4 ms·

> PhoneNumberX was never used on this phone apart from WhatsApp that had PhoneNumberX linked to it. WhatsApp's sole purpose is to be a data stealer for Faceboo

> PhoneNumberX was never used on this phone apart from WhatsApp that had PhoneNumberX linked to it. WhatsApp's sole purpose is to be a data stealer for Facebook - the messaging part is a side effect. It seems like it's done it's job as expected though. iOS allows the concept of App Groups which means apps from the same developer can talk to each other. Since iOS 11 the Keychain (a secure storage area for access tokens, etc) persists even after uninstalling an app, so nasty apps can put the tracking ID in there (you need to restore your entire device to clear this) > Facebook is using some form of secret fingerprinting that got Uber in trouble with Apple Actually, there is very little information you can use for a fingerprint on iOS. All devices are actually pretty similar. What happened is that WhatsApp did what it was designed to do and got your phone number (and contacts) and uploaded them to FB. When you installed the FB app, it used App Groups to talk to the WA app to get your profile ID from there, and link your WhatsApp profile with your Facebook one. In addition, both of these apps will save a persistent ID in the keychain to track you even if you were to delete & reinstall the app. When you installed Instagram, it used App Groups to ask whatever other Facebook app there was (WhatsApp, Facebook, Messenger, etc) to figure out if any of them had a profile on you, and that's how it got your phone number. This persistence mechanism is more advanced than most malware out there. > What would security/privacy experts recommend in this situation? Give the middle finger to Shitbook. Use the GDPR to your advantage to request all your data to be deleted (but don't actually trust they will delete it, because it's in their best interest not to). If you must use their services, use a separate device, on a different carrier, with none of your data on it (make a pseudonymous account if possible), and don't connect it to the same Wi-Fi network as your personal device.

AndyGriffin 8y ago
I applaud your elaborate and thorough reply. Thank you. What it also made me think about is DeviceCheck. A recent framework implemented in iOS that allows app developers to use persistent device identification even after full device restore/reset. One can watch Apple's very own developers pitching it as privacy friendly way to protect app vendors from fraud while no mention of how it can be abused by the same app vendors against customers privacy: https://developer.apple.com/videos/play/wwdc2017/702/?time=1444 https://developer.apple.com/videos/play/wwdc2017/702/?time=1... Given what you wrote, it is pretty clear how this feature can be and is probably being abused by Facebook. Your recommendation is the only thing that can remedy this indeed as resetting device just wont do anymore. For people who somehow already got into privacy trouble with Facebook or Google but don't want to change/sell a device, this method might prove to be useful: https://stackoverflow.com/questions/48239712/is-devicecheck-or-indentifierforvendor-safe https://stackoverflow.com/questions/48239712/is-devicecheck-... Acquiring .ipa file of an app, then altering Bundle ID in AirSign and side loading it to your device using XCode thus resetting DeviceCheck identifiers. Overall, this is a dark chapter we are entering. Companies groom themselves to literally own customers's mind as the only safe route to maximizing profits. > Use the GDPR to your advantage to request all your data to be deleted (but don't actually trust they will delete it, because it's in their best interest not to). While learning about GDPR, i have learned that indeed companies may not honour data deletion requests. Have you made any research on how such requests should be implemented especially if one does not reside in the EU? Would using VPN be sufficient at the time of making such request? Interested in submitting such request to Google. Also what is curious in case of Facebook, they have moved their users from Ireland to US so they don't have to comply with GDPR: https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law https://www.theguardian.com/technology/2018/apr/19/facebook-...

AndyGriffin 8y ago

I applaud your elaborate and thorough reply. Thank you. What it also made me think about is DeviceCheck. A recent framework implemented in iOS that allows app developers to use persistent device identification even after full device restore/reset. One can watch Apple's very own developers pitching it as privacy friendly way to protect app vendors from fraud while no mention of how it can be abused by the same app vendors against customers privacy: https://developer.apple.com/videos/play/wwdc2017/702/?time=1444 https://developer.apple.com/videos/play/wwdc2017/702/?time=1... Given what you wrote, it is pretty clear how this feature can be and is probably being abused by Facebook. Your recommendation is the only thing that can remedy this indeed as resetting device just wont do anymore. For people who somehow already got into privacy trouble with Facebook or Google but don't want to change/sell a device, this method might prove to be useful: https://stackoverflow.com/questions/48239712/is-devicecheck-or-indentifierforvendor-safe https://stackoverflow.com/questions/48239712/is-devicecheck-... Acquiring .ipa file of an app, then altering Bundle ID in AirSign and side loading it to your device using XCode thus resetting DeviceCheck identifiers. Overall, this is a dark chapter we are entering. Companies groom themselves to literally own customers's mind as the only safe route to maximizing profits. > Use the GDPR to your advantage to request all your data to be deleted (but don't actually trust they will delete it, because it's in their best interest not to). While learning about GDPR, i have learned that indeed companies may not honour data deletion requests. Have you made any research on how such requests should be implemented especially if one does not reside in the EU? Would using VPN be sufficient at the time of making such request? Interested in submitting such request to Google. Also what is curious in case of Facebook, they have moved their users from Ireland to US so they don't have to comply with GDPR: https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law https://www.theguardian.com/technology/2018/apr/19/facebook-...