4 ms·

Wouldn't a network analysis be able to detect a difference in the amount of traffic coming out of the phone? Measure with and without Instagram installed, activ

Wouldn't a network analysis be able to detect a difference in the amount of traffic coming out of the phone? Measure with and without Instagram installed, active, background, and given or denied camera access. If it's capturing images in the background that data has to go somewhere. Even if it batches for sending later. Another way to find out is to feed it "interesting" images with faces and objects, then compare if the camera is pointed at a blank wall for the same amount of time. If the phone is significantly noisier then you can conclude it's actually processing the images and not just dumping them to the bitbucket.

dewey 6y ago
> Even if it batches for sending later. Would probably be very hard to spot that if you piggyback on normal story/image upload traffic payloads. Seems like a lot of work for something that's not really that helpful or easier to accomplish.
- varenc 6y ago
  > Seems like a lot of work for something that's not really that helpful or easier to accomplish. That could be said for Facebook surreptitiously uploading images by piggybacking them onto innocuous requests. I’ve disabled the FB app’s cert pinning so I can MITM it and they really don’t seem to care about minimizing the number of requests. Tons of little logging events will be fired off separately instead of being condensed. Also, there are several unofficial Instagram apps that were developed by thoroughly reverse engineering the app’s private API. Seems unlikely that this could have evaded detection. And just data volume-wise, it’s much harder to conceal uploading weighty images/video. Facebook and Instagram mostly just download data. A long term discrepancy in upload usage between when the app has camera permissions and when it doesn’t would be easy to spot. I have no doubt Facebook is still doing creepy things we don't know about yet, but this particular theory just seems incredibly unlikely to me.

dewey 6y ago

> Even if it batches for sending later. Would probably be very hard to spot that if you piggyback on normal story/image upload traffic payloads. Seems like a lot of work for something that's not really that helpful or easier to accomplish.

varenc 6y ago
> Seems like a lot of work for something that's not really that helpful or easier to accomplish. That could be said for Facebook surreptitiously uploading images by piggybacking them onto innocuous requests. I’ve disabled the FB app’s cert pinning so I can MITM it and they really don’t seem to care about minimizing the number of requests. Tons of little logging events will be fired off separately instead of being condensed. Also, there are several unofficial Instagram apps that were developed by thoroughly reverse engineering the app’s private API. Seems unlikely that this could have evaded detection. And just data volume-wise, it’s much harder to conceal uploading weighty images/video. Facebook and Instagram mostly just download data. A long term discrepancy in upload usage between when the app has camera permissions and when it doesn’t would be easy to spot. I have no doubt Facebook is still doing creepy things we don't know about yet, but this particular theory just seems incredibly unlikely to me.