into a product.
- kitsunesoba 9y ago
  I see what you’re getting at, but the reality is that there’s only so far massaging and rethinking your process can take you. No matter what you do, some number of bugs are going to find their way through. There’s going to be unforeseen combinations of variables and edge cases you’d never predict. The best one can ever do is reduce the frequency of occurrence to a minimum. Bugs are an inevitability, and I’d rather not be at the mercy of my users when it comes to finding out about them.

j_s 9y ago

What alternatives are out there for mobile developers? Is there an open source Android and/or iOS equivalent allowing self-hosting analytics like Piwik does for web (without a 3rd party)? Piwik does ship an Android SDK; anyone have experience to compare to 3rd party options? https://github.com/piwik/piwik-sdk-android https://github.com/piwik/piwik-sdk-android Hat tip to user johnny_and1 for mentioning ACRA for Android crash reporting elsewhere in this thread. Are there any similar libraries for iOS? https://github.com/ACRA/acra https://github.com/ACRA/acra

TeeWEE 9y ago

This is completely normal, just like any (web,ios) app, apps are generating analytics point to know how the app is doing, and where to improve. If an app doesnt have a 3rd party analytics tool, you can be almost certain they are using an inhouse tool. These tools never really track individual users outside of the app context.