5 ms·

Apps sending users’ data to Facebook without their consent

59 points by trigger 8y ago

thisacctforreal 8y ago
According to the 35c3 talk[0] by the authors, both SkyScanner and The Weather Channel updated their apps to stop the tracking after the authors told them it was happening. [0] https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/ https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...
- deleted 8y ago
  [deleted]
samstave 8y ago
Simple question: We have firewall capability on every computer. I am surprised that we don't have a FW on a phone - or an app that can be installed which I can force all traffic from the phone to pass through, with source-app and destination IP/App/Service - and choose to block the traffic we would like. Are the devices capable of this?
- Gigamo 8y ago
  Check out NetGuard: https://f-droid.org/en/packages/eu.faircode.netguard/ https://f-droid.org/en/packages/eu.faircode.netguard/
  - jkl1x 8y ago
    +1 for NetGuard. I just started using it recently on a new phone and it was the first thing I installed before connecting the device to any network. You would be amazed how many apps try to make a connection to graph.facebook.com Check out Exodus Privacy[1] to see what trackers are inside a certain app. One could use F-Droid and Yalp Store[2] to try and have a bit more privacy on an Android phone and make it work without a Google account. [1] https://exodus-privacy.eu.org/en/ https://exodus-privacy.eu.org/en/ [2] https://github.com/yeriomin/YalpStore https://github.com/yeriomin/YalpStore
  - amoshi 8y ago
    Too bad it works by creating a local VPN - I'm already using "Block This!" to block ads on my device which also works via a VPN, so you can't use both at the same time.
    - thisacctforreal 8y ago
      I wonder if it's possible to create an app that creates a local VPN that routes through the other VPNs.
- hyperdunc 8y ago
  If you have a rooted Android phone, use AFWall. It's available on F-Droid and Google Play and uses the hosts file. If not rooted then use NetGuard (as mentioned in another comment). It sets up a local VPN on your phone to filter traffic. Other apps also use the local VPN approach for different reasons, e.g. DNS66 allows you to specify your own DNS servers. You'll only be able to use one VPN app at a time.
JumpCrisscross 8y ago
When do we expect the first GDPR challenges to land on Facebook? The law was clearly designed to deal with them. They continue to violate its principles. GDPR delivered tremendous collateral damage to raise these gates. But where is the pay-off? Is there preliminary footwork deploying? Or is Europe distracted by Italy et al?
- tjoff 8y ago
  Facebook tries to offload the responsibility to developers. This is shady at best and I hope the law catch up. But there is also the problem of developers that just don't care. Or, developers that think they care but can't even be bothered to research what a library they include in an application actually does. This is is something that the death of facebook will not solve. GDPR has already been paid off, every day for every user both in the online and offline world is a victory, and examples of it was shown in the talk as well. How GDPR pushed developers to discover this issue and demand solutions for their own apps. How facebook improved the ability for developers to be privacy conscious etc. (hardly by choice, but even they didn't think they could get away with less)
- Despegar 8y ago
  Yes, Facebook and Google were sued almost immediately by activists after GDPR went into effect [1][2]. Those test cases will take time to play out. [1] https://www.theregister.co.uk/2018/05/25/schrems_is_back_facebook_google_get_served_gdpr_complaint/ https://www.theregister.co.uk/2018/05/25/schrems_is_back_fac... [2] https://www.ft.com/content/86d1ce50-3799-11e8-8eee-e06bde01c544 https://www.ft.com/content/86d1ce50-3799-11e8-8eee-e06bde01c...
warent 8y ago
So let's see here. There are apps that people download which, in a way, replicate themselves by enticing other people to download them often using some form of psychological engineering. These apps then compromise the person's data by streaming it to a server. The word "app" is frequently used, but these sound more like computer viruses with a friendly UI, no?
- swebs 8y ago
  A virus self replicates without human interaction.
  - mirimir 8y ago
    No, worms do that. Viruses must be spread. But of course, you can have hybrids, such as WannaCry.
- CamperBob2 8y ago
  The word "app" is frequently used, but these sound more like computer viruses with a friendly UI, no? I think that's a pretty profound way to look at it, but under a broader rubric -- perhaps "User-friendly malware" would be a better euphemism. It's also an ideal way to describe things like Windows Update. It's easy to imagine some of history's most notorious virus authors going straight, working for Facebook and Microsoft. More money, more respect, and the retirement plan beats going to prison.
  - zozbot123 8y ago
    The established name for this sort of "phishing" malware is "Trojan horse malware" https://en.wikipedia.org/wiki/Trojan_horse_(computing) https://en.wikipedia.org/wiki/Trojan_horse_(computing) - a malicious computer program which is designed to appear non-suspicious and mislead users wrt. its malicious activity. The irony is that the complex "app-specific privileges and permissions" system featured on mobile OSs was specifically intended to prevent mobile "apps" being used as dangerous trojan-horses, as was - to a lesser extent - the model of centralized "app store" repositories. It's not working very well. In this case, we're specifically dealing with spyware - a common sort of malware where the malicious activity is invading the user's privacy.
Despegar 8y ago
Apple needs to ban these SDKs from being included in apps. No one reads the privacy policies and they leak data to another party that the user doesn't have a relationship with. Provide first party services, intermediate between apps and ad networks and/or white list a handful of companies to provide these services that are audited and have separate contractual relationships with Apple. I think a good idea would be to stipulate to Facebook, Google, and every purveyor of "analytics" SDKs that they need to serve iOS app developers and their users from EU subsidiaries that are subject to GDPR.
- hedora 8y ago
  The article doesn’t mention Apple. Do these apps also do this on iOS?
  - pseudalopex 8y ago
    Many iOS apps connect to graph.facebook.com without asking.
  - judge2020 8y ago
    Apple has a policy that apps (and their SDKs) must comply with IDFA, so if a user doesn't want to be tracked across the apps they use they can go to settings -> privacy -> advertising to turn off the tracking.
    - Rjevski 8y ago
      Doesn’t solve the issue of device fingerprinting. There are a lot of data points that can be used to create a near-unique fingerprint of a device.
  - Rjevski 8y ago
    iOS doesn’t provide a system-wide unique ID however there is still more than enough data (WiFi network names, device name, device type, IP address, etc) that Shitbook can uniquely fingerprint a device and identify a user.
dang 8y ago
https://news.ycombinator.com/item?id=18788658 https://news.ycombinator.com/item?id=18788658
philliphaydon 8y ago
Can add Agoda to that list. I find it insane how I can visit Agoda in a private tab. Search for hotels. Visit 2 of the hotels. Then switch to Facebook and almost immediately get adverts for exactly those 2 hotels...

59 points by trigger 8y ago

According to the 35c3 talk[0] by the authors, both SkyScanner and The Weather Channel updated their apps to stop the tracking after the authors told them it was happening. [0] https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/ https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...

deleted 8y ago
[deleted]

samstave 8y ago

Simple question: We have firewall capability on every computer. I am surprised that we don't have a FW on a phone - or an app that can be installed which I can force all traffic from the phone to pass through, with source-app and destination IP/App/Service - and choose to block the traffic we would like. Are the devices capable of this?

Gigamo 8y ago
Check out NetGuard: https://f-droid.org/en/packages/eu.faircode.netguard/ https://f-droid.org/en/packages/eu.faircode.netguard/
- jkl1x 8y ago
  +1 for NetGuard. I just started using it recently on a new phone and it was the first thing I installed before connecting the device to any network. You would be amazed how many apps try to make a connection to graph.facebook.com Check out Exodus Privacy[1] to see what trackers are inside a certain app. One could use F-Droid and Yalp Store[2] to try and have a bit more privacy on an Android phone and make it work without a Google account. [1] https://exodus-privacy.eu.org/en/ https://exodus-privacy.eu.org/en/ [2] https://github.com/yeriomin/YalpStore https://github.com/yeriomin/YalpStore
- amoshi 8y ago
  Too bad it works by creating a local VPN - I'm already using "Block This!" to block ads on my device which also works via a VPN, so you can't use both at the same time.
  - thisacctforreal 8y ago
    I wonder if it's possible to create an app that creates a local VPN that routes through the other VPNs.
hyperdunc 8y ago
If you have a rooted Android phone, use AFWall. It's available on F-Droid and Google Play and uses the hosts file. If not rooted then use NetGuard (as mentioned in another comment). It sets up a local VPN on your phone to filter traffic. Other apps also use the local VPN approach for different reasons, e.g. DNS66 allows you to specify your own DNS servers. You'll only be able to use one VPN app at a time.

JumpCrisscross 8y ago

When do we expect the first GDPR challenges to land on Facebook? The law was clearly designed to deal with them. They continue to violate its principles. GDPR delivered tremendous collateral damage to raise these gates. But where is the pay-off? Is there preliminary footwork deploying? Or is Europe distracted by Italy et al?

tjoff 8y ago
Facebook tries to offload the responsibility to developers. This is shady at best and I hope the law catch up. But there is also the problem of developers that just don't care. Or, developers that think they care but can't even be bothered to research what a library they include in an application actually does. This is is something that the death of facebook will not solve. GDPR has already been paid off, every day for every user both in the online and offline world is a victory, and examples of it was shown in the talk as well. How GDPR pushed developers to discover this issue and demand solutions for their own apps. How facebook improved the ability for developers to be privacy conscious etc. (hardly by choice, but even they didn't think they could get away with less)
Despegar 8y ago
Yes, Facebook and Google were sued almost immediately by activists after GDPR went into effect [1][2]. Those test cases will take time to play out. [1] https://www.theregister.co.uk/2018/05/25/schrems_is_back_facebook_google_get_served_gdpr_complaint/ https://www.theregister.co.uk/2018/05/25/schrems_is_back_fac... [2] https://www.ft.com/content/86d1ce50-3799-11e8-8eee-e06bde01c544 https://www.ft.com/content/86d1ce50-3799-11e8-8eee-e06bde01c...

warent 8y ago

So let's see here. There are apps that people download which, in a way, replicate themselves by enticing other people to download them often using some form of psychological engineering. These apps then compromise the person's data by streaming it to a server. The word "app" is frequently used, but these sound more like computer viruses with a friendly UI, no?

swebs 8y ago
A virus self replicates without human interaction.
- mirimir 8y ago
  No, worms do that. Viruses must be spread. But of course, you can have hybrids, such as WannaCry.
CamperBob2 8y ago
The word "app" is frequently used, but these sound more like computer viruses with a friendly UI, no? I think that's a pretty profound way to look at it, but under a broader rubric -- perhaps "User-friendly malware" would be a better euphemism. It's also an ideal way to describe things like Windows Update. It's easy to imagine some of history's most notorious virus authors going straight, working for Facebook and Microsoft. More money, more respect, and the retirement plan beats going to prison.
- zozbot123 8y ago
  The established name for this sort of "phishing" malware is "Trojan horse malware" https://en.wikipedia.org/wiki/Trojan_horse_(computing) https://en.wikipedia.org/wiki/Trojan_horse_(computing) - a malicious computer program which is designed to appear non-suspicious and mislead users wrt. its malicious activity. The irony is that the complex "app-specific privileges and permissions" system featured on mobile OSs was specifically intended to prevent mobile "apps" being used as dangerous trojan-horses, as was - to a lesser extent - the model of centralized "app store" repositories. It's not working very well. In this case, we're specifically dealing with spyware - a common sort of malware where the malicious activity is invading the user's privacy.

Despegar 8y ago

Apple needs to ban these SDKs from being included in apps. No one reads the privacy policies and they leak data to another party that the user doesn't have a relationship with. Provide first party services, intermediate between apps and ad networks and/or white list a handful of companies to provide these services that are audited and have separate contractual relationships with Apple. I think a good idea would be to stipulate to Facebook, Google, and every purveyor of "analytics" SDKs that they need to serve iOS app developers and their users from EU subsidiaries that are subject to GDPR.

hedora 8y ago
The article doesn’t mention Apple. Do these apps also do this on iOS?
- pseudalopex 8y ago
  Many iOS apps connect to graph.facebook.com without asking.
- judge2020 8y ago
  Apple has a policy that apps (and their SDKs) must comply with IDFA, so if a user doesn't want to be tracked across the apps they use they can go to settings -> privacy -> advertising to turn off the tracking.
  - Rjevski 8y ago
    Doesn’t solve the issue of device fingerprinting. There are a lot of data points that can be used to create a near-unique fingerprint of a device.
- Rjevski 8y ago
  iOS doesn’t provide a system-wide unique ID however there is still more than enough data (WiFi network names, device name, device type, IP address, etc) that Shitbook can uniquely fingerprint a device and identify a user.

dang 8y ago

https://news.ycombinator.com/item?id=18788658 https://news.ycombinator.com/item?id=18788658

philliphaydon 8y ago

Can add Agoda to that list. I find it insane how I can visit Agoda in a private tab. Search for hotels. Visit 2 of the hotels. Then switch to Facebook and almost immediately get adverts for exactly those 2 hotels...