18 ms·
Covert web-to-app tracking via localhost on Android
- rvnx 1y agoNot surprising, it's legal, but only if you are a multi-billion dollars company.
- orbital-decay 1y agoActual report: https://localmess.github.io/ https://localmess.github.io/ >Google says it's investigating the abuse That's a bit ironic, considering how they're using any side channel they could lay their hands on (e.g. Wi-Fi AP names) to track everyone. Basically every large app vendor with multiple apps does something similar to circumvent OS restrictions as well.
- n2h4 1y agoif it were a small company, it'd have been dilisted from google's play store in an instant.
- voidUpdate 1y agoI wish we could just ban advertising and tracking on the internet. I feel like so much crap these days has come out of it, all so that CEOs can afford an extra yacht
- crowcroft 1y agoThe question is how do you ban it, and then how do you prove that people are breaking those rules?
- fsflover 1y agohttps://news.ycombinator.com/item?id=43595269 https://news.ycombinator.com/item?id=43595269
- crowcroft 1y agoI like the idea, but where do you draw the line on what advertising is. Is affiliate marketing still allowed? Are influencers allowed to take payment? Can people be a spokesperson for a company? Can newspapers run commentary about businesses? Can companies pay to be vendors at a conference? No matter where you end up drawing the line you’re just shifting the problems somewhere else. Look at the amount of money Meta and Google make, the incentive is just too large.
- voidUpdate 1y agoI know. It's wishful thinking that will never become a reality. I pray for a solarpunk future in the same way
- numpad0 1y agoBy defining the $thing, banning the $thing per definition by law, and then tasking FBI-like organization enforce the law? It won't completely go away but it will subside, like how gambling on Internet is divided binary and confined into lootbox games without cashing features and straight up scam underground casinos. Personally I think we should start from separating good old ads(that existed before I was 15) and Internet "ads". The old ads were still somewhat heavily targeted, but less than it is now. There probably would be an agreeable line up to which level advertisement efforts can be perverted.
- the_sleaze_ 1y agoYes - although I disagree on one point. All we need to do is define the $thing and mandate that lawsuits can be effective. No agency enforces that potato chips need to fill up 92% of the bag or whatever, or that McDonalds cannot show pictures of apple fritters with more apples than they actually come with (this happened). You just incentivize a cottage industry of legal that can squeeze a profit out of suing peanut butter companies for labelling incorrectly, or advertising dishonestly and it sort of takes care of itself.
- crowcroft 1y agoI mean the comparison of ‘old’ ads vs new ads is interesting in itself, old ads already abide by far more regulation and are far more auditable. Simply bringing digital ads in line would be a big step forward. Some examples: In most countries it’s illegal to ‘target minors’ and there’s restrictions on what ads can run on after school hours. Meta has always allowed age targeting down to 13 and has no time of day restrictions. In parts of New Zealand you can’t advertise alcohol between 10PM and 9AM… unless you do it on Meta or Google. Most countries have regulation about promoting casinos (or the inability to) unless they’re digital casinos being promoted in digital ads. Or just look at the deepfake finance and crypto ads that run on Meta and X. Meta requires 24 strikes against an advertiser before they pull them down, if a TV network ran just one ad like that it would be a scandal. Audit-ability is the biggest issue imo. If a TV ad runs we can all see it at the same time and know it ran. That is simply impossible with digital ads, and even when Meta releases some tools for auditing the caveat is that you still have to trust what they’re releasing. Similarly with data protection there’s no way to truly audit what they’re doing unless you install government agencies in the companies to provide oversight, and I don’t see how you could really make that work.
- lucianbr 1y agoI think the main problem is lots of money are made from it, and money influences politics hugely. The technical difficulties are low on the list of reasons this is not happening.
- pseudocomposer 1y agoThe deprecation of third-party cookies, that all browsers were at one point on track to implement, was pretty much the most realistic first step to that. Which is why Google killed it last year by leveraging their control over Chrome. While not technically a crime, it was a disgusting, unethical market manipulation move that never really got the public outrage it deserved. Google execs’ initial support for it was also telling: leadership at Google must literally thought they would find another way to stay as profitable as they are without third-party cookies. Put another way: Google leadership didn’t understand cookies as well as someone who’s taken a single undergrad web dev class. (Or they were lying all along, and always planned to “renege” on third-party cookie deprecation.)
- footlose_3815 1y agoInsidiously calling it "Privacy sandbox", and now setting everything opt-in every time I login to Chrome is really not Googly.
- IggleSniggle 1y agoI don't think that's quite what happened. Google got in anti-trust trouble because they have an unfair advantage in user-tracking, given logged in Chrome accounts. Removing third-party cookies hurts other privacy-invading companies without substantially affecting Google. It was still somewhat on track to be removed from Chrome until they lost their antitrust battle, and Chrome was required to be spun off. With Chrome's new future, and Google's new legal constraints, there's less incentive to try and make Privacy Sandbox work. At least, that was my understanding; I didn't follow it all that closely.
- skybrian 1y agoMost commenters on Hacker News hated Google’s plan and hoped it would fail. Were they wrong? It seems like damned-if-you-do, damned-if-you-don’t.
- threecheese 1y agoThat stemmed from “dammit Google now every SaaS developer has to work nights to meet your arbitrary deadline”; here we’re caring more about the impact as consumers. It’s ok to think about things in two ways. source: a developer who actually did have to do this (and did it, and now didn’t have to, but it’s done)
- Workaccount2 1y ago>all so that CEOs can afford an extra yacht ...and so consumers can use services/products without having to fork over money. People love the ad-model. Given the option to pay or use the "ad-supported" option, the ad-supported one wins 10 to 1. This means in many cases it doesn't even make sense to have a paid option, because the ad option is just so much more popular. As bad as crypto is, with all the negative things attached to it, BAT was probably one of the smartest things to be invented. A browser token that automatically dispenses micropayments to websites you visit. Forget all the details to get snagged on, the basic premise is solid: Pay for what you use. You become the customer, not the advertisers. Also a note about ad-blocking - it only makes the problem worse. It is not a "stick it to the man" protest. You protest things by boycotting them, or paying their competitors, not by using them without compensating them.
- rkomorn 1y agoI really liked the concept of BAT but the reality left me wanting. Things like "we'll hang on to the tokens of sites that don't use BAT yet for them until they join" gave negative vibes. It all felt a little underbaked. I swing back to Brave once in a blue moon and then remember I've got at least $20's worth of BAT lost forever somewhere.
- Workaccount2 1y agoI'm not a big fan of it or anything, it's just the only crypto I know that was targeting that idea. I'd love if there was another one that was totally open and just a browser extension away. But I do not think it would ever get off the ground because... People love the ad model and hate paying for things.
- SecretDreams 1y agoYes, we need ads for a free internet, today. And, as a result, we also have our privacy eroded - eroded in ways we may not care about today, but will probably regret tomorrow. If we must pay for the internet, give me an option to pay to use it where I see no ads and my privacy is preserved. Let me know what that cost is and I'll decide what I want to do. Right now, the actual pricing is obscured so we just "accept" that the internet in its current form is how it needs to be.
- fuzzfactor 1y agoThis type of thing is pure greed, completely distinct from a highly aggressive pursuit of far more lucrative opportunities that average businessmen have been able to accomplish in the extreme interest of their shareholders. Those true leaders are the traditional examples who have shown success over the centuries, without letting any greed whatsoever become a dominant force, recognizing and moving in the opposite direction from those driven by overblown self-interest, who naturally have little else to offer. It can be really disgraceful these days but people don't seem to care any more. That's one thing that made them average businessmen though. Now if you're below-average I understand, but most companies' shareholders would be better off with a non-greedy CEO, who outperforms by steering away from underhanded low-class behavior instead. Now if greed is the only thing on the table, and somebody like a CEO or decision-making executive hammers away using his only little tool with admirable perseverance long enough, it does seem to have a likelihood of bringing in money that would not have otherwise come in. This can be leveraged too, by sometimes even greedier forces. All you can do is laugh, those shareholders might be satisfied, but just imagine what an average person could do with that kind of resources. It would put the greedy cretins to shame on their own terms. And if you could find an honest above-average CEO, woo hoo !
- Hilift 1y agoReddit has fairly extensive device fingerprinting. And they are selling data for training AI models. It's only a matter of time before there is some premium phone app that monetizes data that otherwise isn't available/for sale.
- udev4096 1y agoIt's impossible and we all know it. Instead, donate or help with the huge adblock lists that are being maintained by a lot of people
- kbenson 1y agoA lot of things I would have previously said were impossible have happened in the last half year. If only a few of those things were of the impossibly good type.
- voidUpdate 1y agoAs said in a reply to a sibling comment, I am very aware. This is wishful thinking
- dan15 1y agoThe majority of internet users are either unwilling or unable to pay for content, and so far advertising has been the best business model to allow these users to access content without paying. Do you have a better suggestion?
- FuckButtons 1y agoSure, this entire business model has been cataclysmic for traditional media organizations and news outlets and peoples trust in institutions has plummeted in correlation, so, let’s just fucking scrap it and go back to payed media.
- geoffpado 1y ago"Traditional media organizations" have been primarily funded by advertising longer than anyone on HN has been alive.
- saagarjha 1y agoSome of them; perhaps even a vast majority. But this isn't the only option nor do we have to continue for it to be so.
- _Algernon_ 1y agoManufacturing consent identified advertisement as one of its five filters and was published in 1988. It is and was extremely rare for a magazine or news paper to not be at least partially funded by advertisements.
- bandrami 1y agoI don't pay for network TV but it still gets produced
- thevinter 1y agoAnd it is funded by ads, what's your point?
- bandrami 1y agoI don't think it has to go that far. I think there's a middle ground here that people would accept: show us ads, but make it a one-way firehose, like TV and billboards. If you need to advertise to pay for the site, put up all the banners you want. But don't try to single me out for a specific one. If it could pay for network TV there's no reason it can't pay for a website. (You could still do audience-level tracking, e.g. "Facbebook and NCIS are both for old people, so advertise cruises and geriatric health services on those properties")
- kgwxd 1y agoWe have those one-way firehose online too. They're not mutually exclusive methods. Nothing short of legislation will stop the current norms.
- nedt 1y agoIt's already enough to just have plain ads. Like we have them on the streets, at the bus station, newspapers, etc. No tracking needed at all, just give out the message. If you need to target people to it in the context of the place or content you are showing it with. But you don't need to know anything about the user seeing the ad. Targeting by user doesn't work anyway.
- gbalduzzi 1y ago> Targeting by user doesn't work anyway. How did you reach this conclusion? The main problem is that it works way better than traditional marketing medium. It's the reason Google and Facebook are so massive, why would publishers choose to pay them if it doesn't work?
- Doxin 1y ago> why would publishers choose to pay them if it doesn't work? Because they believe it works and it's impossible to prove otherwise?
- throwanem 1y agoBy the same logic cigarettes are presumptively beneficial...
- lynx97 1y agohttps://www.youtube.com/watch?v=ESoYS9SZW-4 https://www.youtube.com/watch?v=ESoYS9SZW-4
- nedt 1y agoI've seen it being used. Like on the frontend side with Facebook which thinks if I'm interested into cycling I will also be interested in cars (both are on the street, right?) or if I'm interested in some more dirty humor I also want to see more "naughty" stuff. And also on the backend used by magazines and they mostly don't use the user profiles because it's too targeted and doesn't have enough audience. And if you make the targeting broad enough you'll have again people interested in chocolate so you target them with wine and whiskey. Or even better on Amazon where you can buy a new TV and when you have done so it will suggest you even more TVs for the next months.
- burnt-resistor 1y agoThe problem is their greed is unlimited and their power/influence and purchasing power is relative to all of the other billionaires corrupting government and making every little facet of life of ordinary people more expensive, miserable, transactional, and punitive.
- lostmsu 1y agoThis just reinforced the use of uMatrix. Governments should mandate browser vendors to implement any standards gorhill might come up with.
- pabs3 1y agoIf only uMatrix was still developed/supported.
- pmontra 1y agoIt still works very well. I'm using it on both Linux and Android. The UI is far better than its replacement inside uBO.
- fc417fc802 1y agoThe uBO functionality isn't a legitimate replacement. I don't understand how that came to pass.
- pmontra 1y agoThose extensions are from the same author. I don't know the details but maybe gorhill didn't have the time to maintain uMatrix anymore and added the very minimum uMatrix functionality to uBO and settled for that. Luckily uMatrix keeps working.
- k4rli 1y agoUnfortunately in modern web uMatrix is just incredibly annoying. Nearly every site breaks for various reasons and often allowing everything in uMatrix still doesn't fix the issue. Card payments, especially with 3D secure that use iframes, are one of the biggest problems. This often leads to creating new order several times since allowing something + reloading loses the entire flow. Captchas are also massive pain, probably because they can't fingerprint as well as normally? Life after having disabled uMatrix completely has been better.
- Xiol32 1y agoCrap like this is why I haven't had the Facebook or Instagram apps installed for years. I still have accounts, but I only visit them via the browser.
- sklargh 1y ago[flagged]
- Thorrez 1y agoThere are over 300M companies in the world. It seems only 2 companies did this. So look at the revenue models of the other 299,999,998 companies. Meta only started this less than a year ago, so look at their revenue model prior to that.
- einpoklum 1y agoI heard they arrested a serial bank-robber and he said this in court when they asked him why he did it.
- qwertox 1y agoImagine a website not being a trojan horse, but directly serving non-targeted advertising to users at the same level as their content. They could target it by tailoring it to content they're serving, just like I'd be ok with seeing an ad for a new car when I'm on a page reading about the properties of a given combustion engine.
- qwertox 1y ago"UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed." I'm surprised they're allowed to listen on UDP ports, IIRC this requires special permissions? > The Meta (Facebook) Pixel JavaScript, when loaded in an Android mobile web browser, transmits the first-party _fbp cookie using WebRTC to UDP ports 12580–12585 to any app on the device that is listening on those ports. Borders on criminal behavior. Apparently this was a European team of researchers, which would mean that Meta very likely breached the GDPR and ePrivacy Directive. Let's hope this gets very expensive for Meta.
- fluidcruft 1y agoNothing quite like an instant panicked coverup to confirm guilt and intent. Hopefully not too late to make it into the lawsuit. Assholes.
- reaperducer 1y agoHopefully not too late to make it into the lawsuit. Assholes. I sure hope there's a lawsuit. Over the last ten years, I've gotten over $2,000 in lawsuit settlement checks from Meta, alone. I have a savings account at one of my banks that I use just for these settlement checks. Sometimes they're just $5. Sometimes they're a lot more. I think the most I ever got was around $500. It's a little bit here, and a little bit there, but at the rate it's going, in another five years, I'll be able to buy a car with privacy violation money.
- IncreasePosts 1y agoAs someone who works for a similar large org, it's just as likely that some low level programmer put it in without much thought, and then this got surfaces to higher up people who didn't know about it and told them to remove it immediately.
- crtasm 1y agoIt seems incredibly unlikely a low level programmer could come up with this method then get the necessary code into both the tracking pixel served to third party sites and Meta's android apps without some higher ups knowing about it.
- pabs3 1y agoI'm surprised browsers don't isolate each of the localhost/localnet/internet networks from each other. Are there any use-cases for allowing this?
- matthberg 1y agoIf I recall correctly Figma uses it to connect to the locally installed app, and Discord definitely uses it to check if its desktop app is installed by scanning ports (6463-6472). I'm aware of two blockers for LAN intrusions from public internet domains, uBlock Origin has a filter list called "Block Outsider Intrusion into LAN" [0] under the "Privacy" filters, and there's a cool Firefox extension called Port Authority [1][2] that does pretty much the same thing yet more specifically targeted and without the exclusions allowed by the uBlock filterlist (stuff like Figma's use is allowed through, as you can see in [0]). I've contributed some to Port Authority, too :) 0: https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/... 1: https://addons.mozilla.org/firefox/addon/port-authority https://addons.mozilla.org/firefox/addon/port-authority 2: https://github.com/ACK-J/Port_Authority https://github.com/ACK-J/Port_Authority
- bravesoul2 1y agoThere are surely other ways to achieve this. If you are logged into an app and the site at tbe same time they can use the server to communicate. Discord doesn't need to know if the app is installed to work. That sounds sketchy.
- Orphis 1y agoIt's just a way to ensure you open the desired context on a local Discord instance, not any instance that might be logged in to your account. I have a few personal computers logged in on Discord on the same account that could be active at the same time for example.
- pabs3 1y agoThe native messaging feature is a much better way to talk to native apps, that should be used instead for modern browsers.
- neuroticnews25 1y agoTo me it's weird that they're willing to misuse browser APIs so blatantly for interprocess communication, when, as I understand it, server-side correlation using a combination of IP, battery level and screen dimensions probably already gets them 95% of the surveillance capability.
- jeroenhd 1y agoA quite obvious attack mechanism, I'm surprised browsers permitted this in the first place. I can't think of a reason to STUN/TURN to localhost. Aside from localhost, trackers can also use all other IP addresses available to the browser to bind their apps/send traffic to. Now that the mechanism is known (and widely implemented), one could write an app to notify users about attempted tracking. All you need to do is to open the listed UDP ports and send a notification when UDP traffic comes in. For shit and giggles I was pondering if it was possible to modify Android to hand out a different, temporary IPv6 address to every app and segment off any other interface that might be exposed just because of shit like this (and use CLAT or some fallback mechanism for IPv4 connectivity). I thought this stuff was just a theoretical problem because it would be silly to be so blatant about tracking, but Facebook proves me wrong once again. I hope EU regulators take note and start fining the websites that load these trackers without consent, but I suspect they won't have the capacity to do it.
- fc417fc802 1y ago> hand out a different, temporary IPv6 address to every app and segment off any other interface that might be expose Yes, but (AFAIK) not out of the box (unless one of the security focused ROMs already supports this). The kernel supports network namespaces and there's plenty of documentation available explaining how to make use of those. However I don't know if typical android ROMs ship with the necessary tooling. Approximately, you'd just need to patch the logic where zygote changes the PID to also configure and switch to a network namespace.
- jeroenhd 1y agoI've looked into network namespaces a bit but from what I can tell you need to do a lot of manual routing and other weird stuff to actually make IPv6 addresses reachable through them. In theory all you need to do is have zygote constrain the app further with a network namespaces, and run a CLAT daemon for legacy networks, but in practice I'm not sure if that approach works well with 200 apps that each need their IPs rotated regularly. Plus, you'd need to reconfigure the sandbox when switching between WiFi/5G/ethernet. Not impossible to overcome, but not the weekend project I'd hoped it would be.
- bix6 1y agoWhat happened to all the hackers fighting for personal freedom and privacy? Meta paycheck too tasty?
- Agentus 1y agoat some point yah reach a cross road. either sellout and join big brother or join the wandering homeless hordes on the streets.
- kstrauser 1y agoEh. You can have a very comfortable career doing work that still lets you look at yourself in the mirror. You don’t have to choose to burn the world to pay the rent.
- bix6 1y agoI agree with you but I also don’t. It’s a privilege to have the ability to choose which job you work.
- kstrauser 1y agoNot in this case. If you’re qualified to get a job at a company who will pay you to sell out your neighbor, you’re qualified to get a job with a decent boss who’ll never ask you do to do this kind of thing, pays 90% as much, and is still many times the national average salary. The alternatives are not doing evil vs starving. They’re getting paid well for doing evil, or getting paid well for doing good or at least neutral.
- bix6 1y agoOk you’ve convinced me!
- kstrauser 1y agoWe’re still fighting the fight. Turns out shifty assholes also figured out how to write code and get hired.
- GrantMoyer 1y agoWould an individual using this technique to collect information from someone else's computer possibly face prosecution under the Computer Fraud and Abuse act?
- croes 1y agoYes
- paxys 1y agoPeople have been prosecuted under that act for clicking "view source" on their web browser. The crime itself is irrelevant. It's more about who you are/what connections you have/who you piss off.
- evilos 1y agoHas there actually been a conviction purely for "viewing source"?
- pona-a 1y agoThat was a real news story. A journalist looked at the state's educator-credentials checker, viewed the source and saw it had teacher's SSNs in base64 somewhere in the plaintext. Missouri Governor Mike Parson then tried to legally threaten the journalist. Honestly, if this case wasn't as high-profile, I think he might have got a conviction, at least in state court. https://www.theregister.com/2022/02/15/missouri_html_hacking/ https://www.theregister.com/2022/02/15/missouri_html_hacking...
- etherealG 1y agoexactly, the more interesting question: would anyone be willing to prosecute a Meta executive over this? Sadly, I expect no.
- gruez 1y agoThis only works if you control the code on both sides (ie. on the website being visited and an app running on the phone). It's not some sort of magic hack that allows you to exfiltrate arbitrary browser history. Therefore it's unclear how it can be construed as "hacking" in any meaningful way. As bad non-consensual tracking done by google/meta/whatever are, it's not covered under CFAA.
- merek 1y agoThis is the overall process used by Meta as I understand it, taken from https://localmess.github.io/ https://localmess.github.io/: 1. User logged into FB or IG app. The app runs in background, and listens for incoming traffic on specific ports. 2. User visits website on the phone's browser, say something-embarassing.com, which happens to have a Meta Pixel embedded. From the article, Meta Pixel is embedded on over 5.8 million websites. Even in In-Cognito mode, they will still get tracked. 3. Website might ask for user's consent depending on location. The article doesn't elaborate, presumably this is the cookie banner that many people automatically accept to get on with their browsing? 4. > The Meta Pixel script sends the _fbp cookie (containing browsing info) to the native Instagram or Facebook app via WebRTC (STUN) SDP Munging. You won't see this in your browser's dev tools. 5. Through the logged-in app, Meta can now associate the "anonymous" browser activity with the logged-in user. The app relays _fbp info and user id info to Meta's servers. Also noteworthy: > This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users’ web activity. > On or around May 17th, Meta Pixel added a new method to their script that sends the _fbp cookie using WebRTC TURN instead of STUN. The new TURN method avoids SDP Munging, which Chrome developers publicly announced to disable following our disclosure. As of June 2, 2025, we have not observed the Facebook or Instagram applications actively listening on these new ports.
- fluidcruft 1y agoNot totally following but it sounds like you are saying one of the things they have been doing involves abusing mandated GDPR cookie notices to secretly track people?
- hulitu 1y ago> Meta and Yandex are de-anonymizing Android users' web browsing identifiers Thank god that Microsoft and Google don't do this. Oh, wait... /s
- matthberg 1y agoA comment I wrote in another HN thread [0] covering this issue: Web apps talking to LAN resources is an attack vector which is surprisingly still left wide open by browsers these days. uBlock Origin has a filter list that prevents this called "Block Outsider Intrusion into LAN" under the "Privacy" filters [1], but it isn't enabled on a fresh install, it has to be opted into explicitly. It also has some built-in exemptions (visible in [1]) for domains like `figma.com` or `pcsupport.lenovo.com`. There are some semi-legitimate uses, like Discord using it to check if the app is installed by scanning some high-number ports (6463-6472), but mainly it's used for fingerprinting by malicious actors like shown in the article. Ebay for example uses port-scanning via a LexisNexis script for fingerprinting (they did in 2020 at least, unsure if they still do), allegedly for fraud prevention reasons [2]. I've contributed some to a cool Firefox extension called Port Authority [3][4] that's explicitly for blocking LAN intruding web requests that shows the portscan attempts it blocks. You can get practically the same results from just the uBlock Origin filter list, but I find it interesting to see blocked attempts at a more granular level too. That said, both uBlock and Port Authority use WebExtensions' `webRequest` [5] API for filtering HTTP[S]/WS[S] requests. I'm unsure as to how the arcane webRTC tricks mentioned specifically relate to requests exposed to this API; it's possible they might circumvent the reach of available WebExtensions blocking methods, which wouldn't be good. 0: https://news.ycombinator.com/item?id=44170099 https://news.ycombinator.com/item?id=44170099 1: https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/... 2: https://nullsweep.com/why-is-this-website-port-scanning-me/ https://nullsweep.com/why-is-this-website-port-scanning-me/ 3: https://addons.mozilla.org/firefox/addon/port-authority https://addons.mozilla.org/firefox/addon/port-authority 4: https://github.com/ACK-J/Port_Authority https://github.com/ACK-J/Port_Authority 5: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
- JimDabell 1y agoThere is a specification for blocking this: https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/ It gained support from WebKit: https://github.com/WebKit/standards-positions/issues/163 https://github.com/WebKit/standards-positions/issues/163 …and Mozilla: https://github.com/mozilla/standards-positions/issues/143 https://github.com/mozilla/standards-positions/issues/143 …and it was trialled in Blink: https://developer.chrome.com/blog/private-network-access-update/ https://developer.chrome.com/blog/private-network-access-upd... Unfortunately, it’s now on hold due to compatibility problems: https://developer.chrome.com/blog/pna-on-hold https://developer.chrome.com/blog/pna-on-hold
- kriro 1y agoThe EU should set some record breaking fines for this. Maybe it's time to invent a tax that starts at 0% and goes up 1-X% every time your hand is cought in the cookie jar. And add a corresponding website where you can clearly see all violations by company.
- like_any_other 1y agoThere should also be fines, but individuals have gone to jail for less.
- SchemaLoad 1y agoI agree they should. But I don't think the EU has any real ability to send American tech execs to jail. At most they can stop them doing business in the EU.
- impossiblefork 1y agoI think mutual criminality is satisfied, so extradition is definitely possible.
- Hilift 1y agoMeta makes $70 billion net per year, after fines.
- deleted 1y ago[deleted]
- bravesoul2 1y agoSo Meta apps are spyware. And Zuck agains has got his finger in his mouth and a cat on his lap.
- dylan604 1y agoAll Meta software is spyware. Whether it's an app or a website, they are only in existence for you to be pacified to spend as much time on them as possible so they can hoover up your data. If those apps/websites provide you with anything useful, it is just as a ruse to get more data from you.
- dylan604 1y ago*: Meta Pixel script was last seen sending via HTTP in Oct 2024, but Facebook and Instagram apps still listen on this port today. They also listen on port 12388 for HTTP, but we have not found any script sending to 12388. **: Meta Pixel script sends to these ports, but Meta apps do not listen on them (yet?). We speculate that this behavior could be due to slow/gradual app rollout. So, could some other app send data to these ports with a fake message? I'm asking for a friend that likes to do things for science.
- fshafique 1y agoTwo ways to f#ck with these trackers - either send them nothing back, or flood them with lots of fake data. Somebody also needs to come up with a way to peer to peer share advertiser tracking cookies.
- paxys 1y agoAll apps + the web browser being able to communicate freely over a shared localhost interface is such a glaring security hole that I'm surprised both iOS and Android allow it. What even is a legitimate use case for an app starting a local web server?
- dylan604 1y agoWhich begs the question why is this specific to Android? Why would Meta/Yandex not be doing this on iOS, or why did this study not report on iOS?
- mig39 1y agoDoesn't iOS prompt you to give apps permission to connect to your local network? "App would like to find and connect to devices on your local network" or something along those lines. I always hit the "no thanks" button.
- paxys 1y agoIn this case it's the web browser connecting to the network, so the permission is irrelevant.
- deleted 1y ago[deleted]
- JimDabell 1y ago> What even is a legitimate use case for an app starting a local web server? There are apps on iOS that act as shared drives that you can attach via WebDAV. This requires listening on a port for inbound WebDAV (HTTP) requests.
- codedokode 1y agoThey don't need to listen on localhost though.
- like_any_other 1y agoA commenter mentioned [1] that major Russian apps now all ask for permission to read a unique device ID to deanonymize users. The people that stopped Intel from adding such an ID to their CPUs had perfect foresight [2] (too bad later Intel added it anyway). But then it's not hard to guess that if you include a feature whose purpose is to attack the user, it will be used to attack the user. [1] https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/?comments=1&post=43767051 https://arstechnica.com/security/2025/06/meta-and-yandex-are... [2] https://en.wikipedia.org/wiki/Pentium_III#Controversy_about_privacy_issues https://en.wikipedia.org/wiki/Pentium_III#Controversy_about_...
- gruez 1y ago>A commenter mentioned [1] that major Russian apps now all ask for permission to read a unique device ID to deanonymize users. To be fair it's not really limited to Russian apps. Many popular apps on play store have it as well: https://play.google.com/store/apps/details?id=org.telegram.messenger&hl=en&gl=us https://play.google.com/store/apps/details?id=org.telegram.m... https://play.google.com/store/apps/details?id=com.microsoft.copilot&hl=en&gl=us https://play.google.com/store/apps/details?id=com.microsoft.... https://play.google.com/store/apps/details?id=com.pinterest&hl=en&gl=us https://play.google.com/store/apps/details?id=com.pinterest&...
- lachlan_gray 1y agoIs there a similar thing on iOS? I always wonder when a random app asks to “find devices on my network”
- JimDabell 1y agoThis is answered on the page.
- pacifika 1y ago> That said, similar data sharing between iOS browsers and native apps is technically possible.
- cosmic_cheese 1y agoPossible, but potentially not as practical due to the iOS’ restrictive background process model. There, background tasks are generally expected to quickly do whatever it is they need to and exit and generally can’t run indefinitely. Periodic tasks are scheduled by the OS, with scheduling requests from apps being more likely to be honored if their processes are well-behaved (quick, low resource, don’t crash, and don’t run too frequently) with badly-behaved processes getting run less often. Apps that keep themselves open by reporting that they’re playing audio might be able to work around this, but it’d still be spotty since users frequently play media which would suspended those backgrounded apps and eventually bump them out of memory.
- cluckindan 1y agoIt’s probably easier to buy that data directly from Apple. Google’s core business is built on tracking data, so they would be reluctant to sell, necessitating covert collection.
- SchemaLoad 1y agoCan you link the page where you can buy that data?
- bravesoul2 1y agoCan this cross profiles? That would be a big security issue for corps. Quick test and if I serve on 8080 on the Userland app it can be accessed from both profiles. So probably yes. This means an infected app on your personal profile could exchange data with a site visited from a second profile.
- lxgr 1y agoOnly if that site specifically communicates with an (unauthenticated) service bound to a local port though, right?
- btown 1y agoWhich, per the OP, the site would be doing by merely including the Meta pixel, which practically every e-commerce and news site does to track its campaigns and organic traffic. The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity in that app for an unknown amount of time. And even with the tracking code deactivated, cookies may still persist on those secondary profiles that still allow for linking future activity.
- lxgr 1y agoYes, but if the concern is not mixing business and personal compartment of the phone, business sites would hopefully not embed a Meta tracking pixel. > The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity Definitely, and that's a huge problem. I just don't think Android business profiles are a particular concern here; leaking app state to random websites in any profile is the problem. Or do Android "business profiles" also include browser sessions? Then this would be indeed a cross-compartment leak. I'm not too familiar with Android's compartment model; iOS unfortunately doesn't offer sandboxing between environments that way.
- 1y ago
- deleted 1y ago[deleted]
- lgats 1y agoI built a little lan tool https://router.fyi https://router.fyi that tries to get LAN data for a sort of online-nmap. depending on your browser, it's sometimes capable of finding wifi printers and a couple other smart home devices i've manually added.
- barbazoo 1y agoProbably hard to do for many but the solution seems be not to have their apps installed. It’s crazy to me that people tolerate FB et al on their devices where you have absolutely no control over what they’re doing.
- threecheese 1y agoI agree wrt Facebook, but there’s a long tail of useful apps-that-should-be-websites; 1 click for an app versus 45 seconds searching through tabs and re-logging in (etc) can be meaningful, especially when there are fifty of them. My healthcare provider recently yanked the mobile version of their portal website, and forces users to download their app. Personally, I see the security angle, but still feel like it’s a punch in the face and so I just went back to paper billing and using a PC for healthcare stuff. More of this is coming, I suspect.
- Hilift 1y agoReddit has fairly intense device fingerprinting. And they sell data for AI training.
- bandrami 1y agoYup. When I deleted the FB, X, and Reddit apps both my productivity and my phone's battery life skyrocketed. I assume that's why those companies try to actively degrade the experience on the website.
- username135 1y agoSimple question: would disabling apps from running in the background prevent this? Or, more simply, not staying logged into an app on your phone?
- sethaurus 1y agoYes, preventing the app from running in the background (entirely) would prevent it from listening on a port and collaborating with websites via this exploit. As for the second part: no, logging out of the apps would not necessarily be enough. The apps can still link all the different web sessions together for surveillance purposes, whether or not they are also linked to an account within the app. Meta famously maintains "shadow profiles" of data not (yet) associated with a user of the service. Plus, the apps can trivially remember who was last logged in.
- robin_reala 1y agoCan you imagine the mental hoops you’d need to jump through as a developer to persuade yourself that this is a valid thing to implement?
- deleted 1y ago[deleted]
- fanatic2pope 1y agoMy experience is that most developers just do as they are told.
- robin_reala 1y agoAnother reason why AI is so fascinatingly horrible: it’ll never question the moral impact of what you’re trying to do.
- nickthegreek 1y agoexcept claude was trying to rat out users in their newer trials. in the end, the best whistleblower could end up being the ai… not sure what that says about us though.
- ambicapter 1y agoNot many? You've never met a developer with a god complex?
- edoceo 1y agoGet paid - it's one hoop.
- kube-system 1y agoZero. People who work on ad-tech build ad-tech all day long, that's the entire job. Seriously, why do you think all of the unquestionable things humanity has built have been built? It's because it's all just part of the job, for somebody. People working at ad-tech question the things they're building just like the people at McDonalds flipping a burger are questioning the cholesterol levels of their customers. They're not.
- paxys 1y agoIf you are even mildly technical you NEED to have a Pihole + Tailscale setup on your home network and all devices. Block all this malware at the root.
- aembleton 1y agoOr change your DNS to use nextDns
- aembleton 1y agoSounds like blocking these tracking scripts using uBlockOrigin probably prevents this. Another reason to use uBlockOrigin.
- dmantis 1y agoDoes that work across profiles? I have to use some apps from such spyware oriented companies and usually put them in isolated profile with shelter. I wonder whether local ports opened in isolated "work" android profile are accessible by main profile.
- Aissen 1y agoLove the url slug: headline-to-come. It now redirects to a more boring one though.
- bnpxft 1y agoAnother reason not to install big tech's apps and only use their websites if you must. Not only our their websites painful which discourages use, websites are more sandboxed.
- microtonal 1y agoI am not sure which Meta apps open ports, but e.g. Samsung phones come with a bunch of Meta apps pre-shipped. IIRC just removing the Facebook app is is not enough, there is another service installed that is not visible as an app (com.facebook.services etc.), which you can only uninstall from the data partition with something like ADB/UAD. Or buy an iPhone or a Pixel.
- jmm5 1y agoThe Pixel "Private Space" feature should prevent Meta apps from running in the background. It also prevents you from getting notifications.
- Groxx 1y agoI kinda wonder if pushing it into a separate/work profile would isolate it from this... though it kinda smells to be like something that might accidentally (or "accidentally") leak.
- johnisgood 1y agoI tend to buy stock Android, e.g. Motorola moto g30, etc. It still has lots of Google stuff, but you can get rid of them, and I have a work profile specifically designed for Google-related stuff, and my personal profile is de-Googled as much as possible.
- microtonal 1y agoI would recommend everyone who wants a clean Android to look into Google Pixel phones. Aside from being mostly bloat-free (and most bloat can be uninstalled), it is one of the few phones that supports unlocking/relocking and a secure open source alternative (GrapheneOS).
- captn3m0 1y agoAnother similar tracking vector that lets any app detect all installed apps by using android.intent.action.MAIN Query: https://support.google.com/googleplay/android-developer/thread/332857106/privacy-concern-about-android-intent-action-main-intent-in-queries-element https://support.google.com/googleplay/android-developer/thre... without the QUERY_ALL_PACKAGES permission. No response from Google. Being used by dozens of apps in the wild. Edit: Original Research link: https://peabee.substack.com/p/everyone-knows-what-apps-you-use https://peabee.substack.com/p/everyone-knows-what-apps-you-u... (HN: https://news.ycombinator.com/item?id=43518866 https://news.ycombinator.com/item?id=43518866 , 482 comments)
- maeil 1y agoIncredible that this was locked.
- bossyTeacher 1y agodang likely got told not to upset the benefactors
- maeil 1y agoReferring to the linked Google Developers thread.
- deleted 1y ago[deleted]
- maeil 1y agoOn many threads here regarding EU fines, I see the sentiment "The EU only fines US tech to make a quick buck!". It could be an idea to, you know, stop doing these things. Would be great to see another few $billion fine for this one.
- aucisson_masque 1y agoThe us could fine US tech too. I bet that most Americans would be ok with that, more privacy, more money for the state and less to the greedy bastards. EU doesn’t have to be the cop of US technology, in fact it’s a bit pathetic to have another country policy your industry.
- maeil 1y ago(R)ussia only punishes (R)ussian tech when it does not align with the party.
- hofrogs 1y agoDoing something like this should result in Meta and such being legally annihilated. But nothing will happen, as usual.
- OsrsNeedsf2P 1y agoWhat's the crime?
- hofrogs 1y agoSpying on users, connecting their real life identities to their browsing history without their consent or knowledge?
- kennywinker 1y agoTracking users without their consent. This is a crime in the EU. It’s a crime that it’s not a crime in the US.
- autoexec 1y agostalking? Maybe even something in the ECPA
- lucianbr 1y agoUnauthorized access to a computer system. I'm sure if I connected to some port on a computer belonging to Meta without them wanting it, that would be the crime I would be charged with. But somehow if Meta connects to a port on my phone without me agreeing to it, it's not a crime?
- nickphx 1y agoYes.. and that listening service is their software that you installed on your device... So caveat emptor.
- genewitch 1y agoSoftware that came preloaded with what sounds suspiciously like a rootkit to keep the background service running on some phones. Please don't "don't that phone then" because it's the same all the way down to rotary telephones. I still didn't consent to meta tracking me on my telephone. I understand the shadow profiles and tracking pixels and whatnot, but cmon. Next year "actually meta was listening to conversations captured by android devices and using it to target ads" Don't use a cellphone? Meta and Google track desktop web use. Don't use a computer? Okay, that's cool.
- jurgenkesker 1y agoAh yes, and every small Android dev is banned from Play and Admob for tiny unknown reasons, with no recourse or way to communicate with Google. But Meta here probably won't get any problems at all. They should be temporarily banned!
- qwertox 1y agoI wonder if companies like Wetter Online (from whom we know that they're selling the location data to brokers [0]) or ad service providers which offer libraries do the same. If it were so, Google should be knowingly be allowing this to happen and be a co-conspirator. I mean, they surveil our devices as if it were their home. Impossible that they're not aware. [0] https://netzpolitik-org.translate.goog/2025/databroker-files-neuer-datensatz-enthuellt-40-000-apps-hinter-standort-tracking/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://netzpolitik-org.translate.goog/2025/databroker-files...
- josephcsible 1y agoWhy don't all browsers, desktop and mobile, just block all cross-origin access to localhost?
- easterncalculus 1y agoFor one I think it would break all those "update your BIOS via your motherboard website" apps that probably shouldn't exist anyways. There probably are some legitimate uses, but I'm straining to come up with them.
- arunkant 1y agoMaybe just ask for confirmation
- chedabob 1y agoI thought they did for resources and JS, which is why Meta have to use WebRTC instead? I think the Yandex one slips through because CORS does a naive check against just what's in the header, not what it resolves to?
- dwaite 1y agoThere's effort to define standard behavior here. See https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/ (although I suspect this document may make a significant shift soon)
- chedabob 1y agoDoes the Yandex HTTPS one mean they're shipping the private key for their cert in the app, therefore anything running on localhost (or on a network with poisoned DNS) can spoof the yandexmetrica site? There is a cert for it in the logs: https://crt.sh/?q=yandexmetrica.com https://crt.sh/?q=yandexmetrica.com
- will4274 1y agoYup definitely. Edit: the diagram makes it perfectly clear https://yandexmetrica.com:30103/p https://yandexmetrica.com:30103/p?... It even looks like some of the certs were issued by Yandex to Yandex. I guess their cert division will end up writing an incident report for this.
- NoahZuniga 1y agoYes, but presumably they aren't hosting anything on yandexmetrica.com, so any attackeright as wel register yandexmetrica.net and get an ssl cert for that. These sites both have the same potential for abuse.
- worik 1y agoThis is yet another reason for installing very few apps
- ethbr1 1y agoThe reason to install very few mobile apps is directly proportional to the effort companies exert to get you to do so. And they push REALLY hard.
- akimbostrawman 1y agoThe issue isn't the amount of apps but that they are from big tech store and closed source which for 99% of apps means they will spy for profit. You can install all of f-droid.org apps and not a single one will do that.
- neilv 1y agoOf course the ID was easy to abuse, and I assume Google knew this, and also knew they'd need to have rules against abuse... and that they'd need to back up the rules with penalties, like Play Store permaban, legal action for damages, and maybe even referral for criminal investigation (CFAA violation?). Unfortunately, even if they did have such rules, in this case, Meta is a too-big-to-deplatform tech company. (Also, even if it wasn't Meta, sketchy behavior of tech might have the secret endorsement of IC and/or LE. So, making the sketchiness stop could be difficult, and also difficult to talk about.)
- ogurechny 1y agoGoogle and Apple are owning their whole operating systems. They can do tracking directly in 50 different ways. Other corporations routinely renegotiate deals on sharing the user surveillance data with them, for big big money. So it all has already been paid for, and authorised. The only problem is that some stupid serfs are still making a fuss over it.
- tomhow 1y agoWe changed the URL from https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/ https://arstechnica.com/security/2025/06/meta-and-yandex-are... which is a report about this disclosure.
- johannes1234321 1y agoIs there any reason for "normal" applications (not when people use a phone as a web server on purpose etc.) to listen to incoming connections? To me seems like something which should be blocked behind those well hidden developer options or similar and nothing an app can easily do.
- ugh123 1y agoNo doubt, whatever "vulnerability" is found, you have already to agreed to it in some buried TOS.
- 1vuio0pswjnm7 1y agoFirefox about:config toggle media.peerconnection.enabled from true to false Further, Netguard plus Nebulo in non-VPN mode can stop unwanted connections to Meta servers
- mmwelt 1y agoDoes about:config work on Firefox Android?
- 1vuio0pswjnm7 1y agoIt works on Fennec from F-Droid. What are some reasons to use Firefox Android instead of Firefox Nightly. The later is availlable from Aurora Store. IME, Nightly has better add-on support. For example, uMatrix works.
- FroggyJr 1y ago[dead]
- hereme888 1y agoFacebook is stealing people's data? No way. I hope a judge gives them a warning.
- ggeorgovassilis 1y agoI'm using RethinkDNS as a combined firewall and wireguard VPN. I added these two block rules: 127.0.0.0/8 ::1/128 I'll update here with any issues.
- tomhow 1y agoAlso: Meta pauses mobile port tracking tech on Android after researchers cry foul - https://news.ycombinator.com/item?id=44175940 https://news.ycombinator.com/item?id=44175940 - June 2025 (26 comments)
- red_admiral 1y agoSounds like loading from the domains serving the meta pixel should be blockable in the first place.
- Yizahi 1y agoAnd with all that tracking and spying on me, plus a boatload of voluntarily submitted data, and Facebook still can't/won't show me any relevant advertising. I mean, even from the corpo point of view. Whenever I open my feed to read something, I see a boatload of complete garbage ads. Like, they are neither enticing to me nor they are promoting something corpos may want to shove in my fae so I would remember, like some Coca-Cola or whatever product. But no, they have nothing. I've just opened my feed in FB and let's see what ads will be today: Group Dull Men's Club - some garbage meme dump, neither interesting nor selling any product or service. Women emigrant group - I'm a male and in different location. Rundown - some NN generated slop about NN industry Car crash meme group from a different location. Math picture meme group LOTR meme group Photo group with a theme I'm not interested Repeat of the above Another meme group Roland-Garros page - I've never watched tennis or wrote about it. My profile has follows of a different sport pages altogether. None of those rise in the ads. Another fact/meme group Repeat Repeat Another fact/meme group Expat group from incorrect location And so on it goes. Like, who pays for all this junk? Who coordinates targeting? Why do they waste both their and mine capacity for something that useless both for me and Facebook? I would understood if FB had ads of products/services, or something that loosely follows by likes. But what they have is a total 100% miss. It's mindboggling.
- lozenge 1y agoI guess the meme group ads are to draw you in, once you follow them they get to push you actual ads and it costs them less because Facebook doesn't charge them, thinking you want to see the group's posts. It must work to some extent.
- octo888 1y agoI'm incredibly glad this isn't occurring in the UK + EU, because GDPR and the huge fines levied against Meta in the past have scared them sufficiently into not doing this kind of behaviour.
- b0a04gl 1y agowebrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost. the fact that a browser sandbox still leaks this info is wild. like, you’re telling me port 43800 says more about me than a cookie ever could? and of course, this all runs under the radar—no prompt, no opt-in, just “oh hey, we’re just scanning your machine real quick.” insane. might as well call it metascan™. kinda makes me nostalgic for simpler times—when tracking meant throwing 200 trackers into a <script> tag and hoping one stuck. now it’s full-on black ops. i swear, i’m two updates away from running every browser in a docker container inside a faraday cage.
- Vinnl 1y agoWell, primarily it's the other apps that are saying a lot about you. I think this story emphasises yet again that websites are better for your privacy than apps. (Especially in a browser that has e.g. uBlock Origin, such as Firefox for Android.)
- spencerflem 1y agoThe person working on Arcan runs the browser on a separate machine via Remote Desktop with it set to wipe and re-image itself between sessions.
- b0a04gl 1y agocrazy
- spencerflem 1y agoYes but I kinda love it. Perfectly safe from any future Rowhammer type exploit.
- owebmaster 1y ago> webrtc was supposed to be for real-time comms, not fingerprinting people based on what random apps they have running on localhost Native Apps are doing that, not webrtc. Just prove the web is safer and all that BS about native apps being better is, well, BS.
- never_inline 1y agoIt actually bothers me it took so long to be discovered.
- jedahan 1y agoI love how the engineers and product managers who implemented this are not held responsible in any meaningful way.
- time4tea 1y agoIf you work for meta, you're on the baddies team. (Other bad guys are around too)
- deleted 1y ago[deleted]
- diebeforei485 1y agoIf a webpage wants to use WebRTC, the browser should pop up a thing saying this website wants to start a phone call, asking whether the user wants to enable microphone, camera, or both. That would not be an issue for genuine uses of WebRTC.