8 ms·

In the report, not the summary, Firebase is listed as the most used 3rd party, with Firebase Messaging and Firebase Analytics being designated as "High Risk." W

In the report, not the summary, Firebase is listed as the most used 3rd party, with Firebase Messaging and Firebase Analytics being designated as "High Risk." When the report says "these apps are sending data to Google" it sounds like they are sending ad tracking data to commercialize off of this data, but tools like Firebase are common web hosting platforms, not data tracking tools. This is like saying data is being sent to Amazon Web Services. Here is the report: https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/ https://me2ba.org/school-mobile-apps-student-data-sharing-be... As an edtech founder, I 100% agree that there should be more time spent holding school apps accountable for the data that they sent out, but this report doesn't accurately capture the risks present and how to hold organizations accountable.

mro_name 5y ago
IMO there's no such thing as a trustworthy 3rd party. To say the least they are very rare and not the big ones. They just can't care about all the small customers. If they mess one up it's no big deal for them. But if you are small and happen to be messed up it is a big deal for you. Asymmetry is a huge problem. And yes, what would XY-Analytics be other than stalking, put bluntly?
- stingraycharles 5y ago
  The point is that Firebase may not even be a third party, but rather the hosting platform of the application. Like the parent says, it’s like saying that AWS is a third party and a high risk threat.
  - ectopod 5y ago
    Firebase is a hosting platform and a third party.
  - mattacular 5y ago
    AWS is a third party and if you use their services, they are handling your data. I suppose it's up to you to consider how much of a risk that is to your business.
judge2020 5y ago
FYI to find the table, ctrl-f 'top 10 most frequently ' (or, if you use Chrome/your browser supports text fragments, https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/#:~:text=the%20top%2010%20most%20frequently%20included%20sdks%20are%20shown%20below%20in%20table%201 https://me2ba.org/school-mobile-apps-student-data-sharing-be... ) I also don't see how OkHttp[0] or Okio[1] are 'medium' risk. Are they secretly sending data to Square? The code is auditable on GitHub. 0: https://square.github.io/okhttp/ https://square.github.io/okhttp/ 1: https://square.github.io/okio/ https://square.github.io/okio/
- demersb 5y ago
  Likely just user-agent scanning, those libs would be used by other service.
colordrops 5y ago
What ar the agreements with amazon and google/firebase regarding the privacy of your data? If they ensure privacy, can they be trusted? For the data of children, shouldn't they be held to a higher standard? E.g. for protected government data, you have to run in amazon's govcloud.
- judge2020 5y ago
  AWS terms do not grant them a license or ownership over your data, although "If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data" - so if you just store random files on s3 or EBS it's not like AWS can do anything they want with it. https://aws.amazon.com/service-terms/ https://aws.amazon.com/service-terms/ The GDPR DPA does a good job of encompassing the entire extent of their data use: > AWS will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order)... https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
- asciimike 5y ago
  Firebase's terms are here: https://firebase.google.com/terms https://firebase.google.com/terms (and GCP's data processing terms are here: https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms) Having worked on those products (and in some cases, written the terms), I'd say so.
  - Nextgrid 5y ago
    Facebook used to promise that phone numbers collected for 2FA purposes wouldn't be used for advertising purposes, and then broke that promise. That is just one example which was made public and was done intentionally. There's potentially plenty more cases where it's either done but concealed (because of how many factors go into ad targeting it's often impossible to categorically prove/disprove which data was used to target an ad) or done by accident from earlier code that just assumed all data is fine to use for ads (or that the new product which shouldn't share its data for advertising purposes was accidentally storing data in the same place as other products who do share data for advertising purposes). Why should we trust companies that have a business incentive to break their promises? If Google's biggest revenue stream is ads and that requires personal data then I wouldn't trust any of their promises not to use some personal data unless I can 100% audit all the code myself and prove that it's indeed that code that is running in production.
1vuio0pswjnm7 5y ago
Google, who operate Firebase, enable and encourage Firebase customers to partake in advertising, e.g., by linking their Firebase account to an ads account. https://support.google.com/google-ads/answer/6333536?hl=en https://support.google.com/google-ads/answer/6333536?hl=en https://firebase.google.com/docs/ads https://firebase.google.com/docs/ads https://firebase.google.com/products/analytics/partners https://firebase.google.com/products/analytics/partners
- asciimike 5y ago
  Unless things have changed, the bigger issue is that Firebase Analytics is included by default and can't easily be excluded. Linking Firebase to Ads requires conscious action on behalf of the developer, while the former only requires using any Firebase product. Also, Google is in the online ads business, so I don't think it's surprising that they provide docs that show how to use Firebase data to target ads. That said, it's not the default, so it's not as shady as you're making it sound.
elliekelly 5y ago
> This is like saying data is being sent to Amazon Web Services. I have a (large financial institution) client that asks this question on their vendor due diligence and on-boarding and plans to phase out vendors who say yes and aren’t willing/able to change. They’re concerned about data privacy. Not just security, privacy. From Amazon.
- vasco 5y ago
  They better be huge or super niche, otherwise this sounds like an egotrip. Not sending data to a major cloud provider is quickly becoming like producing your own electricity because you don't trust the grid will provide a stable frequency and won't go down. At some point you just need to trust the utilities and go with it. Plus you can hopefully encrypt your data if this is a major concern.
  - pjc50 5y ago
    Amazon have been caught using the sales data of their customers to compete against them. If they want utility levels of trust they should get nationalized.
    - Sander_Marechal 5y ago
      That's not AWS though
      - martin_a 5y ago
        Not yet.
      - nannal 5y ago
        But it's still amazon, the left hand doesn't get a free pass because the right hand pulled the trigger. Amazon has shown willingness to utilise privileged information in the past why wouldn't they go snooping around?
        5y ago
lmilcin 5y ago
I think the tracking landscape is such that you can't trust ANY of the companies involved in it. I personally divide tracking companies into those that were caught doing something shady with the data and those that are doing it but were not yet caught. School apps should not involve ANY tracking, regardless of your opinion about the company. Kids require special protection because they don't yet know how to function in the world and can't make informed decision about whether they want or don't want to be tracked and in fact for these kinds of apps, they are not even consulted or asked to consent. Schooling is obligatory. I can make decision whether I want to use the internet or not and whether I want to be identified, but kids don't make that decision -- they are being forced to use the software provided by schools.

mro_name 5y ago

IMO there's no such thing as a trustworthy 3rd party. To say the least they are very rare and not the big ones. They just can't care about all the small customers. If they mess one up it's no big deal for them. But if you are small and happen to be messed up it is a big deal for you. Asymmetry is a huge problem. And yes, what would XY-Analytics be other than stalking, put bluntly?

stingraycharles 5y ago
The point is that Firebase may not even be a third party, but rather the hosting platform of the application. Like the parent says, it’s like saying that AWS is a third party and a high risk threat.
- ectopod 5y ago
  Firebase is a hosting platform and a third party.
- mattacular 5y ago
  AWS is a third party and if you use their services, they are handling your data. I suppose it's up to you to consider how much of a risk that is to your business.

judge2020 5y ago

FYI to find the table, ctrl-f 'top 10 most frequently ' (or, if you use Chrome/your browser supports text fragments, https://me2ba.org/school-mobile-apps-student-data-sharing-behavior/#:~:text=the%20top%2010%20most%20frequently%20included%20sdks%20are%20shown%20below%20in%20table%201 https://me2ba.org/school-mobile-apps-student-data-sharing-be... ) I also don't see how OkHttp[0] or Okio[1] are 'medium' risk. Are they secretly sending data to Square? The code is auditable on GitHub. 0: https://square.github.io/okhttp/ https://square.github.io/okhttp/ 1: https://square.github.io/okio/ https://square.github.io/okio/

demersb 5y ago
Likely just user-agent scanning, those libs would be used by other service.

colordrops 5y ago

What ar the agreements with amazon and google/firebase regarding the privacy of your data? If they ensure privacy, can they be trusted? For the data of children, shouldn't they be held to a higher standard? E.g. for protected government data, you have to run in amazon's govcloud.

judge2020 5y ago
AWS terms do not grant them a license or ownership over your data, although "If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data" - so if you just store random files on s3 or EBS it's not like AWS can do anything they want with it. https://aws.amazon.com/service-terms/ https://aws.amazon.com/service-terms/ The GDPR DPA does a good job of encompassing the entire extent of their data use: > AWS will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order)... https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
asciimike 5y ago
Firebase's terms are here: https://firebase.google.com/terms https://firebase.google.com/terms (and GCP's data processing terms are here: https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms) Having worked on those products (and in some cases, written the terms), I'd say so.
- Nextgrid 5y ago
  Facebook used to promise that phone numbers collected for 2FA purposes wouldn't be used for advertising purposes, and then broke that promise. That is just one example which was made public and was done intentionally. There's potentially plenty more cases where it's either done but concealed (because of how many factors go into ad targeting it's often impossible to categorically prove/disprove which data was used to target an ad) or done by accident from earlier code that just assumed all data is fine to use for ads (or that the new product which shouldn't share its data for advertising purposes was accidentally storing data in the same place as other products who do share data for advertising purposes). Why should we trust companies that have a business incentive to break their promises? If Google's biggest revenue stream is ads and that requires personal data then I wouldn't trust any of their promises not to use some personal data unless I can 100% audit all the code myself and prove that it's indeed that code that is running in production.

1vuio0pswjnm7 5y ago

Google, who operate Firebase, enable and encourage Firebase customers to partake in advertising, e.g., by linking their Firebase account to an ads account. https://support.google.com/google-ads/answer/6333536?hl=en https://support.google.com/google-ads/answer/6333536?hl=en https://firebase.google.com/docs/ads https://firebase.google.com/docs/ads https://firebase.google.com/products/analytics/partners https://firebase.google.com/products/analytics/partners

asciimike 5y ago
Unless things have changed, the bigger issue is that Firebase Analytics is included by default and can't easily be excluded. Linking Firebase to Ads requires conscious action on behalf of the developer, while the former only requires using any Firebase product. Also, Google is in the online ads business, so I don't think it's surprising that they provide docs that show how to use Firebase data to target ads. That said, it's not the default, so it's not as shady as you're making it sound.

elliekelly 5y ago

> This is like saying data is being sent to Amazon Web Services. I have a (large financial institution) client that asks this question on their vendor due diligence and on-boarding and plans to phase out vendors who say yes and aren’t willing/able to change. They’re concerned about data privacy. Not just security, privacy. From Amazon.

vasco 5y ago
They better be huge or super niche, otherwise this sounds like an egotrip. Not sending data to a major cloud provider is quickly becoming like producing your own electricity because you don't trust the grid will provide a stable frequency and won't go down. At some point you just need to trust the utilities and go with it. Plus you can hopefully encrypt your data if this is a major concern.
- pjc50 5y ago
  Amazon have been caught using the sales data of their customers to compete against them. If they want utility levels of trust they should get nationalized.
  - Sander_Marechal 5y ago
    That's not AWS though
    - martin_a 5y ago
      Not yet.
    - nannal 5y ago
      But it's still amazon, the left hand doesn't get a free pass because the right hand pulled the trigger. Amazon has shown willingness to utilise privileged information in the past why wouldn't they go snooping around?
      - 5y ago

lmilcin 5y ago

I think the tracking landscape is such that you can't trust ANY of the companies involved in it. I personally divide tracking companies into those that were caught doing something shady with the data and those that are doing it but were not yet caught. School apps should not involve ANY tracking, regardless of your opinion about the company. Kids require special protection because they don't yet know how to function in the world and can't make informed decision about whether they want or don't want to be tracked and in fact for these kinds of apps, they are not even consulted or asked to consent. Schooling is obligatory. I can make decision whether I want to use the internet or not and whether I want to be identified, but kids don't make that decision -- they are being forced to use the software provided by schools.