3 ms·

My thoughts now: one of the reasons I use NewPipe is because it have no need for Google accounts (i.e. correlation to emails, no tracking of data gathering). I

My thoughts now: one of the reasons I use NewPipe is because it have no need for Google accounts (i.e. correlation to emails, no tracking of data gathering). If evilG banned an account, it means the event that triggered it was a correlation between YT usage and IP addresses. Interesting.

shadowgovt 7y ago
Has anyone Wiresharked the data that is sent when NewPipe makes a video request? I wonder if it's leaking things Google could use for correlating signal (IP address is an obvious one, but I wonder if the phone is sending IMEI in a header, or if YouTube is setting a cookie / using a storage API that NewPipe honors, but then that cookie / API tag is also readable from the browser when the user uses their regular account).
- gaius_baltar 7y ago
  NewPipe is free software so I don't thing it will be able to send some covert information (even if the author is attacked /compromised). Android is designed to not allow an app to read information from another one, so it should prevent the second scenario -- except that Google has root-level access to our phones so it can spy everything anyway.
  - shadowgovt 7y ago
    NewPipe's free-software-ness is less relevant if it's relying upon OS-supplied APIs to send network requests and nobody has Wiresharked the output of those APIs. For example, if it's fetching data from YouTube via a WebView, the HTTP requests made to the server will carry all kinds of cookie state and enable all kinds of APIs that can be used to tag a client in a cross-session fashion (though I don't personally know what WebView's state-sharing model is). Remember, the security model for web sites isn't "app"-based; it's domain-based. Hypothetically, if YouTube were setting a cookie via NewPipe's interactions onto the youtube.com domain that says "Hey this user-agent used NewPipe," then if some other piece of Android (such as the browser) were sharing the same cookie jar, it would vend that cookie back and Google could correlate it to a logged-in user. The question is whether the cookie jar gets reused.
    - gaius_baltar 7y ago
      Well, that makes perfect sense! If Google is providing an API to easily download things through (e.g.) HTTPS, it may also intercept and poison these requests when they are directed to one of their services and get some extra information from it!
- netsharc 7y ago
  One feature NewPipe has is to import your list of subscribed channels, after you've exported the list from YouTube. So if a NewPipe install queried YouTube to "give me updates for the following channels", YT could "fingerprint" which account the channel list came from. And match the IP of these NewPipe requests to the IP of the account (since the GMail app would also be talking to Google from the phone), and Google can be certain it's the "abuser". That's one possible vector...
KingMachiavelli 7y ago
Doubtful, the youtube-dl python library is used by thousands of people and sites to download youtube videos and while API changes break it often, I've never heard of anyone getting their IP banned or an associated account banned from using it. Even though I have Youtube Red (through my google music subscription), I watch most of my Youtube videos through mpv which uses youtube-dl to download the videos. There are no ads and it requires no account to use yet I've seen no reports on their bug tracker of getting banned.
deleted 7y ago
[deleted]

shadowgovt 7y ago

Has anyone Wiresharked the data that is sent when NewPipe makes a video request? I wonder if it's leaking things Google could use for correlating signal (IP address is an obvious one, but I wonder if the phone is sending IMEI in a header, or if YouTube is setting a cookie / using a storage API that NewPipe honors, but then that cookie / API tag is also readable from the browser when the user uses their regular account).

gaius_baltar 7y ago
NewPipe is free software so I don't thing it will be able to send some covert information (even if the author is attacked /compromised). Android is designed to not allow an app to read information from another one, so it should prevent the second scenario -- except that Google has root-level access to our phones so it can spy everything anyway.
- shadowgovt 7y ago
  NewPipe's free-software-ness is less relevant if it's relying upon OS-supplied APIs to send network requests and nobody has Wiresharked the output of those APIs. For example, if it's fetching data from YouTube via a WebView, the HTTP requests made to the server will carry all kinds of cookie state and enable all kinds of APIs that can be used to tag a client in a cross-session fashion (though I don't personally know what WebView's state-sharing model is). Remember, the security model for web sites isn't "app"-based; it's domain-based. Hypothetically, if YouTube were setting a cookie via NewPipe's interactions onto the youtube.com domain that says "Hey this user-agent used NewPipe," then if some other piece of Android (such as the browser) were sharing the same cookie jar, it would vend that cookie back and Google could correlate it to a logged-in user. The question is whether the cookie jar gets reused.
  - gaius_baltar 7y ago
    Well, that makes perfect sense! If Google is providing an API to easily download things through (e.g.) HTTPS, it may also intercept and poison these requests when they are directed to one of their services and get some extra information from it!
netsharc 7y ago
One feature NewPipe has is to import your list of subscribed channels, after you've exported the list from YouTube. So if a NewPipe install queried YouTube to "give me updates for the following channels", YT could "fingerprint" which account the channel list came from. And match the IP of these NewPipe requests to the IP of the account (since the GMail app would also be talking to Google from the phone), and Google can be certain it's the "abuser". That's one possible vector...

KingMachiavelli 7y ago

Doubtful, the youtube-dl python library is used by thousands of people and sites to download youtube videos and while API changes break it often, I've never heard of anyone getting their IP banned or an associated account banned from using it. Even though I have Youtube Red (through my google music subscription), I watch most of my Youtube videos through mpv which uses youtube-dl to download the videos. There are no ads and it requires no account to use yet I've seen no reports on their bug tracker of getting banned.

deleted 7y ago

[deleted]