11 ms·

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance o

by nly 8y ago

We're spoiled in the desktop browser by being able to clear history, cookies, local storage etc, or use a private browser session. There's also the importance of the "same origin policy". The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a shared filesystem. Mobile apps, despite platform API permission, and having some ability to protect their own data, are a lot closer to desktop programs than web apps in many regards.

blfr 8y ago
While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs. EFF has had a proof of concept online for quite a while https://panopticlick.eff.org/ https://panopticlick.eff.org/ And HN users are probably even more vulnerable since we will have customized our software making it stand out.
- dvfjsdhgfv 8y ago
  > And HN users are probably even more vulnerable since we will have customized our software making it stand out. On the other hand, among HN users you'll probably find a higher percentage of those who block JS by default and allow it only on selected websites. Most of these fingerprinting methods (and most web abuse in general) depends on JS being turned on.
  - blfr 8y ago
    Maybe. OTOH, how many people who share your IP addresses use the same browser, OS, and block JS? Unless you're using a vanilla Tor Browser, you will probably stand out. And if you are, 'tptacek will tell you how it's a bad idea for other reasons.
- nly 8y ago
  I know you're not disagreeing with me, but the issue you raise only distracts and lends ammo to the defenders of these prolific tracking mechanisms. It's the Nirvana fallacy. I'm sure there's a Google rep somewhere that will tell you that their "advertising ID" is better than the status quo on the web because the user can rotate it and, because it's reliable and easy for app devs to use, they are discouraged from being more nefarious and sneaky in tracking users. This is all a bloody distraction from the point: it should not be an acceptable norm for this tracking to happen and it should be as hard as possible to pull off without informed user consent. The degree to which platforms are defensive against it is a different issue to whether or not they actively encourage it by design... which shouldn't even be open to debate.
  - VRay 8y ago
    That's a good point. Depending on permissions, it would be hard to keep some malicious apps from stealing your nude photos too, but we don't take it for granted that "Of course the file explorer app looks for and surreptitiously uploads nudes! How else are they supposed to make money?" Our world is starting to looka lot like that of the Space Merchants..
  - blfr 8y ago
    I didn't disagree with your original comment by I do disagree with the follow-up. It's neither a distraction, nor a fallacy. First, our computing devices do not protect our privacy and security sufficiently. It's a general problem, not limited or even particularly affecting Android. And you deal with general problems differently than with incidental ones. You don't tell people in an epidemic to "just go see a doctor." Second, I do more sensitive computing in the browser on my computer than I do on my phone. It's the bigger issue. Finally, the way we dealt with Internet worms and viruses was not by strongly stating how unacceptable infecting other people's computers is. We patched our software, kept it up to date, and even completely changed its design. Later shamed Microsoft into doing the same.
    - PavlovsCat 8y ago
      I upvoted you because while I disagree that browsers are the bigger issue (many people use mobile devices for important things, and the less tech literate, the higher the chance they do all their online stuff with them, I'll just claim that), you didn't bring browsers up, you just responded to that with a fair point... and the comment you responded to didn't mention browers to distract either, so it seems silly to me that there's now this hot potato of who distracted from what in play. Good points all around, that's what I'm seeing.
- bagsvaerd70 8y ago
  Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.
  - blfr 8y ago
    I don't. The only one I know is using Tor Browser without any customization, without even changing the windows size, because it makes you look like every other Tor Browser user. However, it comes with a fairly long list of downsides: less secure than Chrome, less secure than even Firefox it's based on because it's not updated as often and quickly, and you MITM yourself by default, and it's slow, it doesn't block ads... The price to pay is steep.
    - crtasm 8y ago
      It's fast enough to be my main browser and plays e.g. YouTube at lower resolutions fine. I chose to install ublock origin, makes me stand out more from other users but I'm on Linux which is now revealed directly in the useragent string so I decided it wasn't a concern for me as I'm already not in the larger group of Windows users.
  - Santosh83 8y ago
    Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.
    - freedomben 8y ago
      This 100%. It will also make your web experience a lot better because so much of the javascript out there just does things you don't want anyway, such as loading ads and displaying popups. If you are a web developer or are familiar with web terminology like origins, domains, frames, XHR, etc on the web, and are willing to put in some time learning how to use it (15 mins for a seasoned web dev, maybe 30-60 mins otherwise) get uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix). It will change your life! If not, use ScriptBlock on Chrome or NoScript on Firefox. Block all scripts (and if using uMatrix, cookies, XHR, and frames) by default and whitelist as you go for sites you trust (or want to use bad enough to potentially open yourself up for tracking).
- tokyodude 8y ago
  I'm not totally convinced panopticlick is as real as they claim. Try you're on the west or east coast of the USA and own an 1 or 2 year old iphone try visiting. It will likely tell you you're identifible 1 out of 500k or so. But except for time zone all iPhones of the same model should have the same fingerprint. Pretty much any calcluation on how many iphones 1 or 2 years old in the same time zone will make it clear that 500k is several orders of magnitude off. I'm not saying you can't finger print, and like you pointed out it's easier on desktop. I'm only pointing out that panopticlick needs some work to be more accurate.
dvfjsdhgfv 8y ago
> The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Of course. On the other hand, Google's global attitude is that user tracking is fine, their core business is based on that. So it would be hypocritical on their part if they decided to block user tracking on their devices.
- kerng 8y ago
  Yes, it's in Google's interest to be able to uniquely identify each user so they can also serve "better" ads...
- scarface74 8y ago
  So it’s better not to buy your device based on a operating system created by an advertising company...
  - majui 8y ago
    All smartphones are bad.
- kllrnohj 8y ago
  They have increasingly revised or clamped down on the various unique IDs and are pushing everyone to the (user-resetable) advertising ID. Things like the MAC have already been hardcoded to a single fixed value for a couple of years now. You're just spreading unsupported fud. Actions speak louder than words and Google's actions for Android apps and APIs do not agree with your comments.
  - dvfjsdhgfv 8y ago
    It's very kind of Google to, say, make the recent change re. Build.SERIAL/Build.getSerial() so that it requires a permission now. That's a step in the right direction, but we're still very far from being untrackable.
Daniel_sk 8y ago
They are removing the ability to get any device identifiers in newer Android versions - unless you ask the user for a permission. https://developer.android.com/training/articles/user-data-ids https://developer.android.com/training/articles/user-data-id... There are advertising IDs and these can be reset. But I am not saying it's ideal in Android - up until recently you could easily fingerprint a device and you can do it today if you ask the users for permission (which the average user doesn't read or you can trick him into accepting the permission request).
- scarface74 8y ago
  “asking users for permission” never works. You end up with Vista style UAC. What about not allowing it all? Even before iOS and Android were a thing, Windows Mobile had a way for apps to uniquely identify a device but that unique identifier was per app/per user.
  - lern_too_spel 8y ago
    Because there are some applications that have a real need for knowing the actual MAC address or the IMEI.
    - scarface74 8y ago
      Which applications would that be? I’m sure there are applications that need unlimited access to your file system, read your text messages, and read your call logs. How has that worked out for the privacy and security of Android users?
      - lern_too_spel 8y ago
        Much better than the privacy and security of iOS, which has had hundreds of millions of users infected with XCodeGhost. All while allowing much more useful applications to be built. The fact that the application must request permission to see that data gets those applications extra scrutiny from not only the user but the app store and third party security researchers as well.
sfifs 8y ago
> The Android platform API should simply never allow apps to obtain global system identifiers When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs. Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to do so suggests they want to keep the possibility of re-entering the advertising business (or at least portray so to their shareholders)
- SlowRobotAhead 8y ago
  >When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. Well put. I’ve tried to explain to people that I prefer Apple’s upfrontness that they are there to sell me a device and it’s software for money. Unlike Android systems where I feel the lead is intentionally buried by telling me how “free” the software is.
  - zozbot123 8y ago
    iOS apps have similar issues, actually. On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS. (More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS. Not usable right now, but it's progressing rather quickly, and may well be practically useful later in 2019.)
    - paulcole 8y ago
      > iOS apps have similar issues, actually. Which issues specifically?
      - zozbot123 8y ago
        Being non-free and non-auditable, including proprietary SDKs that can gather tracking info/IDs, connecting to Facebook (even when the app is something other than a FB client)... Stuff that's quite comparable to what the video is talking about.
api 8y ago
The main business goal of mobile platforms is to spy on users.
jniedrauer 8y ago
Using local storage/hardware to track devices is easy mode, but removing those options won't come even close to limiting per-device tracking. You can track clients using entirely serverside techniques. You can also leverage legitimate security features (like HSTS headers) to track clients.
em3rgent0rdr 8y ago
You can run the Facebook mobile site inside Firefox browser and do all those things. Or use an open source wrapper app like FaceSlim so that the mobile site can feel like an app.
gcb0 8y ago
I would say educated, not spoiled. if you so choose to not install apps (which are the same of, in the 90s, going to twocows or download.com, searching for idiot applications like "blockbuster" and installing them in your computer with full access to memory and disk) then you can buy an android phone, install firefox, install uBlock Origin, and only use those companies offerings via the browser. granted, you will have to give up on netflix unless you want to install their DRM client, just like in the desktop.
trishmapow2 8y ago
For the power-users out there there is a solution, install Xposed[0] on your device (root and custom recovery required of course) and then XPrivacyLua[1] which provides fine controls allowing you to hide identifiers (ad IDs etc), tracking, activity, applications installed, network info, analytics and much more for each app. Best part is it sends fake data to make sure apps don't crash or complain. [0]: https://forum.xda-developers.com/showthread.php?t=3034811 https://forum.xda-developers.com/showthread.php?t=3034811 [1]: https://github.com/M66B/XPrivacyLua https://github.com/M66B/XPrivacyLua
burtonator 8y ago
A major issue for me recently is that I've found my users VERY distrustful of ANYTHING regarding tracking, cloud usages, etc. I'm just an ISV and have no evil intentions but I"m constantly having to defend myself against people saying I'm trying to track them too much. I'm trying to track app version numbers, how often features are used, etc.
- badrabbit 8y ago
  Yeah but that can be used against your users. I've used user-agent's from the facebook app against a user for example(legit work :) ). It contains the phone version,app version and so much other detail that's a unique identifier.
lazyjones 8y ago
> The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a shared filesystem. Well, that's a nice wish for Santa, but does anyone really expect such a policy from an advertising company like Google?
- markovbot 8y ago
  Not without public pressure. Commenting on it, reminding everyone that this is actually Google's fault in the first place, etc, is a good way to apply that pressure. Otherwise it's just on Facebook, and they do not give a fuck what people think of them.
kgwxd 8y ago
Firefox Mobile for Android has all the spoils.

by nly 8y ago

blfr 8y ago

While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs. EFF has had a proof of concept online for quite a while https://panopticlick.eff.org/ https://panopticlick.eff.org/ And HN users are probably even more vulnerable since we will have customized our software making it stand out.

dvfjsdhgfv 8y ago
> And HN users are probably even more vulnerable since we will have customized our software making it stand out. On the other hand, among HN users you'll probably find a higher percentage of those who block JS by default and allow it only on selected websites. Most of these fingerprinting methods (and most web abuse in general) depends on JS being turned on.
- blfr 8y ago
  Maybe. OTOH, how many people who share your IP addresses use the same browser, OS, and block JS? Unless you're using a vanilla Tor Browser, you will probably stand out. And if you are, 'tptacek will tell you how it's a bad idea for other reasons.
nly 8y ago
I know you're not disagreeing with me, but the issue you raise only distracts and lends ammo to the defenders of these prolific tracking mechanisms. It's the Nirvana fallacy. I'm sure there's a Google rep somewhere that will tell you that their "advertising ID" is better than the status quo on the web because the user can rotate it and, because it's reliable and easy for app devs to use, they are discouraged from being more nefarious and sneaky in tracking users. This is all a bloody distraction from the point: it should not be an acceptable norm for this tracking to happen and it should be as hard as possible to pull off without informed user consent. The degree to which platforms are defensive against it is a different issue to whether or not they actively encourage it by design... which shouldn't even be open to debate.
- VRay 8y ago
  That's a good point. Depending on permissions, it would be hard to keep some malicious apps from stealing your nude photos too, but we don't take it for granted that "Of course the file explorer app looks for and surreptitiously uploads nudes! How else are they supposed to make money?" Our world is starting to looka lot like that of the Space Merchants..
- blfr 8y ago
  I didn't disagree with your original comment by I do disagree with the follow-up. It's neither a distraction, nor a fallacy. First, our computing devices do not protect our privacy and security sufficiently. It's a general problem, not limited or even particularly affecting Android. And you deal with general problems differently than with incidental ones. You don't tell people in an epidemic to "just go see a doctor." Second, I do more sensitive computing in the browser on my computer than I do on my phone. It's the bigger issue. Finally, the way we dealt with Internet worms and viruses was not by strongly stating how unacceptable infecting other people's computers is. We patched our software, kept it up to date, and even completely changed its design. Later shamed Microsoft into doing the same.
  - PavlovsCat 8y ago
    I upvoted you because while I disagree that browsers are the bigger issue (many people use mobile devices for important things, and the less tech literate, the higher the chance they do all their online stuff with them, I'll just claim that), you didn't bring browsers up, you just responded to that with a fair point... and the comment you responded to didn't mention browers to distract either, so it seems silly to me that there's now this hot potato of who distracted from what in play. Good points all around, that's what I'm seeing.
bagsvaerd70 8y ago
Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.
- blfr 8y ago
  I don't. The only one I know is using Tor Browser without any customization, without even changing the windows size, because it makes you look like every other Tor Browser user. However, it comes with a fairly long list of downsides: less secure than Chrome, less secure than even Firefox it's based on because it's not updated as often and quickly, and you MITM yourself by default, and it's slow, it doesn't block ads... The price to pay is steep.
  - crtasm 8y ago
    It's fast enough to be my main browser and plays e.g. YouTube at lower resolutions fine. I chose to install ublock origin, makes me stand out more from other users but I'm on Linux which is now revealed directly in the useragent string so I decided it wasn't a concern for me as I'm already not in the larger group of Windows users.
- Santosh83 8y ago
  Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.
  - freedomben 8y ago
    This 100%. It will also make your web experience a lot better because so much of the javascript out there just does things you don't want anyway, such as loading ads and displaying popups. If you are a web developer or are familiar with web terminology like origins, domains, frames, XHR, etc on the web, and are willing to put in some time learning how to use it (15 mins for a seasoned web dev, maybe 30-60 mins otherwise) get uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix). It will change your life! If not, use ScriptBlock on Chrome or NoScript on Firefox. Block all scripts (and if using uMatrix, cookies, XHR, and frames) by default and whitelist as you go for sites you trust (or want to use bad enough to potentially open yourself up for tracking).
tokyodude 8y ago
I'm not totally convinced panopticlick is as real as they claim. Try you're on the west or east coast of the USA and own an 1 or 2 year old iphone try visiting. It will likely tell you you're identifible 1 out of 500k or so. But except for time zone all iPhones of the same model should have the same fingerprint. Pretty much any calcluation on how many iphones 1 or 2 years old in the same time zone will make it clear that 500k is several orders of magnitude off. I'm not saying you can't finger print, and like you pointed out it's easier on desktop. I'm only pointing out that panopticlick needs some work to be more accurate.

dvfjsdhgfv 8y ago

> The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Of course. On the other hand, Google's global attitude is that user tracking is fine, their core business is based on that. So it would be hypocritical on their part if they decided to block user tracking on their devices.

kerng 8y ago
Yes, it's in Google's interest to be able to uniquely identify each user so they can also serve "better" ads...
scarface74 8y ago
So it’s better not to buy your device based on a operating system created by an advertising company...
- majui 8y ago
  All smartphones are bad.
kllrnohj 8y ago
They have increasingly revised or clamped down on the various unique IDs and are pushing everyone to the (user-resetable) advertising ID. Things like the MAC have already been hardcoded to a single fixed value for a couple of years now. You're just spreading unsupported fud. Actions speak louder than words and Google's actions for Android apps and APIs do not agree with your comments.
- dvfjsdhgfv 8y ago
  It's very kind of Google to, say, make the recent change re. Build.SERIAL/Build.getSerial() so that it requires a permission now. That's a step in the right direction, but we're still very far from being untrackable.

Daniel_sk 8y ago

They are removing the ability to get any device identifiers in newer Android versions - unless you ask the user for a permission. https://developer.android.com/training/articles/user-data-ids https://developer.android.com/training/articles/user-data-id... There are advertising IDs and these can be reset. But I am not saying it's ideal in Android - up until recently you could easily fingerprint a device and you can do it today if you ask the users for permission (which the average user doesn't read or you can trick him into accepting the permission request).

scarface74 8y ago
“asking users for permission” never works. You end up with Vista style UAC. What about not allowing it all? Even before iOS and Android were a thing, Windows Mobile had a way for apps to uniquely identify a device but that unique identifier was per app/per user.
- lern_too_spel 8y ago
  Because there are some applications that have a real need for knowing the actual MAC address or the IMEI.
  - scarface74 8y ago
    Which applications would that be? I’m sure there are applications that need unlimited access to your file system, read your text messages, and read your call logs. How has that worked out for the privacy and security of Android users?
    - lern_too_spel 8y ago
      Much better than the privacy and security of iOS, which has had hundreds of millions of users infected with XCodeGhost. All while allowing much more useful applications to be built. The fact that the application must request permission to see that data gets those applications extra scrutiny from not only the user but the app store and third party security researchers as well.

sfifs 8y ago

> The Android platform API should simply never allow apps to obtain global system identifiers When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs. Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to do so suggests they want to keep the possibility of re-entering the advertising business (or at least portray so to their shareholders)

SlowRobotAhead 8y ago
>When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. Well put. I’ve tried to explain to people that I prefer Apple’s upfrontness that they are there to sell me a device and it’s software for money. Unlike Android systems where I feel the lead is intentionally buried by telling me how “free” the software is.
- zozbot123 8y ago
  iOS apps have similar issues, actually. On the Android side, you can at least use free and auditable apps from the F-Droid repository, and buy your device from an OEM vendor which will let you unlock it and install google-free LineageOS. (More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS. Not usable right now, but it's progressing rather quickly, and may well be practically useful later in 2019.)
  - paulcole 8y ago
    > iOS apps have similar issues, actually. Which issues specifically?
    - zozbot123 8y ago
      Being non-free and non-auditable, including proprietary SDKs that can gather tracking info/IDs, connecting to Facebook (even when the app is something other than a FB client)... Stuff that's quite comparable to what the video is talking about.

api 8y ago

The main business goal of mobile platforms is to spy on users.

jniedrauer 8y ago

Using local storage/hardware to track devices is easy mode, but removing those options won't come even close to limiting per-device tracking. You can track clients using entirely serverside techniques. You can also leverage legitimate security features (like HSTS headers) to track clients.

em3rgent0rdr 8y ago

You can run the Facebook mobile site inside Firefox browser and do all those things. Or use an open source wrapper app like FaceSlim so that the mobile site can feel like an app.

gcb0 8y ago

I would say educated, not spoiled. if you so choose to not install apps (which are the same of, in the 90s, going to twocows or download.com, searching for idiot applications like "blockbuster" and installing them in your computer with full access to memory and disk) then you can buy an android phone, install firefox, install uBlock Origin, and only use those companies offerings via the browser. granted, you will have to give up on netflix unless you want to install their DRM client, just like in the desktop.

trishmapow2 8y ago

For the power-users out there there is a solution, install Xposed[0] on your device (root and custom recovery required of course) and then XPrivacyLua[1] which provides fine controls allowing you to hide identifiers (ad IDs etc), tracking, activity, applications installed, network info, analytics and much more for each app. Best part is it sends fake data to make sure apps don't crash or complain. [0]: https://forum.xda-developers.com/showthread.php?t=3034811 https://forum.xda-developers.com/showthread.php?t=3034811 [1]: https://github.com/M66B/XPrivacyLua https://github.com/M66B/XPrivacyLua

burtonator 8y ago

A major issue for me recently is that I've found my users VERY distrustful of ANYTHING regarding tracking, cloud usages, etc. I'm just an ISV and have no evil intentions but I"m constantly having to defend myself against people saying I'm trying to track them too much. I'm trying to track app version numbers, how often features are used, etc.

badrabbit 8y ago
Yeah but that can be used against your users. I've used user-agent's from the facebook app against a user for example(legit work :) ). It contains the phone version,app version and so much other detail that's a unique identifier.

lazyjones 8y ago

> The Android platform API should simply never allow apps to obtain global system identifiers (serial numbers, "advertising IDs", MACs, Wifi network info, EMEIs etc) in the first place. Perhaps even going as far as not providing a shared filesystem. Well, that's a nice wish for Santa, but does anyone really expect such a policy from an advertising company like Google?

markovbot 8y ago
Not without public pressure. Commenting on it, reminding everyone that this is actually Google's fault in the first place, etc, is a good way to apply that pressure. Otherwise it's just on Facebook, and they do not give a fuck what people think of them.

kgwxd 8y ago

Firefox Mobile for Android has all the spoils.