3 ms·

How can an app track activities in other apps? Is it only possible if those other apps use the same tracking networks, or can the app track activities in _any_

How can an app track activities in other apps? Is it only possible if those other apps use the same tracking networks, or can the app track activities in _any_ other app? How does this work? What can facebook extract today? (I'm surprised a bit, i thought phones offer app isolation). The only things that comes to mind is to correlate device ids from different apps if the apps use the same analytics/advertising networks. Pls enlighten me...

kstrauser 6y ago
> The only things that comes to mind is to correlate device ids from different apps if the apps use the same analytics/advertising networks. This, and also anything that uses "Sign in with Facebook". (That's one of several reasons I have for never using anything that requires signing in with Facebook or Google; if I can't create a username or enter an email address, I generally don't want to use it.)
LMYahooTFY 6y ago
I'd also like insight into this. Are apps still not isolated enough for this? Is this more due to FB dragnet network analytics that they can put enough data together that it doesn't matter if you isolate the app?
- deleted 6y ago
  [deleted]
- zepto 6y ago
  > Is this more due to FB dragnet network analytics that they can put enough data together that it doesn't matter if you isolate the app? Exactly this.
pfortuny 6y ago
“which includes which apps are being used and for how long, which websites are visited, and data about a user's location“ This is probaly in the “/tmp” or similar directory and probably useful for the system as a whole to be readable (or probably /dev or /proc). It is not a big deal unless you are facebook and, for instance, want to know if your user watches foxnews or has the cnn app or whatever. AFAIK just doing “ps” gives you a LOT of info on any unix env.
- quenix 6y ago
  I may be wrong, but I don't think the iOS sandbox allows apps to poke around that much.
move-on-by 6y ago
My understanding is that, by default, Apple devices have an IDFA (Identifier for Advertisers) that apps can use to correlate usage to a specific device. That identifier is going to be the same regardless of app, so it can easily be shared between data aggregators. You've been able to turn this off for ages deep in your apple settings - but of course most people don't bother with that (70% is the number I found). This update brings that feature front-and-center by making it a popup. I suppose that it also makes it app-specific instead of the previous system wide setting? Not sure on that one. At least that is my understanding, if someone knows better please inform me.
ogre_codes 6y ago
Facebook, Google, and other aggregators entice developers into using their APIs (or even their ad platforms). The developers get use of a nice analytics package, authentication, or other features, and in exchange Facebook and Google use those APIs to exfiltrate data from your device. They can tie all of this data neatly together using an identifier which Apple has to date provided as an opt-out service. Apple is now changing this to opt-in, so all these developers who have included APIs which are sneaking data out to the Google and Facebook will need to include a pop-up to get permissions to tie their data to the rest of Google and Facebook’s acquired knowledge about you.
newscracker 6y ago
> The only things that comes to mind is to correlate device ids from different apps if the apps use the same analytics/advertising networks. A long time ago, device IDs were available to apps. But that changed because those are typically immutable and the user has no control on revealing a different one to apps. So the makers of the operating systems brought a new identifier (IDFA in Apple’s OSes) that can be controlled through settings. Even before the forthcoming iOS update, you could just turn off cross app tracking completely by turning on Settings->Privacy->Advertising->Limit Ad Tracking in previous versions. But this was off by default, meaning tracking was allowed unless disabled by the user. Now it’s an explicit prompt when an app asks for the IDFA. The IDFA can be used to uniquely identify and connect a user across apps.
rmrfrmrf 6y ago
Facebook offers libraries for iOS (and Android) developers to add features Facebook login, but which include other features like native app analytics and drop-in widgets that serve Facebook ads. If it's not obvious, these Facebook libraries are trojan malware, full stop. And, even though iOS apps are sandboxed, if 50% of a user's apps have the same Facebook library baked into them, it's not hard for Facebook to link all that data together to determine usage patterns across apps. The reason why they're fighting with Apple now is that it used to be much easier for Facebook to obtain a device-unique identifier that each app could forward along to Facebook, giving them device-level usage data. Apple now sees the privacy flaws in device-unique ids, and has either started or plans to start rotating those device ids and making them unique at the app-level only, which reduces the resolution of its tracking from the device level to the network level.

kstrauser 6y ago

> The only things that comes to mind is to correlate device ids from different apps if the apps use the same analytics/advertising networks. This, and also anything that uses "Sign in with Facebook". (That's one of several reasons I have for never using anything that requires signing in with Facebook or Google; if I can't create a username or enter an email address, I generally don't want to use it.)

LMYahooTFY 6y ago

I'd also like insight into this. Are apps still not isolated enough for this? Is this more due to FB dragnet network analytics that they can put enough data together that it doesn't matter if you isolate the app?

deleted 6y ago
[deleted]
zepto 6y ago
> Is this more due to FB dragnet network analytics that they can put enough data together that it doesn't matter if you isolate the app? Exactly this.

pfortuny 6y ago

“which includes which apps are being used and for how long, which websites are visited, and data about a user's location“ This is probaly in the “/tmp” or similar directory and probably useful for the system as a whole to be readable (or probably /dev or /proc). It is not a big deal unless you are facebook and, for instance, want to know if your user watches foxnews or has the cnn app or whatever. AFAIK just doing “ps” gives you a LOT of info on any unix env.

quenix 6y ago
I may be wrong, but I don't think the iOS sandbox allows apps to poke around that much.

move-on-by 6y ago

My understanding is that, by default, Apple devices have an IDFA (Identifier for Advertisers) that apps can use to correlate usage to a specific device. That identifier is going to be the same regardless of app, so it can easily be shared between data aggregators. You've been able to turn this off for ages deep in your apple settings - but of course most people don't bother with that (70% is the number I found). This update brings that feature front-and-center by making it a popup. I suppose that it also makes it app-specific instead of the previous system wide setting? Not sure on that one. At least that is my understanding, if someone knows better please inform me.

ogre_codes 6y ago

Facebook, Google, and other aggregators entice developers into using their APIs (or even their ad platforms). The developers get use of a nice analytics package, authentication, or other features, and in exchange Facebook and Google use those APIs to exfiltrate data from your device. They can tie all of this data neatly together using an identifier which Apple has to date provided as an opt-out service. Apple is now changing this to opt-in, so all these developers who have included APIs which are sneaking data out to the Google and Facebook will need to include a pop-up to get permissions to tie their data to the rest of Google and Facebook’s acquired knowledge about you.

newscracker 6y ago

> The only things that comes to mind is to correlate device ids from different apps if the apps use the same analytics/advertising networks. A long time ago, device IDs were available to apps. But that changed because those are typically immutable and the user has no control on revealing a different one to apps. So the makers of the operating systems brought a new identifier (IDFA in Apple’s OSes) that can be controlled through settings. Even before the forthcoming iOS update, you could just turn off cross app tracking completely by turning on Settings->Privacy->Advertising->Limit Ad Tracking in previous versions. But this was off by default, meaning tracking was allowed unless disabled by the user. Now it’s an explicit prompt when an app asks for the IDFA. The IDFA can be used to uniquely identify and connect a user across apps.

rmrfrmrf 6y ago

Facebook offers libraries for iOS (and Android) developers to add features Facebook login, but which include other features like native app analytics and drop-in widgets that serve Facebook ads. If it's not obvious, these Facebook libraries are trojan malware, full stop. And, even though iOS apps are sandboxed, if 50% of a user's apps have the same Facebook library baked into them, it's not hard for Facebook to link all that data together to determine usage patterns across apps. The reason why they're fighting with Apple now is that it used to be much easier for Facebook to obtain a device-unique identifier that each app could forward along to Facebook, giving them device-level usage data. Apple now sees the privacy flaws in device-unique ids, and has either started or plans to start rotating those device ids and making them unique at the app-level only, which reduces the resolution of its tracking from the device level to the network level.