10 ms·

How Apps on Android Share Data with Facebook (2018)

326 points by allwynpfr 8y ago

devoply 8y ago
Is there any solution to ban facebook from your android phone like you can from a browser like firefox through a facebook container? I would imagine something like a firewall that keeps your phone from being able to connect to URLs or IPs owned by Facebook.
- robjan 8y ago
  You can download an app which changes your DNS settings (without root it creates a local VPN) then point it to a server that blackholes Facebook
- franky47 8y ago
  I use Exodus Privacy [1] to learn more about what SDKs and permissions are used by the app before even installing it, and as a last line of defense, NetGuard [2] which is an open-source VPN-based firewall that lets you block requests to some servers on a per-app basis (some features are paid). [1] https://reports.exodus-privacy.eu.org/en/ https://reports.exodus-privacy.eu.org/en/ [2] https://www.netguard.me/ https://www.netguard.me/
  - spunker540 8y ago
    This doesn’t tell you about any data sharing that happens serverside.
  - djaychela 8y ago
    Well, using exodus privacy to look up some apps that I use has just opened up a portal to hell for me! I had no idea about the depth of the tracking that was happening - I foolishly thought it was only browsing issues I needed to worry about until reading this thread and then looking on there. Thanks for opening my eyes to this!
- irishdude5186 8y ago
  I would recommend blockada. Its open source.
  - irishdude5186 8y ago
    Also, it gives you a real eye opener as to what apps are sending out..
  - ignoramous 8y ago
    Blockada doesn't do DoH or DoT yet. You should try https://getintra.org https://getintra.org and use it with AdGuard DNS [0] [0] https://news.ycombinator.com/item?id=18788410 https://news.ycombinator.com/item?id=18788410
- random878 8y ago
  You can ban Facebook from your phone by choosing not use it.
ndnxhs 8y ago
The only way to crack down on this is to prevent apps sending any data at all and to minimise the use of proprietary software. As soon as your personal data leaves your phone and hits someone else's server they will sell it. Its a bit of a hard problem which we tried to solve using a permissions system but its a hassle because its hard to tell if a permission is being used legitimately and the average user just hits accept on anything because they don't know how to verify if something seems right. The GDPR was a step in the right direction where it allows you to say no to tracking and still use the service as normal.
- Drakim 8y ago
  I think it's not good enough to merely prevent it from happening with sandboxing or permissions, that's a very technically-oriented way of solving the problem (and obviously what most of us here on HN would go to first). But merely preventing it on a technical level creates this race where companies and startups are always finding new ways to violate our privacy, while we stumble after trying to patch the latest evil, hoping that it's even possible to patch this time. Stop ajax calls to third party domains? What if they start piping it though the first party server? etc. There fundamentally needs to be laws and principles in place that sets clear lines as to what's okay and not, it shouldn't come down to "whatever is technically possible". You may NOT take my personal data, my contact list, my browsing habits, and sell them to a third party, even if it's hidden somewhere deep in your T&S. No human actually wants you to do that, if you offered somebody on the street five bucks for their phone contact list they wouldn't say yes. It's only possible because you are doing these evil things hidden from view.
  - Ntrails 8y ago
    > No human actually wants you to do that, if you offered somebody on the street five bucks for their phone contact list they wouldn't say yes. There is an argument i have with a guy who stands on the street offering 'free coffee'. So i ask for a voucher, and he explains i have to download an app. I am not convinced that is truly free.
  - nl 8y ago
    Plenty of people will just tell you their password if you ask them nicely (https://www.google.com/amp/s/nakedsecurity.sophos.com/2015/01/21/people-happily-give-away-their-bad-passwords-to-tv-reporter/amp/ https://www.google.com/amp/s/nakedsecurity.sophos.com/2015/0...) so I'm pretty sure they'd give up their contact list.
mrzool 8y ago
I'd be very interested to know how this compares to apps on iOS. Can someone shed some light?
- saagarjha 8y ago
  Most of this is entirely possible on iOS and I would be surprised if the Facebook SDK didn't do the exact same thing.
- ankit219 8y ago
  The process is the same. You integrate the SDK and it will keep sending the data. No permission needed either. For a user, he would not even know what SDKs are integrated with the app, as it is never mentioned anywhere and no way to check it either.
- izacus 8y ago
  Most of these frameworks are built for iOS first and Android second (you can quickly glance at their marketing material to find proof). There are also no restrictions (policy or system-wise) that prevent these SDKs from uploading data about your profile as well. It's unfortunate that Android is singled out here - it'll lure iOS users into false sense of privacy.
  - tinus_hn 8y ago
    It is more difficult for apps to know your identity in other apps on iOS. Although Apple has bungled it quite a few times these frameworks are supposed to use an identifier that you can reset and change to be per-developer. Also if the framework goes over the line, which might be defined as ‘bad publicity happens’, Apple might come down hard and simply ban the whole thing (no app that includes the framework gets approved).
    - izacus 8y ago
      As I developer I didn't really see much of a difference - most of profile matching I've seen these SDKs do is via social logins and not via device identifiers. The OSes currently are very close in what you can get to identify the user.
mshahi8210 8y ago
Whats the sole purpose behind this?
- deleted 8y ago
  [deleted]
- robjan 8y ago
  Usually to track conversion rate of posts and other similar metrics
- deleted 8y ago
  [deleted]
- badwolf 8y ago
  Same as any other ads or analytics sdk (google, branch.io, etc...) getting data to target ads. Apps gladly integrate them, because they can get better analytics on how the app functions and is used, but also for marketing attribution (comes back to ads.) I find the outrage at Facebook for this to be a bit obnoxious. Are we equally as outraged at every app that has Google Analytics implemented? It's sending your data to Google, even if you don't have an account!
  - ignoramous 8y ago
    I'm not sure about you, but yes, I'm def outraged by analytics gathered without user's consent, sometimes complete with fingerprinting, as well. I tolerate WebRTC blocker, Canvas Blocker, DecentralEyes, FPI, PrivacyBadger, HttpsEverywhere, uMatrix, and NoScript on Firefox and painfully deal with all the broken websites, despite the costs. It is worth it ten times over.
amelius 8y ago
Question: it's been almost a year now since GDPR has come into effect. Has there been evidence that people from the EU have been able to completely withdraw themselves from the user-tracking universe?
- IshKebab 8y ago
  I doubt it. We need some prosecutions of Oath, Vox and so on before they start implementing the consent request properly.
  - Nextgrid 8y ago
    Oath is the business embodiment of cancer, it needs to be sued out of existence. It provides absolutely zero value and just makes the internet more toxic.
  - neop1x 8y ago
    It should be implemented in a "global" way. Instead of filling in no tracking forms for each website, they should be forced to honor DNT (do not track) header. Similarly on OS level, it should be possible to say to all apps that I don't want any tracking.
- kmlx 8y ago
  yes. websites across the world have been banning whole EU countries like there’s no tomorrow. but on the plus side we now we know how it feels for the Chinese and their firewall. only ours is called GDPR. to put this in context: there are more websites accessible from Hong Kong than from the EU.
  - canofbars 8y ago
    Which means the shitty companies are removed from the market and websites and companies that respect their users stop getting undercut by their unethical competition.
    - amelius 8y ago
ankit219 8y ago
This is not just facebook. This is what all the DMPs[1] in advertising do, and charge millions of dollars for it. There is BlueKai from Oracle, one from Adobe, and various others. The core proposition is to collect as much data about the user to understand the interests (profiling) and then target that user or users like him to get a better conversion rate. Why facebook emerged as a big player in this field was because the other companies were really expensive for consumer apps and hence they were used only by the biggest players. Facebook made it cheap, automated the process and allowed for targeting without even telling the advertisers what audience needs to be targeted. All at the cost startups and smbs could afford. Google also does the same. Infact all the big advertising networks do it, or utilize a DMP to do it on their behalf. I realize that this discussion is about privacy, and in that regard, it should not be allowed by any company. However, this is just the tip of the iceberg. Almost all the big players in travel have huge customer profiles on us, gained by our credit card transactions, credit history, data from insurance and other friendly companies (you scratch my back and I scratch yours) and various other practices which frequently compromise on user's privacy. I dont know how one can solve this though. [1] http://www.bluekai.com/files/DMP_Demystified_Whitepaper_BlueKai.pdf http://www.bluekai.com/files/DMP_Demystified_Whitepaper_Blue... [2] https://www.adobe.com/analytics/audience-manager.html https://www.adobe.com/analytics/audience-manager.html
- tgsovlerkhgsel 8y ago
  I think this is going to continue until both a few of the app developers and some of the DMPs get bankrupted through GDPR fines for not obtaining proper consent. The entire business model is infeasible under GDPR.
  - derefr 8y ago
    You don’t have to collect that much data from users in a given market (Europe), if you’ve already collected [and continue to collect] so much other data from users in other markets (America) that you’ve built up predictive models that only need a few hints in order to map a user to one of a well-known constellation of “profiles” that advertisers target their ads towards. Basically, GDPR only prevents DMPs from training their models using your app’s data (i.e. exfiltrating the user’s personal details from the client to a backend.) If, on the other hand, the DMP comes to you with an advertising library that runs entirely client-side and embeds a pre-trained model; where, when you call this library, it decides what profile of theirs a user slots into by doing things like e.g. “young or old based on how they type on a touch keyboard” (but in a much more clever ML-dictated fashion)... then there’s no violation here. You’re using the user’s personal data to derive a category to place them into; but you’re not recording or sending the user’s personal data anywhere. And when you, as an app, turn around and make a request to an ad network for ad media to display based on that profile, that’s not a violation of GDPR either: the derived profile is no longer information about a particular user, but is rather just a group that the user belongs to, with each profiling group being so large that that assertion-of-fact doesn’t help to de-anonymize the user any more than saying “they’re a human being” does—it’s not information that could be mapped back to the individual user. So it’s fine to send out. It can be taken a level further, as well; such “statistics that convert to a profile” can be aggregated into one per-app profile. At that point, you’re doing exactly what magazine publishers do: looking at the audience for a given magazine, building a summary profile of said audience, and then selling ad space to advertisers who want to target that summary profile. Of course, that same library will probably do a region check, and in the case that you’re not in the GDPR-affected area of the world, it will skip its (slightly crap) client-side detection logic and instead feed all your clicks and taps back to its (much smarter) backend, just like the previous version of the library was doing unilaterally.
HenryBemis 8y ago
NoRoot Firewall: I got a global Block rule for 31.13.. The exact same thing applies for all iOS devices. Web banking, airlines, almost every game. There very few exceptions of the most common apps, e.g. Dropbox, Skype, stock apps. Facebook is cancer. It gets into the body and never leaves. Unless you firewall or hosts block their IPs.
- elorant 8y ago
  Just a friendly reminder, because I see this line of reasoning too often in here. We're not the average Joe. Just because we can circumvent those techniques doesn't mean that everyone can, or for that matter they even bother to. Most people can't even understand the repercussions of profiling.
  - HenryBemis 8y ago
    I very well understan that, and unfortunately: 1) not many people see the evil of Facebook's immoral actions 2) not many people (even in here) are aware that they can firewall their Android devices.
- nepthar 8y ago
  I hadn't heard of NoRoot firewall, thanks for mentioning! Is the 31.13.. the range of addresses owned by FB?
OrgNet 8y ago
Does Facebook share data back with the app? For example, your name, etc...
- deleted 8y ago
  [deleted]
karmakaze 8y ago
Has anyone found the list of tested apps and their results? I've followed many of the links but find more articles/versions
- ignoramous 8y ago
  Are you looking for something equivalent to http://exodus-privacy.eu.org/ http://exodus-privacy.eu.org/ ?
- pretty_dumm_guy 8y ago
  Maybe this is what you are looking for ? I looked into certain apps (Shazam, Duolingo etc.,) and its quite interesting. https://privacyinternational.org/appdata https://privacyinternational.org/appdata
  - deleted 8y ago
    [deleted]
  - karmakaze 8y ago
    Yes thanks. I looked at this page but perhaps it didn't render fully on the platform I first saw it on.
kleiba 8y ago
"You have zero privacy anyway. Get over it." Scott McNealy, former chairman of Sun Microsystems.
- alamortsubite 8y ago
  (1999)
- elmo2you 8y ago
  The typical "accept reality and get over it" mentality has repeatedly and consistently been used throughout history to justify plunder. One might even wonder if it ever has been used for anything else. There was a time when legal businessmen, with sincerity, claimed that a dark skin color made you deserve to be slave. "When plunder becomes a way of life for a group of men in society, over the course of time they create for themselves a legal system that authorizes it and a moral code that glorifies it." ~ Frederic Bastiat
- kerng 8y ago
  Normalization of Deviance - we as the community of technical folks who have the engineering knowledge to tackle and highlight and help solve these issues should not follow that normalization. It's very dangerous. We need to continue highlighting unacceptable practices to drive privacy improvements in legislation. And we should establish ethics boards and education (ethical software engineering) amongst ourselves to stop building shady things.
- matz1 8y ago
  Yes, I would prefer to see solution that adapting to zero privacy life. Instead of trying to stop the flow of information.
- skummetmaelk 8y ago
  Ah yes. We should just accept body builders mugging us whenever we step outside because the reality is they are stronger than us.
  - dingaling 8y ago
allwynpfr 8y ago
The important point here to note is that it shares this data even if you don't use / don't have a facebook account
throw2016 8y ago
Isn't this the nightmare scenario the GPL was created to fight against, a device that is not acting in the users interest but against it, with tons of private APIs [1], complete lack of transparency, deceptive language and hoovering up user data to send to others. And the kicker is this is happening on the supposedly 'open' Android platform. Take that Stallman. Its really disappointing to see how the software ecosystem has degenerated into these shady mercenaries with zero compass. The only thing that can temper this crazy greed fueled appetite for surveillance is regulations and prosecutions because what some of these articles describe is venal and corrupt to restore some sense of propriety and civilization values. [1] https://techcrunch.com/2019/03/25/android-users-security-and-privacy-at-risk-from-shadowy-ecosystem-of-pre-installed-software-study-warns/ https://techcrunch.com/2019/03/25/android-users-security-and...
- random878 8y ago
  Android and the apps (in this sense) are not 'open source' and, regardless, 'open source' is not the same thing as 'Free'. Richard Stallman is known for his hatred of the term 'open source' (as it generally causes a misunderstanding such as yours).
ignoramous 8y ago
I have come across fair share of blog posts on how horrendous this is getting in the current age of big data and app economy. This behaviour is warranted by how VCs, PEs, and potential acquirers value a company... by number of users an app tracks. Boils down to battle for eye-balls all the way down because ads are guaranteed revenue stream that scales in-propotion to number-of-users * user-engagement, I guess. I think everyone agrees there's a market for a simple-to-use solution. Folks at https://GuardianApp.com https://GuardianApp.com are doing just that for iOS. For Android, apps like NoRootFirewall, NetGuard, Glasswire exist and other solutions like XPrivacyLua require root, or flashing LineageOS/ChromeheadOS and/or de-googling the phone voids the warranty. Most of the 2 Billion Android user-base wouldn't go anywhere near these. A stop-gap then might be to provide a zero-touch / firction-free Firewall/VPN app that's "free" and one that's anti-surveillance and anti-censorship, but is also transparent, in that it enables end-user to inspect the traffic flowing in and out of their devices. The challenge is no one wants to pay the internet provider and a random VPN app for a censorship-free / surveillance-free internet but they might gladly pay the internet provider extra premium if they offered the same experience. I know my dad wants this, but he wouldn't pay two entities for the same service. May be what https://puri.sm https://puri.sm is doing is the eventual end-game, but I think they're trying too hard. May be its time for an Android phone-manufacturer to launch a privacy focused phone. OnePlus reached its heights by placing itself as a Nexus/Pixel killer offering vanilla Android experience... so may be there's a market for privacy focused phone too, or may be https://e.foundation https://e.foundation might pull this miracle off and become mainstream enough to matter. Eventually, though, governments have to step in and bring forth regulations that prevents relentless surveillance of the end-user, similar to how wire-tapping phone-calls is illegal.
- paulcarroty 8y ago
  > May be its time for an Android phone-manufacturer to launch a privacy focused phone. LOL, they don't need it. Privacy focused phone doesn't generate money from user data. There's two ways: dumbphone or Apple.
  - tokyodude 8y ago
    see post above yours. Apple is not protecting your privacy. in fact they are explicitly disallowing your privacy to be protected.
deleted 8y ago
[deleted]
ape4 8y ago
I like the idea of your device giving out fake advertising id's out.
- ignoramous 8y ago
  There's more than ad-ids to fingerprinting a user [0]. For instance, MAC addresses (wifi, Bluetooth), IMEI, GPU based fingerprinting techniques, scanning for apps installed, WiFi networks connected to, location, and so on. You need to fake a lot of things to be scot-free from this madness. It's ashtonishing, really [1]. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/ [1] https://copperhead.co/android/docs/usage_guide https://copperhead.co/android/docs/usage_guide
product50 8y ago
This is so misleading. Almost all SDKs do this and this also happens on iOS too. If you have an SDK on iOS, there is nothing the OS can do to stop tracking of the users. Also, the author literally says that Google tracks even more apps vs. FB but still chooses to use FB in their headline. Sigh.

326 points by allwynpfr 8y ago

Is there any solution to ban facebook from your android phone like you can from a browser like firefox through a facebook container? I would imagine something like a firewall that keeps your phone from being able to connect to URLs or IPs owned by Facebook.

robjan 8y ago
You can download an app which changes your DNS settings (without root it creates a local VPN) then point it to a server that blackholes Facebook
franky47 8y ago
I use Exodus Privacy [1] to learn more about what SDKs and permissions are used by the app before even installing it, and as a last line of defense, NetGuard [2] which is an open-source VPN-based firewall that lets you block requests to some servers on a per-app basis (some features are paid). [1] https://reports.exodus-privacy.eu.org/en/ https://reports.exodus-privacy.eu.org/en/ [2] https://www.netguard.me/ https://www.netguard.me/
- spunker540 8y ago
  This doesn’t tell you about any data sharing that happens serverside.
- djaychela 8y ago
  Well, using exodus privacy to look up some apps that I use has just opened up a portal to hell for me! I had no idea about the depth of the tracking that was happening - I foolishly thought it was only browsing issues I needed to worry about until reading this thread and then looking on there. Thanks for opening my eyes to this!
irishdude5186 8y ago
I would recommend blockada. Its open source.
- irishdude5186 8y ago
  Also, it gives you a real eye opener as to what apps are sending out..
- ignoramous 8y ago
  Blockada doesn't do DoH or DoT yet. You should try https://getintra.org https://getintra.org and use it with AdGuard DNS [0] [0] https://news.ycombinator.com/item?id=18788410 https://news.ycombinator.com/item?id=18788410
random878 8y ago
You can ban Facebook from your phone by choosing not use it.

ndnxhs 8y ago

The only way to crack down on this is to prevent apps sending any data at all and to minimise the use of proprietary software. As soon as your personal data leaves your phone and hits someone else's server they will sell it. Its a bit of a hard problem which we tried to solve using a permissions system but its a hassle because its hard to tell if a permission is being used legitimately and the average user just hits accept on anything because they don't know how to verify if something seems right. The GDPR was a step in the right direction where it allows you to say no to tracking and still use the service as normal.

Drakim 8y ago
I think it's not good enough to merely prevent it from happening with sandboxing or permissions, that's a very technically-oriented way of solving the problem (and obviously what most of us here on HN would go to first). But merely preventing it on a technical level creates this race where companies and startups are always finding new ways to violate our privacy, while we stumble after trying to patch the latest evil, hoping that it's even possible to patch this time. Stop ajax calls to third party domains? What if they start piping it though the first party server? etc. There fundamentally needs to be laws and principles in place that sets clear lines as to what's okay and not, it shouldn't come down to "whatever is technically possible". You may NOT take my personal data, my contact list, my browsing habits, and sell them to a third party, even if it's hidden somewhere deep in your T&S. No human actually wants you to do that, if you offered somebody on the street five bucks for their phone contact list they wouldn't say yes. It's only possible because you are doing these evil things hidden from view.
- Ntrails 8y ago
  > No human actually wants you to do that, if you offered somebody on the street five bucks for their phone contact list they wouldn't say yes. There is an argument i have with a guy who stands on the street offering 'free coffee'. So i ask for a voucher, and he explains i have to download an app. I am not convinced that is truly free.
- nl 8y ago
  Plenty of people will just tell you their password if you ask them nicely (https://www.google.com/amp/s/nakedsecurity.sophos.com/2015/01/21/people-happily-give-away-their-bad-passwords-to-tv-reporter/amp/ https://www.google.com/amp/s/nakedsecurity.sophos.com/2015/0...) so I'm pretty sure they'd give up their contact list.

mrzool 8y ago

I'd be very interested to know how this compares to apps on iOS. Can someone shed some light?

saagarjha 8y ago
Most of this is entirely possible on iOS and I would be surprised if the Facebook SDK didn't do the exact same thing.
ankit219 8y ago
The process is the same. You integrate the SDK and it will keep sending the data. No permission needed either. For a user, he would not even know what SDKs are integrated with the app, as it is never mentioned anywhere and no way to check it either.
izacus 8y ago
Most of these frameworks are built for iOS first and Android second (you can quickly glance at their marketing material to find proof). There are also no restrictions (policy or system-wise) that prevent these SDKs from uploading data about your profile as well. It's unfortunate that Android is singled out here - it'll lure iOS users into false sense of privacy.
- tinus_hn 8y ago
  It is more difficult for apps to know your identity in other apps on iOS. Although Apple has bungled it quite a few times these frameworks are supposed to use an identifier that you can reset and change to be per-developer. Also if the framework goes over the line, which might be defined as ‘bad publicity happens’, Apple might come down hard and simply ban the whole thing (no app that includes the framework gets approved).
  - izacus 8y ago
    As I developer I didn't really see much of a difference - most of profile matching I've seen these SDKs do is via social logins and not via device identifiers. The OSes currently are very close in what you can get to identify the user.

mshahi8210 8y ago

Whats the sole purpose behind this?

deleted 8y ago
[deleted]
robjan 8y ago
Usually to track conversion rate of posts and other similar metrics
deleted 8y ago
[deleted]
badwolf 8y ago
Same as any other ads or analytics sdk (google, branch.io, etc...) getting data to target ads. Apps gladly integrate them, because they can get better analytics on how the app functions and is used, but also for marketing attribution (comes back to ads.) I find the outrage at Facebook for this to be a bit obnoxious. Are we equally as outraged at every app that has Google Analytics implemented? It's sending your data to Google, even if you don't have an account!
- ignoramous 8y ago
  I'm not sure about you, but yes, I'm def outraged by analytics gathered without user's consent, sometimes complete with fingerprinting, as well. I tolerate WebRTC blocker, Canvas Blocker, DecentralEyes, FPI, PrivacyBadger, HttpsEverywhere, uMatrix, and NoScript on Firefox and painfully deal with all the broken websites, despite the costs. It is worth it ten times over.

amelius 8y ago

Question: it's been almost a year now since GDPR has come into effect. Has there been evidence that people from the EU have been able to completely withdraw themselves from the user-tracking universe?

IshKebab 8y ago
I doubt it. We need some prosecutions of Oath, Vox and so on before they start implementing the consent request properly.
- Nextgrid 8y ago
  Oath is the business embodiment of cancer, it needs to be sued out of existence. It provides absolutely zero value and just makes the internet more toxic.
- neop1x 8y ago
  It should be implemented in a "global" way. Instead of filling in no tracking forms for each website, they should be forced to honor DNT (do not track) header. Similarly on OS level, it should be possible to say to all apps that I don't want any tracking.
kmlx 8y ago
yes. websites across the world have been banning whole EU countries like there’s no tomorrow. but on the plus side we now we know how it feels for the Chinese and their firewall. only ours is called GDPR. to put this in context: there are more websites accessible from Hong Kong than from the EU.
- canofbars 8y ago
  Which means the shitty companies are removed from the market and websites and companies that respect their users stop getting undercut by their unethical competition.
  - amelius 8y ago

ankit219 8y ago

This is not just facebook. This is what all the DMPs[1] in advertising do, and charge millions of dollars for it. There is BlueKai from Oracle, one from Adobe, and various others. The core proposition is to collect as much data about the user to understand the interests (profiling) and then target that user or users like him to get a better conversion rate. Why facebook emerged as a big player in this field was because the other companies were really expensive for consumer apps and hence they were used only by the biggest players. Facebook made it cheap, automated the process and allowed for targeting without even telling the advertisers what audience needs to be targeted. All at the cost startups and smbs could afford. Google also does the same. Infact all the big advertising networks do it, or utilize a DMP to do it on their behalf. I realize that this discussion is about privacy, and in that regard, it should not be allowed by any company. However, this is just the tip of the iceberg. Almost all the big players in travel have huge customer profiles on us, gained by our credit card transactions, credit history, data from insurance and other friendly companies (you scratch my back and I scratch yours) and various other practices which frequently compromise on user's privacy. I dont know how one can solve this though. [1] http://www.bluekai.com/files/DMP_Demystified_Whitepaper_BlueKai.pdf http://www.bluekai.com/files/DMP_Demystified_Whitepaper_Blue... [2] https://www.adobe.com/analytics/audience-manager.html https://www.adobe.com/analytics/audience-manager.html

tgsovlerkhgsel 8y ago
I think this is going to continue until both a few of the app developers and some of the DMPs get bankrupted through GDPR fines for not obtaining proper consent. The entire business model is infeasible under GDPR.
- derefr 8y ago
  You don’t have to collect that much data from users in a given market (Europe), if you’ve already collected [and continue to collect] so much other data from users in other markets (America) that you’ve built up predictive models that only need a few hints in order to map a user to one of a well-known constellation of “profiles” that advertisers target their ads towards. Basically, GDPR only prevents DMPs from training their models using your app’s data (i.e. exfiltrating the user’s personal details from the client to a backend.) If, on the other hand, the DMP comes to you with an advertising library that runs entirely client-side and embeds a pre-trained model; where, when you call this library, it decides what profile of theirs a user slots into by doing things like e.g. “young or old based on how they type on a touch keyboard” (but in a much more clever ML-dictated fashion)... then there’s no violation here. You’re using the user’s personal data to derive a category to place them into; but you’re not recording or sending the user’s personal data anywhere. And when you, as an app, turn around and make a request to an ad network for ad media to display based on that profile, that’s not a violation of GDPR either: the derived profile is no longer information about a particular user, but is rather just a group that the user belongs to, with each profiling group being so large that that assertion-of-fact doesn’t help to de-anonymize the user any more than saying “they’re a human being” does—it’s not information that could be mapped back to the individual user. So it’s fine to send out. It can be taken a level further, as well; such “statistics that convert to a profile” can be aggregated into one per-app profile. At that point, you’re doing exactly what magazine publishers do: looking at the audience for a given magazine, building a summary profile of said audience, and then selling ad space to advertisers who want to target that summary profile. Of course, that same library will probably do a region check, and in the case that you’re not in the GDPR-affected area of the world, it will skip its (slightly crap) client-side detection logic and instead feed all your clicks and taps back to its (much smarter) backend, just like the previous version of the library was doing unilaterally.

HenryBemis 8y ago

NoRoot Firewall: I got a global Block rule for 31.13.. The exact same thing applies for all iOS devices. Web banking, airlines, almost every game. There very few exceptions of the most common apps, e.g. Dropbox, Skype, stock apps. Facebook is cancer. It gets into the body and never leaves. Unless you firewall or hosts block their IPs.

elorant 8y ago
Just a friendly reminder, because I see this line of reasoning too often in here. We're not the average Joe. Just because we can circumvent those techniques doesn't mean that everyone can, or for that matter they even bother to. Most people can't even understand the repercussions of profiling.
- HenryBemis 8y ago
  I very well understan that, and unfortunately: 1) not many people see the evil of Facebook's immoral actions 2) not many people (even in here) are aware that they can firewall their Android devices.
nepthar 8y ago
I hadn't heard of NoRoot firewall, thanks for mentioning! Is the 31.13.. the range of addresses owned by FB?

OrgNet 8y ago

Does Facebook share data back with the app? For example, your name, etc...

deleted 8y ago
[deleted]

karmakaze 8y ago

Has anyone found the list of tested apps and their results? I've followed many of the links but find more articles/versions

ignoramous 8y ago
Are you looking for something equivalent to http://exodus-privacy.eu.org/ http://exodus-privacy.eu.org/ ?
pretty_dumm_guy 8y ago
Maybe this is what you are looking for ? I looked into certain apps (Shazam, Duolingo etc.,) and its quite interesting. https://privacyinternational.org/appdata https://privacyinternational.org/appdata
- deleted 8y ago
  [deleted]
- karmakaze 8y ago
  Yes thanks. I looked at this page but perhaps it didn't render fully on the platform I first saw it on.

kleiba 8y ago

"You have zero privacy anyway. Get over it." Scott McNealy, former chairman of Sun Microsystems.

alamortsubite 8y ago
(1999)
elmo2you 8y ago
The typical "accept reality and get over it" mentality has repeatedly and consistently been used throughout history to justify plunder. One might even wonder if it ever has been used for anything else. There was a time when legal businessmen, with sincerity, claimed that a dark skin color made you deserve to be slave. "When plunder becomes a way of life for a group of men in society, over the course of time they create for themselves a legal system that authorizes it and a moral code that glorifies it." ~ Frederic Bastiat
kerng 8y ago
Normalization of Deviance - we as the community of technical folks who have the engineering knowledge to tackle and highlight and help solve these issues should not follow that normalization. It's very dangerous. We need to continue highlighting unacceptable practices to drive privacy improvements in legislation. And we should establish ethics boards and education (ethical software engineering) amongst ourselves to stop building shady things.
matz1 8y ago
Yes, I would prefer to see solution that adapting to zero privacy life. Instead of trying to stop the flow of information.
skummetmaelk 8y ago
Ah yes. We should just accept body builders mugging us whenever we step outside because the reality is they are stronger than us.
- dingaling 8y ago

allwynpfr 8y ago

The important point here to note is that it shares this data even if you don't use / don't have a facebook account

throw2016 8y ago

Isn't this the nightmare scenario the GPL was created to fight against, a device that is not acting in the users interest but against it, with tons of private APIs [1], complete lack of transparency, deceptive language and hoovering up user data to send to others. And the kicker is this is happening on the supposedly 'open' Android platform. Take that Stallman. Its really disappointing to see how the software ecosystem has degenerated into these shady mercenaries with zero compass. The only thing that can temper this crazy greed fueled appetite for surveillance is regulations and prosecutions because what some of these articles describe is venal and corrupt to restore some sense of propriety and civilization values. [1] https://techcrunch.com/2019/03/25/android-users-security-and-privacy-at-risk-from-shadowy-ecosystem-of-pre-installed-software-study-warns/ https://techcrunch.com/2019/03/25/android-users-security-and...

random878 8y ago
Android and the apps (in this sense) are not 'open source' and, regardless, 'open source' is not the same thing as 'Free'. Richard Stallman is known for his hatred of the term 'open source' (as it generally causes a misunderstanding such as yours).

ignoramous 8y ago

I have come across fair share of blog posts on how horrendous this is getting in the current age of big data and app economy. This behaviour is warranted by how VCs, PEs, and potential acquirers value a company... by number of users an app tracks. Boils down to battle for eye-balls all the way down because ads are guaranteed revenue stream that scales in-propotion to number-of-users * user-engagement, I guess. I think everyone agrees there's a market for a simple-to-use solution. Folks at https://GuardianApp.com https://GuardianApp.com are doing just that for iOS. For Android, apps like NoRootFirewall, NetGuard, Glasswire exist and other solutions like XPrivacyLua require root, or flashing LineageOS/ChromeheadOS and/or de-googling the phone voids the warranty. Most of the 2 Billion Android user-base wouldn't go anywhere near these. A stop-gap then might be to provide a zero-touch / firction-free Firewall/VPN app that's "free" and one that's anti-surveillance and anti-censorship, but is also transparent, in that it enables end-user to inspect the traffic flowing in and out of their devices. The challenge is no one wants to pay the internet provider and a random VPN app for a censorship-free / surveillance-free internet but they might gladly pay the internet provider extra premium if they offered the same experience. I know my dad wants this, but he wouldn't pay two entities for the same service. May be what https://puri.sm https://puri.sm is doing is the eventual end-game, but I think they're trying too hard. May be its time for an Android phone-manufacturer to launch a privacy focused phone. OnePlus reached its heights by placing itself as a Nexus/Pixel killer offering vanilla Android experience... so may be there's a market for privacy focused phone too, or may be https://e.foundation https://e.foundation might pull this miracle off and become mainstream enough to matter. Eventually, though, governments have to step in and bring forth regulations that prevents relentless surveillance of the end-user, similar to how wire-tapping phone-calls is illegal.

paulcarroty 8y ago
> May be its time for an Android phone-manufacturer to launch a privacy focused phone. LOL, they don't need it. Privacy focused phone doesn't generate money from user data. There's two ways: dumbphone or Apple.
- tokyodude 8y ago
  see post above yours. Apple is not protecting your privacy. in fact they are explicitly disallowing your privacy to be protected.

deleted 8y ago

[deleted]

ape4 8y ago

I like the idea of your device giving out fake advertising id's out.

ignoramous 8y ago
There's more than ad-ids to fingerprinting a user [0]. For instance, MAC addresses (wifi, Bluetooth), IMEI, GPU based fingerprinting techniques, scanning for apps installed, WiFi networks connected to, location, and so on. You need to fake a lot of things to be scot-free from this madness. It's ashtonishing, really [1]. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/ [1] https://copperhead.co/android/docs/usage_guide https://copperhead.co/android/docs/usage_guide

product50 8y ago

This is so misleading. Almost all SDKs do this and this also happens on iOS too. If you have an SDK on iOS, there is nothing the OS can do to stop tracking of the users. Also, the author literally says that Google tracks even more apps vs. FB but still chooses to use FB in their headline. Sigh.