6 ms·

How Facebook Tracks You on Android (2018) [video]

141 points by k0t0n0 7y ago

solounavez 7y ago
At the 7:00 minute mark, they show that the company has false or misleading advertising, can that company be sued for this?
blindseer 7y ago
This is tangential, but I really dislike how this YouTube channel always downloads the original video, strips it of all information regarding the speaker and the conference and uploads it to their channel. Even though the original is published under Creative Commons Attribution, it still bothers me that they 1) download and reupload (wouldn't this be better accomplished by a playlist?) 2) strip information that makes it appear they produce the content. I'm curious what other people think about this. Anyway, here is the source [1] from their video description. [1] https://www.youtube.com/watch?v=y0vlD7r-kTc https://www.youtube.com/watch?v=y0vlD7r-kTc
- perlpimp 7y ago
  stripping is not good but corralling and filtering videos maybe not so bad. maybe in the future content id can let people know of people from which a given video originates? that would be a useful exploration feature.
  - indalo 7y ago
    I'd like curated content to have a larger presence as well. I wonder If enhancing playlists could accomplish this. You can add metadata and arrange while the video remains on its channel. On the other hand I doubt a lot of reuploading is done in earnest.
- dang 7y ago
  OK, we've changed to that from https://www.youtube.com/watch?v=OTt1AVRQyx0 https://www.youtube.com/watch?v=OTt1AVRQyx0.
  - saagarjha 7y ago
    Can we link to the CCC page instead? It has the video along with additional resources: https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...
    - dang 7y ago
      Sure. Changed from https://www.youtube.com/watch?v=y0vlD7r-kTc https://www.youtube.com/watch?v=y0vlD7r-kTc.
- input_sh 7y ago
  Not to mention that they're breaking the license by not indicating that they've made changes to the original work. As far as 2) is concerned, that's allowed by Creative Commons Attribution, but it must be indicated that the changes were made. Just the fact that they've cropped the video makes their video a modification. From[0]: > How do I properly attribute material offered under a Creative Commons license? > You must also indicate if you have modified the work—for example, if you have taken an excerpt, or cropped a photo. [0] https://creativecommons.org/faq/#how-do-i-properly-attribute-material-offered-under-a-creative-commons-license https://creativecommons.org/faq/#how-do-i-properly-attribute...
kekebo 7y ago
Original full length video from 35C3: https://www.youtube.com/watch?v=y0vlD7r-kTc https://www.youtube.com/watch?v=y0vlD7r-kTc [How Facebook Tracks You On Android]
saagarjha 7y ago
Previous discussion: https://news.ycombinator.com/item?id=18788658 https://news.ycombinator.com/item?id=18788658
- dang 7y ago
  Missed that one. Thanks!
mcintyre1994 7y ago
It's pretty amazing that Facebook got such a foothold here that all these high profile apps use their SDK. Are they just using it for log-in? Are their mobile ads better than Google's for developers? I assume that Google provide all the same tools for their own ads, analytics etc. and presumably similar tracking by Google is already baked in and unavoidable.
- dep_b 7y ago
  Login is a big thing but if I can get away with it, I'll simply use a web view Facebook authentication instead. Adding all that framework weight for something the average user only uses once and will be a jarring experience from the rest of the app no matter what you do is not worth it to me.
- harryf 7y ago
  > Are their mobile ads better than Google's for developers? The situation may have changed but last time I worked (as a PM) with people doing mobile marketing back in 2015, Facebook App install campaigns were _massively_ better than anyone else. You could get installs for under $3 per user and the performance was fantastic eg 1000 times more installs in the same time as the next best network. Facebook may have upped their prices since and Googles App install products have got a lot better, especially on YouTube
ttctciyf 7y ago
As mentioned in the video, but not afaics in the description, the page from the presenters at https://privacyinternational.org/appdata https://privacyinternational.org/appdata has the testing environment if you want to extend or replicate these results, as well as the report itself and its documentation, along with a March 2019 update.[1] 1: https://privacyinternational.org/blog/2758/guess-what-facebook-still-tracks-you-android-apps-even-if-you-dont-have-facebook-account https://privacyinternational.org/blog/2758/guess-what-facebo...
blackbear_ 7y ago
Completely anecdotal: I have no facebook apps or social media on my android except for whatsapp, and I never use anything else from them. I see between 400 and 500 calls to graph.facebook.com _every day_
- gvurrdon 7y ago
  I see a few on iOS from time to time, but they are blocked by Adblock Pro with a hosts file listing Facebook servers.
- NikolaeVarius 7y ago
  Websites and apps use Facebook apis. Nothing conspiritorial about that
  - tobr 7y ago
    On the contrary, it fits the definition of conspiracy pretty well.
    - NikolaeVarius 7y ago
      Explain.
      - kevin_thibedeau 7y ago
        Facebook has bought their way into tracking people who are not users of their service with no notification and no opportunity to opt in or out.
      - tobr 7y ago
        I’ll give you a definition of “conspiracy”: a group of actors that coordinate in secret to achieve something harmful or unethical. I’m not sure what to explain.
        NikolaeVarius 7y ago
BenGosub 7y ago
How hypocritical it is to both boast that you are privacy focused, while blatantly invading users privacy at the same time!? I think their days are numbered, but hopefully we get rid of them sooner than later.
eden_h 7y ago
It would be helpful to be more upfront in the video about why Facebook is tracking this, because it looks like it's Facebook Analytics for Apps - (https://analytics.facebook.com/get-started/Apps#fq https://analytics.facebook.com/get-started/Apps#fq), which puts this on par with Google Analytics for Apps - (https://developers.google.com/analytics/solutions/mobile https://developers.google.com/analytics/solutions/mobile) in terms of problematic behaviour. So it is unclear if this is data that is provided to Facebook servers but not accessible to Facebook, similar to options for Google's Analytics platforms, or if it is harvested by Facebook by permission of the app creator. Both options being shady, as it's not told to the user, but this video feels more like it's saying Facebook is actively tracking people, not App Designers are giving Facebook permission to track you in exchange for marketing analytics. The data that is being provided is significantly too high, and the user should be made aware, but this video seems to only discuss it being API calls to the Analytics interface when using the app. I'd definitely expect there to be API calls when using an app, but how User ID tracking is done is probably the most potentially dangerous part here.
- mfer 7y ago
  Does Facebook Analytics for Apps segment the data from that of Facebook or combine it? Is there any policy even stated that says it's not used for other things. I would suspect, but have not looked, that all the data is combined together and used for selling ads and in other ways. If that is the case, an app that is using it to get analytics for themselves is also sending lots of data to Facebook to be used for their other purposes. Is this information transparent to anyone? This can lead to the tracking failing GDPR or other laws. Now, if it was only analytics for apps for the benefit of the app owner and not shared... things might be different legally speaking. Of course IANAL and they may have much more to say.

141 points by k0t0n0 7y ago

At the 7:00 minute mark, they show that the company has false or misleading advertising, can that company be sued for this?

blindseer 7y ago

This is tangential, but I really dislike how this YouTube channel always downloads the original video, strips it of all information regarding the speaker and the conference and uploads it to their channel. Even though the original is published under Creative Commons Attribution, it still bothers me that they 1) download and reupload (wouldn't this be better accomplished by a playlist?) 2) strip information that makes it appear they produce the content. I'm curious what other people think about this. Anyway, here is the source [1] from their video description. [1] https://www.youtube.com/watch?v=y0vlD7r-kTc https://www.youtube.com/watch?v=y0vlD7r-kTc

perlpimp 7y ago
stripping is not good but corralling and filtering videos maybe not so bad. maybe in the future content id can let people know of people from which a given video originates? that would be a useful exploration feature.
- indalo 7y ago
  I'd like curated content to have a larger presence as well. I wonder If enhancing playlists could accomplish this. You can add metadata and arrange while the video remains on its channel. On the other hand I doubt a lot of reuploading is done in earnest.
dang 7y ago
OK, we've changed to that from https://www.youtube.com/watch?v=OTt1AVRQyx0 https://www.youtube.com/watch?v=OTt1AVRQyx0.
- saagarjha 7y ago
  Can we link to the CCC page instead? It has the video along with additional resources: https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...
  - dang 7y ago
    Sure. Changed from https://www.youtube.com/watch?v=y0vlD7r-kTc https://www.youtube.com/watch?v=y0vlD7r-kTc.
input_sh 7y ago
Not to mention that they're breaking the license by not indicating that they've made changes to the original work. As far as 2) is concerned, that's allowed by Creative Commons Attribution, but it must be indicated that the changes were made. Just the fact that they've cropped the video makes their video a modification. From[0]: > How do I properly attribute material offered under a Creative Commons license? > You must also indicate if you have modified the work—for example, if you have taken an excerpt, or cropped a photo. [0] https://creativecommons.org/faq/#how-do-i-properly-attribute-material-offered-under-a-creative-commons-license https://creativecommons.org/faq/#how-do-i-properly-attribute...

kekebo 7y ago

Original full length video from 35C3: https://www.youtube.com/watch?v=y0vlD7r-kTc https://www.youtube.com/watch?v=y0vlD7r-kTc [How Facebook Tracks You On Android]

saagarjha 7y ago

Previous discussion: https://news.ycombinator.com/item?id=18788658 https://news.ycombinator.com/item?id=18788658

dang 7y ago
Missed that one. Thanks!

mcintyre1994 7y ago

It's pretty amazing that Facebook got such a foothold here that all these high profile apps use their SDK. Are they just using it for log-in? Are their mobile ads better than Google's for developers? I assume that Google provide all the same tools for their own ads, analytics etc. and presumably similar tracking by Google is already baked in and unavoidable.

dep_b 7y ago
Login is a big thing but if I can get away with it, I'll simply use a web view Facebook authentication instead. Adding all that framework weight for something the average user only uses once and will be a jarring experience from the rest of the app no matter what you do is not worth it to me.
harryf 7y ago
> Are their mobile ads better than Google's for developers? The situation may have changed but last time I worked (as a PM) with people doing mobile marketing back in 2015, Facebook App install campaigns were _massively_ better than anyone else. You could get installs for under $3 per user and the performance was fantastic eg 1000 times more installs in the same time as the next best network. Facebook may have upped their prices since and Googles App install products have got a lot better, especially on YouTube

ttctciyf 7y ago

As mentioned in the video, but not afaics in the description, the page from the presenters at https://privacyinternational.org/appdata https://privacyinternational.org/appdata has the testing environment if you want to extend or replicate these results, as well as the report itself and its documentation, along with a March 2019 update.[1] 1: https://privacyinternational.org/blog/2758/guess-what-facebook-still-tracks-you-android-apps-even-if-you-dont-have-facebook-account https://privacyinternational.org/blog/2758/guess-what-facebo...

blackbear_ 7y ago

Completely anecdotal: I have no facebook apps or social media on my android except for whatsapp, and I never use anything else from them. I see between 400 and 500 calls to graph.facebook.com _every day_

gvurrdon 7y ago
I see a few on iOS from time to time, but they are blocked by Adblock Pro with a hosts file listing Facebook servers.
NikolaeVarius 7y ago
Websites and apps use Facebook apis. Nothing conspiritorial about that
- tobr 7y ago
  On the contrary, it fits the definition of conspiracy pretty well.
  - NikolaeVarius 7y ago
    Explain.
    - kevin_thibedeau 7y ago
      Facebook has bought their way into tracking people who are not users of their service with no notification and no opportunity to opt in or out.
    - tobr 7y ago
      I’ll give you a definition of “conspiracy”: a group of actors that coordinate in secret to achieve something harmful or unethical. I’m not sure what to explain.
      - NikolaeVarius 7y ago

BenGosub 7y ago

How hypocritical it is to both boast that you are privacy focused, while blatantly invading users privacy at the same time!? I think their days are numbered, but hopefully we get rid of them sooner than later.

eden_h 7y ago

It would be helpful to be more upfront in the video about why Facebook is tracking this, because it looks like it's Facebook Analytics for Apps - (https://analytics.facebook.com/get-started/Apps#fq https://analytics.facebook.com/get-started/Apps#fq), which puts this on par with Google Analytics for Apps - (https://developers.google.com/analytics/solutions/mobile https://developers.google.com/analytics/solutions/mobile) in terms of problematic behaviour. So it is unclear if this is data that is provided to Facebook servers but not accessible to Facebook, similar to options for Google's Analytics platforms, or if it is harvested by Facebook by permission of the app creator. Both options being shady, as it's not told to the user, but this video feels more like it's saying Facebook is actively tracking people, not App Designers are giving Facebook permission to track you in exchange for marketing analytics. The data that is being provided is significantly too high, and the user should be made aware, but this video seems to only discuss it being API calls to the Analytics interface when using the app. I'd definitely expect there to be API calls when using an app, but how User ID tracking is done is probably the most potentially dangerous part here.

mfer 7y ago
Does Facebook Analytics for Apps segment the data from that of Facebook or combine it? Is there any policy even stated that says it's not used for other things. I would suspect, but have not looked, that all the data is combined together and used for selling ads and in other ways. If that is the case, an app that is using it to get analytics for themselves is also sending lots of data to Facebook to be used for their other purposes. Is this information transparent to anyone? This can lead to the tracking failing GDPR or other laws. Now, if it was only analytics for apps for the benefit of the app owner and not shared... things might be different legally speaking. Of course IANAL and they may have much more to say.