9 ms·

"Localhost tracking" explained. It could cost Meta €32B

598 points by donohoe 1y ago

ajsnigrutin 1y ago
My prediction, facebook gets fined something like ~12 million euros, eu bureaucrats shake their hands, facebook finds a different way to do the same thing. Definitely not even close to 32B
- ceejayoz 1y ago
  The EU doesn’t play around in this realm. 1.2 billion fine for an earlier incident: https://www.edpb.europa.eu/news/news/2023/12-billion-euro-fine-facebook-result-edpb-binding-decision_en https://www.edpb.europa.eu/news/news/2023/12-billion-euro-fi...
  - ryukoposting 1y ago
    1.2B is less than 1% of Meta's revenue in FY2024. Maximum fines for infractions like these should exist on a sliding scale, as some percentage of prior revenue.
    - gloxkiqcza 1y ago
      The point was it’s two orders of magnitude more than the original comment stated. Also 1% of yearly revenue is not insignificant.
      - efilife 1y ago
        How is it not? Will anyone actually feel this fine?
        gloxkiqcza 1y ago
        YoY percentages are usually presented with one decimal place of precision. This makes the number drop by one whole percentage point. It impacts net profit margin and profit numbers even more. Literally everyone up to the C level executives, board of directors and shareholders will notice and care about this. The missing money could have been invested into making more money in the future or payed out as dividends. Instead it’s gone. This also means all employees feel this because it affects the prospects of their raises, management pressure and in the end whether they get to keep their job or not. (I’m not saying the recent layoffs were caused by this but it sure as hell didn’t help.) Every single penny matters to a capitalist corporation and this was not pennies.
    - birn559 1y ago
      Something that you can sensibly express as a fraction of the revenue of Meta is significant though. It must be low enough that Meta never seriously considers to pull out of Europe.
      - ajsnigrutin 1y ago
        > It must be low enough that Meta never seriously considers to pull out of Europe. Why? Threathening is one thing, actually leaving one of the largest markets is something different. Also, not much of value would be lost. > Something that you can sensibly express as a fraction of the revenue of Meta is significant though. Also, if the percentage is low, it just becomes the "cost of doing business" and not a fine that would actually make them rethink and not do stuff like that again.
      - fzuck686 1y ago
        [dead]
      - okanat 1y ago
        Why do you think Zuck became a wannabe fascho out of nowhere? DMA and GDPR fines will hurt Meta a lot when they are due. Zuck is trying to leverage Trump and the war to nullify the fines.
    - brookst 1y ago
      Probably best indexed to profit rather than revenue. 10% of revenue would be a one quarter’s profit for meta, but more than a year’s profit for Amazon and about 9 years of profit for Otto. Higher margins / profits should mean higher fines.
      - disgruntledphd2 1y ago
        The laws specify revenue, to avoid transfer pricing removing all fineable profits. Live by the sword, die by the sword I guess.
        brookst 1y ago
        This isn’t live/die/sword. This is “low margin companies held to a higher standard than high margins companies”. It hurts Otto a lot more to lose 9 years of profit than it hurts Amazon to lose one quarter.
        disgruntledphd2 1y ago
        If there hadn't been such transfer pricing shenanigans, then the laws would have been written on profit. Because there's little to no profit shown in many entities in the EU, the laws were written on revenue. More generally, the whole point of getting absurdly large (and such to be covered by DMA etc) is precisely to extract more monopoly profits. GDPR is different, in that one can easily imagine a low margin company getting hurt by this, but in that case they should invest in compliance, rather like these (mostly US) companies do for US laws.
      - account42 1y ago
        Profit doesn't include employee and especially executive compensation, i.e. what the perpetrators were paid.
        brookst 1y ago
        Sure. But it’s what shareholders care about. Who are you trying to punish financially if not the shareholders?
    - rsynnott 1y ago
      They actually do; max GDPR penalty is 4% global revenue, say. Of course the concern would be that even at that rate some companies might see it as a cost of doing business.
      - ryukoposting 1y ago
        I'd be inclined to go with something closer to 40%, or 400%.
  - Ray20 1y ago
    [flagged]
    - bendigedig 1y ago
      > Meta has suffered zero liability in the EU. I guess because Zuc gives money to transgenders or something. I'm sorry, but are you a real person?
sidcool 1y ago
This is quite an interesting read. But if Android does not allow listening to local host ports, how did meta achieve it?
- graftak 1y ago
  It’s allowed over RTC
ricardbejarano 1y ago
This is equal parts ingenious and dishonest.
Waterluvian 1y ago
Every story like this has me thinking about two things: 1. Companies have no soul. They are, by design, just chasing revenue. Everything else is just a risk to be factored. 2. There are real humans at these companies who choose to take part in the business and design and engineering, etc. I don’t think these humans have no soul (though some won’t), and I don’t think they’re stupid (though some are). I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to.
- jameskilton 1y ago
  Never underestimate the evil a human can perpetuate in the name of a paycheck.
  - bsenftner 1y ago
    If that paycheck comes from religion, that salaryman will willfully incorporate evil into their everyday behavior, thinking they are doing evil for gawd. We've got a civilization of short sighted idiots.
- genocidicbunny 1y ago
  > I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to. Which is why I don't think punishing just the company itself is enough. The engineers, designers, PM's that implemented this should also receive punishment, sufficient enough to make anyone thinking of participating in the implementation of such systems has reason enough to feel sick, if only for their own skin. Make it clear that participating in such things carries the risk of losing your career, a lot of money, and potentially even your freedom.
  - DrScientist 1y ago
    I'd argue that the person running the company in this case is responsible. Now they may argue that they didn't know - but you can frame the law such that's it's their duty to know and ensure this sort of stuff doesn't happen. cf Sarbanes-Oxley
lom 1y ago
How long can Instagram keep the local port open before Android will kill it to save battery?
davedx 1y ago
This is an incredibly scummy and devious implementation of user tracking. I think META shareholders should hold onto their hats with this one. @dang maybe add a $ to the 32B? I see B so often with AI Models that I think the currency symbol would be useful in this link title
- geerlingguy 1y ago
  Ditto on the 32B, especially since that's IIRC one of the llama model sizes!
- ranguna 1y ago
  It's 32B€
deleted 1y ago
[deleted]
jmyeet 1y ago
I'm reminded of zombie cookies [1]. This was 15+ years ago now but Verizon (and others?) used Flash (because browsers still shipped with support for that in the 2000s) to create an undeletable cookie. This was settled for low 7 figures. Privacy legislation has advanced a lot since then and the EU doesn't play around with GDPR violations, particularly when it's so egregious. I don't expect a $32B fine or settlement but it won't surprise me if this costs Meta $1B+. [1]: https://www.propublica.org/article/verizon-to-pay-1.35-million-to-settle-zombie-cookie-privacy-charges https://www.propublica.org/article/verizon-to-pay-1.35-milli...
greenchair 1y ago
This is one of the big reasons big tech wants h1bs -> for their shady/illegal/immoral projects.
geerlingguy 1y ago
Sounds like you're affected if you have either Facebook or Instagram app installed on an Android phone, you're signed into your account, and you don't have anything set up to block tracking pixels and the like (though that last part I'm not as sure of). Getting through VPNs and incognito mode are the most egregious parts of this offense, though. I think some people are under the impression that's a way to act like you're in total privacy... but it's not. It's just an easy way to act like you're in a new browser session or coming from another location, mostly.
- joshstrange 1y ago
  > I think some people are under the impression that's a way to act like you're in total privacy... but it's not. It should be for the average person. VPN and private browsing should be enough for what most people use it for. I don’t think it’s fair to expect people to think that the browser is secretly communicating with apps on their phone, tying all behavior to their identity.
  - aspenmayer 1y ago
    > I don’t think it’s fair to expect people to think that the browser is secretly communicating with apps on their phone, tying all behavior to their identity. If it was possible for this to happen in the past, we have reason to believe that the technical capability to link behavior with identity still exists. What’s “unfair” about informing others about the limitations and risks of using a device online?
  - SoftTalker 1y ago
    I mean, I think that Google (or Apple) have full visiblity to everything on my Android (or iPhone). Why wouldn't they? Just because they say they don't?
- kccqzy 1y ago
  And if you actually leave the Facebook or instagram apps running in the background. Some people hate apps running in the background and they terminate all apps as soon as they are done using them.
ranguna 1y ago
Tldr because this article has way too much fillers to my taste (but I'm sure there are people out there that enjoy reading that kind of thing): The native Instagram and meta apps start a server listening on predefined ports when you launch said apps, they eventually run on the background as well. When you are on your browser, whether in private more, not logged, refused or disabled cookies, or anything else that might make you feel like you are not being explicitly tracked, the browser will connect to the locally running servers through webrtc and send all tracking data to said servers from the browser. The android sandboxing thing is basically about how Android isolates each app and should only allow communication through android intents that inform the user of such inter app communication, such as sharing photos and the like. In this case, the browser is communicating with Instagram and Facebook apps without letting the user know. The legal infregement here is that this happens even when you refuse to be tracked, which is a violation of GDPR and another law mentioned in the article. The 32B figure is a theoretical maximum (but they also mentioned 100B+ in the article, which confuses me).
- naniwaduni 1y ago
  The technical details roughly boil down to "your browser lets internet sites talk to local services"; in this case if they cooperate they can identify each other, but cf. https://mrbruh.com/asusdriverhub/ https://mrbruh.com/asusdriverhub/ In practical terms this is a privacy leak a couple bits more informative but slightly less robust than "these requests are coming from the same IP address."
- bsimpson 1y ago
  And according to the article, they're using RTC because Android is meant to be hardened against backdooring localhost, but Meta found a loophole that allowed it if over RTC.
- theginger 1y ago
  Does anyone know how long was this going on, are we talking weeks, months or years?
throwawayffffas 1y ago
So I am seeing two issues here. 1. Android allows apps to open ports without permissions. And apps to communicate with each other without permissions. 2. The browsers allow random domains to access services on the localhost. Without notifying the user. We have seen vulnerabilities in the past accessing dev services running on localhost. Something should be done there.
- WhyNotHugo 1y ago
  I'd split that first list into two: 1a. Arbitrary apps can listen on ports without permissions. 1b. Arbitrary apps can access local ports without permissions. I've recently been experimenting with running the browser (on my desktop) in a network namespace precisely because of these reasons. Random websites shouldn't be able to access services running on localhost.
  - throwawayffffas 1y ago
    > I've recently been experimenting with running the browser (on my desktop) in a network namespace precisely because of these reasons. Let me introduce you to https://www.qubes-os.org/ https://www.qubes-os.org/.
    - alchemist1e9 1y ago
      For the ultra paranoid is there anything that can do this on a smartphone?
      - const_cast 1y ago
        I believe GrapheneOS has true sandboxing.
      - WhyNotHugo 1y ago
        Nothing out of the box, but you can run VMs in a similar fashion (eg: qemu).
  - mzajc 1y ago
frenchmajesty 1y ago
Very impressive but not surprising coming from Meta. They have an history of doing this kind of things. Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets. At this point, I think the race for Zuckerberg is, can Meta survive long enough for the next platform shift (AR or VR) where they will own one of the major platforms and won't need to abide by any reasonable rules before their "internet tentacles" that sustain the Ad Machine are cut off. My bet is they will make it. Though I don't wish it, they're on track.
- joshstrange 1y ago
  > Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent. Unlike this case, it required users to jump through a number of hoops/scary iOS warnings. Many still did, for a gift card or less.
  - disgruntledphd2 1y ago
    > Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets. Incorrect. An Israeli startup (Onavo) had pivoted into selling data acquired from their VPN got acquired by Facebook. Importantly, they used statistics to estimate population prevalence which is how FB knew that Whatsapp (specifically, this was all post IG acquisition) was super popular outside the US. > They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent. This was (sadly) an entirely different scandal. Honestly, I generally defend Meta/targeted advertising in these threads, but this one is such incredible, total, absolute bullshit that I can't even begin to comprehend how one could defend this. I do remember when I joined FB in 2013, how surprised I was that most of the company didn't care about ads/making money (apart from the sales org). That ship has clearly sailed.
throwawayffffas 1y ago
What about the whatsapp app?
- bsimpson 1y ago
  ...and FB Messenger
- throwawayffffas 1y ago
  I did a quick check with adb, it looks like whatsapp is not opening any ports.
fidotron 1y ago
The same European intellegentsia that is progressively forcing Apple to tear down the walled garden simultaneously fails to understand that this is exactly why they had it in the first place: > You’re not affected if (and only if) . . . > You browse on desktop computers or use iOS (iPhones) At the very least they should step back and allow companies to enforce safeguards because they clearly lack the understanding or foresight to do so effectively. The simple way for the EU to beat Meta is to stop being so cheap: break the WhatsApp dependency by actually paying properly for something that has a decent UX and doesn't track you. If you aren't willing to do this you will be exploited over and over again. TANSTAAFL
- brookst 1y ago
  It is kind of funny that EU may well require these kinds of vulns to be present, while reacting with outrage when used.
- LinAGKar 1y ago
  Is there anything in those EU directives that requires browsers to let webpages connect to localhost? Because that's the main issue here. And also maybe apps should need permission to listen on ports or connect to localhost, but I doubt the regulation prevents that either. On https://localmess.github.io/ https://localmess.github.io/, they think that this is technically possible on iOS too, and the main reason it wasn't done there is due to restrictions on apps running in the background. This is nothing new that has been opened up because of those regulations.
Thorrez 1y ago
>You’re not affected if (and only if) ... >You always used the Brave browser or the DuckDuckGo search engine on mobile How does choice of search engine protect from this?
- yegg 1y ago
  I think they meant our browser.
- joshstrange 1y ago
  > How does choice of search engine protect from this? I don’t use android or either of those browsers but my guess is that either block the tracking pixel from loading in the first place or they’re more locked down on what they allow websites to reach out to (aka no Localhost access).
  - Thorrez 1y ago
    I'm not asking about browsers, I'm asking about a search engine. How could a search engine block a tracking pixel? You click a link in the search engine and go to a website. The search engine can't control the website after you go there, can it?
    - joshstrange 1y ago
      DuckDuckGo and Brave have browsers on Android
      - mvdtnz 1y ago
        Are you being intentionally obtuse? Read the quote again, >You’re not affected if (and only if) ... >You always used the Brave browser or the DuckDuckGo search engine on mobile
      - Thorrez 1y ago
        The article says search engine, not browser.
wewewedxfgdf 1y ago
Makes me think of the Simpson's episode where Bart gets away with anything by saying "I'm sorry", and looking contrite.
JimDabell 1y ago
Previous discussion: Covert web-to-app tracking via localhost on Android (341 comments): https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115
- 1vuio0pswjnm7 1y ago
  NB. Comment totals may still be increasing as discussion continues Washington Post's Privacy Tip: Stop Using Chrome, Delete Meta Apps (and Yandex) (328 comments) https://news.ycombinator.com/item?id=44210689 https://news.ycombinator.com/item?id=44210689 Meta found 'covertly tracking' Android users through Instagram and Facebook (95 comments) https://news.ycombinator.com/item?id=44182204 https://news.ycombinator.com/item?id=44182204 Meta pauses mobile port tracking tech on Android after researchers cry foul (28 comments) https://news.ycombinator.com/item?id=44175940 https://news.ycombinator.com/item?id=44175940 Covert web-to-app tracking via localhost on Android (6 comments) https://news.ycombinator.com/item?id=44169314 https://news.ycombinator.com/item?id=44169314 Covert Web-to-App Tracking via Localhost on Android (6 comments) https://news.ycombinator.com/item?id=44169314 https://news.ycombinator.com/item?id=44169314 Meta and Yandex Spying on Your Android Web Browsing Activity https://news.ycombinator.com/item?id=44177637 https://news.ycombinator.com/item?id=44177637 New research highlights privacy abuse involving Meta and Yandex https://news.ycombinator.com/item?id=44171535 https://news.ycombinator.com/item?id=44171535 Meta and Yandex exfiltrating tracking data on Android via WebRTC (3 comments) https://news.ycombinator.com/item?id=44176697 https://news.ycombinator.com/item?id=44176697
hurtuvac78 1y ago
This story got kicked out of front page quite suddenly, not sure how/why. Lots of points and comments.
- N-Krause 1y ago
  Yeah, would be interested to know why exactly EDIT: Ok probably because it basically is a repost. I just haven't seen it 6 days ago.
  - ChrisMarshallNY 1y ago
    Lots of second posts stick around for a long time. I have seen that if a company is called out by name, in an inflammatory manner, the posts tend to drop out quickly. Sometimes, they come back. Conspiracy theorists say that only happens with YC-backed companies, but that may be selection bias. I have seen stories that call out a number of companies, disappear quickly. It's hard to say if that's OK or not. I think some of these stories are really nothing more than "hit pieces," but some of them are really on the money.
jmward01 1y ago
I'm just confused why Meta needed to do this. Isn't fingerprinting good enough to not risk building this? All I can think is they use something like this to prove out their other tracking tech is working (this is the test set effectively). It is obvious that they really have several of these types of tracking technologies so that if one gets found out/patched they can switch it off and say 'look we stopped' all while still tracking with impunity. It just seems dumb that they would keep something this blatant in use.
- SoftTalker 1y ago
  Sociopathic people are running the company. You tell them they can't do something, they take it as a challenge and try to do it without getting caught.
- jaks6 1y ago
  This provides them an easy way to build a labelled dataset for training the fingerprinting ML models.
sudahtigabulan 1y ago
Can this be avoided by running any Meta apps in Work Profile, and the browser in Main Profile?
pupppet 1y ago
Once again those of us in NA have to leave it to the European government to look out for us.
- ghthor 1y ago
  I mean, we can assume they are doing something bad and not install their software.
- icedchai 1y ago
  Yes, I just love all those cookie banners. Thanks!
teleforce 1y ago
"If you're not paying for the product, you are the product" - anonymous. Why is this very news is not in the HN front page for considerable amount of time is beyond me. It has the right recipe for top HN post namely users deception, sandbox bypass, privacy or lack thereof, web browser, Meta, etc.
- eviks 1y ago
  "If you're paying, you're still the product", so apparently other factors anon didn't mention are involved
  - noisy_boy 1y ago
    "They will never stop trying/making you the product, until people trying/doing so go to jail".
_wire_ 1y ago
You've rented a device that connects to a worldwide communications network built on a principle of numerically exact message routing between every device and use it to run numerically exact programs from service providers to access services that host and consolidate the particulars of your identity within their servers rather than your device, and you are amazed that the device can persistently track everything you do with the device? What's the point of being Google or Apple except for precisely control of such central services?... ♪ Central Services, we do the work, you do the pleasure... ♪ "Have you considered your ducts?" ...And it just so happens that all the news you see is from the device and subject to this surveillance used to colonize your mind... Sounds democratic! The old Politburo could only dream of such tools for maintenance of a compliant, obedient proletariat. And with Central Services new "AI" you can get a brain implant to ensure your perfect conformity and access to the best paying jobs in the world, yours and your family's future will be secure. Be sure to invest in these securities, shop here, entertain and vacation there— leave the driving to us! Do it your way. "A new life awaits you in the Offworld Colonies. A chance to begin again in a golden land of opportunity and adventure. So c'mon America..." "...Every leap of civilization was built off the back of a disposable work force..."
jasonthorsness 1y ago
"The Meta Pixel script sends the _fbp cookie to the native Instagram or Facebook app via WebRTC (STUN) SDP Munging." Crazy to deploy a hack like this at the scale of Meta.
- jobs_throwaway 1y ago
  yeah...how does this get approved?
  - strix_varius 1y ago
    "approved?" In a company where ads are the lifeblood and where the targeting specificity of ads determines their value, whichever engineers put this together are guaranteed to have gotten fantastic promo packets.
- raxxorraxor 1y ago
  Shouldn't a sensible CORS policy by the webserver block these access attempts? Of course the website owner wants the tracking, but I think they should also be a guilty party here next to Facebook, even if they just bought the service.
ls-a 1y ago
What's funny is that the engineers who implemented this are probably one of us here on HN. I don't think Zuck implemented this himself
- hbossy 1y ago
  That's what they need AI for. It won't say no.
  - aunetx 1y ago
    The engineers did not say no either though.
    - hkt 1y ago
      They're hoping that in the long run AI won't say no and will be cheaper
    - steve_adams_86 1y ago
      My experience is that most won’t. I was someone who wouldn’t say no, once. For me it was because I was naive and didn’t believe people would work so hard to exploit others. In fact, one time there were users on an ad network I built who were breaking rules. I’d track them and try to figure out where they came from and who they actually are, only for them to drop out and open a new account. I’d report to my CEO about this, ask for advice, generally discuss strategies to prevent this kind of usage of the network. He seemed very concerned. But sure enough, eventually I figured out it was actually him all along. He was making tens of thousands of dollars in revenue per month doing literally the most shady stuff on the network. He was using my naivety to keep himself in the loop on internal compliance and stay a step ahead of me. I’ve worked with several people like this. They love the tech industry. I had to finally admit to myself that I worked with bad people and did bad things to develop the awareness and courage to start saying no and do something else. Once I was gone, he did the same thing with a younger developer who was eager to break into the industry. I actually work with him now, nearly 15 years later.
- ryandrake 1y ago
ATechGuy 1y ago
If it does not cost them everything, they will not stop.
udev4096 1y ago
This is one of the reason you need to segregate your whole LAN. At the bare minimum, use VLANs to knock off these ruthless scanners. And obviously, this wouldn't be possible if you used a strong adblock list on whatever DNS you're running. They cannot touch the people who take proper measures. I also do not believe people who use Facebook really care about privacy. I am well aware of how mean this sounds but they fully deserve to be tracked
- janalsncm 1y ago
  > they fully deserve to be tracked Absolutely not. The law is still the law. The fact that Meta is able to break the law via technical means doesn’t mean victims deserve to be victimized. Just because someone is able to pick your lock at night doesn’t mean you deserve to be burglarized.
  - udev4096 1y ago
    Get a better lock. If you don't care enough to not get lock picked, whose fault is it? The bar to avoid this form of tracking is not high at all. It's trivial for anyone who is willing to put some serious efforts in defending their privacy
    - comrh 1y ago
      You live in a tech bubble if you think it's trivial when most people don't even know what localhost is.
    - finnh 1y ago
      "trivial ... serious efforts" which is it? you contradict yourself in a single sentence.
    - oceansky 1y ago
      Absolutely no lock will prevent a sufficiently motivated thief. And the bar is high for the average person, who isn't much tech savvy at all.
    - 1y ago
deleted 1y ago
[deleted]
aorth 1y ago
Remember in 2014 when the Android Twitter app started sending a list of all your installed applications back to Twitter? https://news.bloomberglaw.com/privacy-and-data-security/twitter-starting-to-track-list-of-users-apps-on-mobile-devices https://news.bloomberglaw.com/privacy-and-data-security/twit... Ever since then I refused to install native versions of apps that could be used in a browser. I don't use Facebook or Instagram so I don't know if that works anymore, and I recall testing that they were intentionally crippling Facebook Messenger at one point. Then the past decade of native apps requesting tons of permissions and users just clicking agree. Why should Facebook be able to read my Wi-Fi network or Bluetooth? Of course there is something shady going on. Beacons tracking people walking around brick and mortar stores. https://en.wikipedia.org/wiki/Facebook_Bluetooth_Beacon https://en.wikipedia.org/wiki/Facebook_Bluetooth_Beacon Such a shame because native apps are so much more pleasant and performant to use than web apps.
- dcminter 1y ago
  > they were intentionally crippling Facebook Messenger at one point [in a browser] They were/did. I was using Messenger Lite for a bit which was ok, but they killed that and the mobile browser mode. I still need FB for some events and contacts, but I refuse to have the fat messenger app installed so now I end up using the damn thing in desktop mode which is ... painful. All I seem to see in my feed these days is "suggested for you" so it's a lot less addictive than it was back in the day. Not sure why they're so determined to drive the user base away, but that does seem to be the plan.
- gausswho 1y ago
  I felt a prude at the time but eschewed native apps for browser versions and haven't regretted. Didn't benefit from notification distraction anyway. Apple and Google just didn't get their houses in order to be taken seriously. If it ain't on F-Droid, I'll wait.
  - boneitis 1y ago
    There is another can of worms hidden in plain sight right here, I feel like. From the article: You’re not affected if (and only if) You access Facebook and Instagram via the web, without having the apps installed on your phone This is only what's observably true of a particular app under the hood from straightforwardly jacking into it with Frida or performing any other deeper analysis. What's to say Meta/Google/OtherAnalyticsCorp/OtherMegaCorp hasn't already, on a large scale, colluded with[bought out] app developers to simply share session data out-of-band as another tentacle? Rather, is it even reasonable to assume they all haven't been doing this all this time? (Maybe these also fall squarely under what GDPR, DSA, and DMA were supposed to mitigate? I'm not an expert here.. just my cynicism kicking in.) I too go through fairly great pains to try to minimize unneeded apps on my device.
iamleppert 1y ago
The real flaw here is in WebRTC. WebRTC should be disabled by default, and behind a permissions dialog at least. Still, facebook could just disable chat or some feature and claim they need WebRTC and 99% of users would opt-in to it.
OptionOfT 1y ago
Reading though this, is it correct to say that they could've done a fetch("http://localhost:<port>/id=<id> http://localhost:<port>/id=<id>"), but then it would show up very conspicuously in the logs, and you couldn't talk to UDP ports with it?
- brazzy 1y ago
  I read this: > Android has many flaws, but in the relevant part here, it’s specifically designed to prevent apps from doing this — from listening to local ports like localhost. to mean that they could not do it via HTTP, and instead had to circumvent Android's privacy measures via WebRTC.
fifilura 1y ago
If this fine is collected. Will I get the money? Serious question. I don't generally mind paying taxes and all that. But in this case I feel I am the person offended and I should get some kind of compensation. I'd say €1-2000 would make me feel somewhat compensated.
- BlarfMcFlarf 1y ago
  Theoretically, fines replace tax revenue, so you get compensated by lower taxes. (Practically, spending and income are decoupled and taxes are mostly just an inflation management strategy.)
  - fifilura 1y ago
    I can understand it of course. But in this case I feel personally offended. I would like to see the money handed to me.
    - remram 1y ago
      If most people in your country use Meta apps, whether it's a tax discount spread across the population or a payout spread across the userbase doesn't make a difference. Personally I would like to see some execs go to prison, rather than taxing/fining a monopolistic corporation, which achieves nothing.
      - fifilura 1y ago
        You don't have to explain taxes to me, it is a concept that is pretty easy to grasp, and - even though I understood it already - the grandparent post also explained it . And I touched the subject in my original post. I guess what I am looking for is some kind of personal apology. And that could be manifested in a refund to mu bank account. As I explained above. I don't think sending people to prison helps much. A personal check would open the eyes for a lot of people and make them realize that this company committed a crime. Against you. And you are worth it.
- saintfire 1y ago
globalise83 1y ago
This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.
- ribosometronome 1y ago
  How would the EU fine American engineers who live and are paid in America?
  - joelfried 1y ago
    They would fine them by having a court case and saying they are guilty and owe money. Collecting on it would be awfully difficult, but you know, people do like trips to Europe. That said, I think fining the company seems pretty plausible. They won't, but it'd be nice if they did.
  - acatnamedjoe 1y ago
    Can't America fine them? Surely this is illegal there too?
    - pesus 1y ago
      There is probably little to no chance of that happening in the current political climate.
      - markus92 1y ago
        I can see the California or maybe even Texas AG go after them, wouldn’t be the first time.
  - okanat 1y ago
    Well some of them definitely has savings in Europe and like to travel destinations in Europe.
tdiff 1y ago
What I don't get: - How come Yandex was doing it for years without being noticed. - Facebook must have known about this technique for years as well, why did they only enable it last year.
- kgwxd 1y ago
  They knew who was going to be president this year.
  - bloppe 1y ago
    The American president doesn't really matter in this case. The EU is where they're going to get destroyed.
    - afavour 1y ago
      It’s quite possible that a different administration would punish FB for this. The current president being who he is, is the reason it doesn’t matter.
camillomiller 1y ago
The craziest part is that they are not liable of anything apparently under the basically non existent American privacy laws.
riddley 1y ago
I'm guessing I'll get down-voted for this, but what's to stop any browser/executable from trolling through /proc on Linux and knowing about what every process running as you is doing?
- deleted 1y ago
  [deleted]
- hollerith 1y ago
  File mode bits prevent processes not running as root from reading much of the info in /proc.
  - mbreese 1y ago
    I don’t know… with a stock Linux, the information a user can get from top (via /proc, I assume), is pretty thorough. You can at least get a list of running programs, which by itself could be valuable.
    - hollerith 1y ago
      Good point. I withdraw my comment.
- const_cast 1y ago
  Nothing really. Desktop operating systems are basically grandfathered into the modern world. They have the old timey approach to application security. That being, applications can access everything on your computer, and there's no fine-grained permission systems. But, for OS that we've developed later, we kind of decided that's a problem, and applications are a vector for malware, and "trust" just isn't enough. So Android and iOS did the whole permissions thing. Now, we've gone back and added some stuff onto desktop operating systems. Of course Linux has containers these days on desktop. Like, I'm running Firefox right now - but Firefox can only access it's runtime folders and ~/Downloads. So, if there's a zero day sandbox breach, I won't get data stolen. There's also SELinux and Apparmor and stuff and you can really jump into the deep end with this. But, we largely view it as unnecessary because we're running open-source software from trusted repositories. We probably shouldn't view it that way.
12_throw_away 1y ago
I guess we don't call it a "0-day" if it's multinational corporation doing the illegal data exfiltration ...
BobbyTables2 1y ago
They’re getting off cheaply!
jonahbenton 1y ago
What about Whatsapp?
1vuio0pswjnm7 1y ago
"Meta faces simultaneous liability under the following regulations, listed from least to most severe: GDPR, DSA, and DMA (I'm not even including the ePrivacy Directive because it's laughable)." Also not included: https://www.courtlistener.com/docket/70448987/1/rose-v-meta-platforms-inc/ https://www.courtlistener.com/docket/70448987/1/rose-v-meta-... The wiretapping claims carry damages of $5,000 per violation. It could be he thinks this is laughable like the ePrivacy Directive. https://www.reuters.com/technology/metas-facebook-pay-90-million-settle-privacy-lawsuit-over-user-tracking-2022-02-15/ https://www.reuters.com/technology/metas-facebook-pay-90-mil... https://dicellolevitt.com/case-study/facebook-agrees-to-pay-90-million-to-settle-decade-long-data-privacy-class-action-involving-facebooks-secret-internet-tracking/ https://dicellolevitt.com/case-study/facebook-agrees-to-pay-...
account42 1y ago
Theoretical maximum fines are cool at all but at what point will wanton disregard for the law result in actual prison time for the people involved?
eqvinox 1y ago
> 1. The user opens the native Facebook or Instagram app, […] I'm not going full "it's your own fault for having those apps installed" — it really isn't — but people need to learn they shouldn't trust apps made by these giant adzillas. (Which to be fair you could also argue for Android as a whole, and Chrome). If Facebook and Instagram are "dominating the market" as the EU likes to say, maybe it's time to force allowing 3rd party frontend apps?
- sdht0 1y ago
  > people need to learn they shouldn't trust apps made by these giant adzillas. I do wish life were that simple. Users (including myself) get value out of natively installed apps. Until that changes, this suggestion is impractical.
ornornor 1y ago
“They trust me. Dumb fucks.” —-Zuckerberg As relevant as ever. https://news.ycombinator.com/item?id=19966959 https://news.ycombinator.com/item?id=19966959
eqvinox 1y ago
Interesting view on Mastodon arguing this might even be a criminal act, not just civil liability: https://infosec.exchange/@isotopp/114664494157616670 https://infosec.exchange/@isotopp/114664494157616670 > What Meta did wasn’t just a violation of GDPR. It involved bypassing built-in technical protections with the intent to extract and link data — potentially personally identifiable information (PII) — to users without their knowledge or consent. > That is the textbook definition of unauthorized access and data exfiltration.
ncr100 1y ago
In 2014 / 2015 I was digging through the code of the iOS Facebook app and found that it was loading, by string name, a dylib. I think it was a system dylib for networking, or sound, or something. It seemed like the wrong way to access a system service. That seemed unnecessarily sneaky and made me appreciate the sense of righteousness which I would have, if I were a SW dev @ FB at the time, to add such a technique to a world-tier app like FB.
deleted 1y ago
[deleted]
zeristor 1y ago
So Facebook collects this, and sells it. Perhaps sanctions on those that buy and use the data would help?
anonbanker 1y ago
Oh, this is bigger than just Android. SDP munging can cause all sorts of havoc on desktop clients as well. Bit of a blind spot in WebRTC implementations.

598 points by donohoe 1y ago

My prediction, facebook gets fined something like ~12 million euros, eu bureaucrats shake their hands, facebook finds a different way to do the same thing. Definitely not even close to 32B

ceejayoz 1y ago
The EU doesn’t play around in this realm. 1.2 billion fine for an earlier incident: https://www.edpb.europa.eu/news/news/2023/12-billion-euro-fine-facebook-result-edpb-binding-decision_en https://www.edpb.europa.eu/news/news/2023/12-billion-euro-fi...
- ryukoposting 1y ago
  1.2B is less than 1% of Meta's revenue in FY2024. Maximum fines for infractions like these should exist on a sliding scale, as some percentage of prior revenue.
  - gloxkiqcza 1y ago
    The point was it’s two orders of magnitude more than the original comment stated. Also 1% of yearly revenue is not insignificant.
    - efilife 1y ago
      How is it not? Will anyone actually feel this fine?
      - gloxkiqcza 1y ago
        YoY percentages are usually presented with one decimal place of precision. This makes the number drop by one whole percentage point. It impacts net profit margin and profit numbers even more. Literally everyone up to the C level executives, board of directors and shareholders will notice and care about this. The missing money could have been invested into making more money in the future or payed out as dividends. Instead it’s gone. This also means all employees feel this because it affects the prospects of their raises, management pressure and in the end whether they get to keep their job or not. (I’m not saying the recent layoffs were caused by this but it sure as hell didn’t help.) Every single penny matters to a capitalist corporation and this was not pennies.
  - birn559 1y ago
    Something that you can sensibly express as a fraction of the revenue of Meta is significant though. It must be low enough that Meta never seriously considers to pull out of Europe.
    - ajsnigrutin 1y ago
      > It must be low enough that Meta never seriously considers to pull out of Europe. Why? Threathening is one thing, actually leaving one of the largest markets is something different. Also, not much of value would be lost. > Something that you can sensibly express as a fraction of the revenue of Meta is significant though. Also, if the percentage is low, it just becomes the "cost of doing business" and not a fine that would actually make them rethink and not do stuff like that again.
    - fzuck686 1y ago
      [dead]
    - okanat 1y ago
      Why do you think Zuck became a wannabe fascho out of nowhere? DMA and GDPR fines will hurt Meta a lot when they are due. Zuck is trying to leverage Trump and the war to nullify the fines.
  - brookst 1y ago
    Probably best indexed to profit rather than revenue. 10% of revenue would be a one quarter’s profit for meta, but more than a year’s profit for Amazon and about 9 years of profit for Otto. Higher margins / profits should mean higher fines.
    - disgruntledphd2 1y ago
      The laws specify revenue, to avoid transfer pricing removing all fineable profits. Live by the sword, die by the sword I guess.
      - brookst 1y ago
        This isn’t live/die/sword. This is “low margin companies held to a higher standard than high margins companies”. It hurts Otto a lot more to lose 9 years of profit than it hurts Amazon to lose one quarter.
        disgruntledphd2 1y ago
        If there hadn't been such transfer pricing shenanigans, then the laws would have been written on profit. Because there's little to no profit shown in many entities in the EU, the laws were written on revenue. More generally, the whole point of getting absurdly large (and such to be covered by DMA etc) is precisely to extract more monopoly profits. GDPR is different, in that one can easily imagine a low margin company getting hurt by this, but in that case they should invest in compliance, rather like these (mostly US) companies do for US laws.
    - account42 1y ago
      Profit doesn't include employee and especially executive compensation, i.e. what the perpetrators were paid.
      - brookst 1y ago
        Sure. But it’s what shareholders care about. Who are you trying to punish financially if not the shareholders?
  - rsynnott 1y ago
    They actually do; max GDPR penalty is 4% global revenue, say. Of course the concern would be that even at that rate some companies might see it as a cost of doing business.
    - ryukoposting 1y ago
      I'd be inclined to go with something closer to 40%, or 400%.
- Ray20 1y ago
  [flagged]
  - bendigedig 1y ago
    > Meta has suffered zero liability in the EU. I guess because Zuc gives money to transgenders or something. I'm sorry, but are you a real person?

sidcool 1y ago

This is quite an interesting read. But if Android does not allow listening to local host ports, how did meta achieve it?

graftak 1y ago
It’s allowed over RTC

ricardbejarano 1y ago

This is equal parts ingenious and dishonest.

Waterluvian 1y ago

Every story like this has me thinking about two things: 1. Companies have no soul. They are, by design, just chasing revenue. Everything else is just a risk to be factored. 2. There are real humans at these companies who choose to take part in the business and design and engineering, etc. I don’t think these humans have no soul (though some won’t), and I don’t think they’re stupid (though some are). I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to.

jameskilton 1y ago
Never underestimate the evil a human can perpetuate in the name of a paycheck.
- bsenftner 1y ago
  If that paycheck comes from religion, that salaryman will willfully incorporate evil into their everyday behavior, thinking they are doing evil for gawd. We've got a civilization of short sighted idiots.
genocidicbunny 1y ago
> I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to. Which is why I don't think punishing just the company itself is enough. The engineers, designers, PM's that implemented this should also receive punishment, sufficient enough to make anyone thinking of participating in the implementation of such systems has reason enough to feel sick, if only for their own skin. Make it clear that participating in such things carries the risk of losing your career, a lot of money, and potentially even your freedom.
- DrScientist 1y ago
  I'd argue that the person running the company in this case is responsible. Now they may argue that they didn't know - but you can frame the law such that's it's their duty to know and ensure this sort of stuff doesn't happen. cf Sarbanes-Oxley

lom 1y ago

How long can Instagram keep the local port open before Android will kill it to save battery?

davedx 1y ago

This is an incredibly scummy and devious implementation of user tracking. I think META shareholders should hold onto their hats with this one. @dang maybe add a $ to the 32B? I see B so often with AI Models that I think the currency symbol would be useful in this link title

geerlingguy 1y ago
Ditto on the 32B, especially since that's IIRC one of the llama model sizes!
ranguna 1y ago
It's 32B€

deleted 1y ago

[deleted]

jmyeet 1y ago

I'm reminded of zombie cookies [1]. This was 15+ years ago now but Verizon (and others?) used Flash (because browsers still shipped with support for that in the 2000s) to create an undeletable cookie. This was settled for low 7 figures. Privacy legislation has advanced a lot since then and the EU doesn't play around with GDPR violations, particularly when it's so egregious. I don't expect a $32B fine or settlement but it won't surprise me if this costs Meta $1B+. [1]: https://www.propublica.org/article/verizon-to-pay-1.35-million-to-settle-zombie-cookie-privacy-charges https://www.propublica.org/article/verizon-to-pay-1.35-milli...

greenchair 1y ago

This is one of the big reasons big tech wants h1bs -> for their shady/illegal/immoral projects.

geerlingguy 1y ago

Sounds like you're affected if you have either Facebook or Instagram app installed on an Android phone, you're signed into your account, and you don't have anything set up to block tracking pixels and the like (though that last part I'm not as sure of). Getting through VPNs and incognito mode are the most egregious parts of this offense, though. I think some people are under the impression that's a way to act like you're in total privacy... but it's not. It's just an easy way to act like you're in a new browser session or coming from another location, mostly.

joshstrange 1y ago
> I think some people are under the impression that's a way to act like you're in total privacy... but it's not. It should be for the average person. VPN and private browsing should be enough for what most people use it for. I don’t think it’s fair to expect people to think that the browser is secretly communicating with apps on their phone, tying all behavior to their identity.
- aspenmayer 1y ago
  > I don’t think it’s fair to expect people to think that the browser is secretly communicating with apps on their phone, tying all behavior to their identity. If it was possible for this to happen in the past, we have reason to believe that the technical capability to link behavior with identity still exists. What’s “unfair” about informing others about the limitations and risks of using a device online?
- SoftTalker 1y ago
  I mean, I think that Google (or Apple) have full visiblity to everything on my Android (or iPhone). Why wouldn't they? Just because they say they don't?
kccqzy 1y ago
And if you actually leave the Facebook or instagram apps running in the background. Some people hate apps running in the background and they terminate all apps as soon as they are done using them.

ranguna 1y ago

Tldr because this article has way too much fillers to my taste (but I'm sure there are people out there that enjoy reading that kind of thing): The native Instagram and meta apps start a server listening on predefined ports when you launch said apps, they eventually run on the background as well. When you are on your browser, whether in private more, not logged, refused or disabled cookies, or anything else that might make you feel like you are not being explicitly tracked, the browser will connect to the locally running servers through webrtc and send all tracking data to said servers from the browser. The android sandboxing thing is basically about how Android isolates each app and should only allow communication through android intents that inform the user of such inter app communication, such as sharing photos and the like. In this case, the browser is communicating with Instagram and Facebook apps without letting the user know. The legal infregement here is that this happens even when you refuse to be tracked, which is a violation of GDPR and another law mentioned in the article. The 32B figure is a theoretical maximum (but they also mentioned 100B+ in the article, which confuses me).

naniwaduni 1y ago
The technical details roughly boil down to "your browser lets internet sites talk to local services"; in this case if they cooperate they can identify each other, but cf. https://mrbruh.com/asusdriverhub/ https://mrbruh.com/asusdriverhub/ In practical terms this is a privacy leak a couple bits more informative but slightly less robust than "these requests are coming from the same IP address."
bsimpson 1y ago
And according to the article, they're using RTC because Android is meant to be hardened against backdooring localhost, but Meta found a loophole that allowed it if over RTC.
theginger 1y ago
Does anyone know how long was this going on, are we talking weeks, months or years?

throwawayffffas 1y ago

So I am seeing two issues here. 1. Android allows apps to open ports without permissions. And apps to communicate with each other without permissions. 2. The browsers allow random domains to access services on the localhost. Without notifying the user. We have seen vulnerabilities in the past accessing dev services running on localhost. Something should be done there.

WhyNotHugo 1y ago
I'd split that first list into two: 1a. Arbitrary apps can listen on ports without permissions. 1b. Arbitrary apps can access local ports without permissions. I've recently been experimenting with running the browser (on my desktop) in a network namespace precisely because of these reasons. Random websites shouldn't be able to access services running on localhost.
- throwawayffffas 1y ago
  > I've recently been experimenting with running the browser (on my desktop) in a network namespace precisely because of these reasons. Let me introduce you to https://www.qubes-os.org/ https://www.qubes-os.org/.
  - alchemist1e9 1y ago
    For the ultra paranoid is there anything that can do this on a smartphone?
    - const_cast 1y ago
      I believe GrapheneOS has true sandboxing.
    - WhyNotHugo 1y ago
      Nothing out of the box, but you can run VMs in a similar fashion (eg: qemu).
- mzajc 1y ago

frenchmajesty 1y ago

Very impressive but not surprising coming from Meta. They have an history of doing this kind of things. Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets. At this point, I think the race for Zuckerberg is, can Meta survive long enough for the next platform shift (AR or VR) where they will own one of the major platforms and won't need to abide by any reasonable rules before their "internet tentacles" that sustain the Ad Machine are cut off. My bet is they will make it. Though I don't wish it, they're on track.

joshstrange 1y ago
> Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent. Unlike this case, it required users to jump through a number of hoops/scary iOS warnings. Many still did, for a gift card or less.
- disgruntledphd2 1y ago
  > Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets. Incorrect. An Israeli startup (Onavo) had pivoted into selling data acquired from their VPN got acquired by Facebook. Importantly, they used statistics to estimate population prevalence which is how FB knew that Whatsapp (specifically, this was all post IG acquisition) was super popular outside the US. > They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent. This was (sadly) an entirely different scandal. Honestly, I generally defend Meta/targeted advertising in these threads, but this one is such incredible, total, absolute bullshit that I can't even begin to comprehend how one could defend this. I do remember when I joined FB in 2013, how surprised I was that most of the company didn't care about ads/making money (apart from the sales org). That ship has clearly sailed.

throwawayffffas 1y ago

What about the whatsapp app?

bsimpson 1y ago
...and FB Messenger
throwawayffffas 1y ago
I did a quick check with adb, it looks like whatsapp is not opening any ports.

fidotron 1y ago

The same European intellegentsia that is progressively forcing Apple to tear down the walled garden simultaneously fails to understand that this is exactly why they had it in the first place: > You’re not affected if (and only if) . . . > You browse on desktop computers or use iOS (iPhones) At the very least they should step back and allow companies to enforce safeguards because they clearly lack the understanding or foresight to do so effectively. The simple way for the EU to beat Meta is to stop being so cheap: break the WhatsApp dependency by actually paying properly for something that has a decent UX and doesn't track you. If you aren't willing to do this you will be exploited over and over again. TANSTAAFL

brookst 1y ago
It is kind of funny that EU may well require these kinds of vulns to be present, while reacting with outrage when used.
LinAGKar 1y ago
Is there anything in those EU directives that requires browsers to let webpages connect to localhost? Because that's the main issue here. And also maybe apps should need permission to listen on ports or connect to localhost, but I doubt the regulation prevents that either. On https://localmess.github.io/ https://localmess.github.io/, they think that this is technically possible on iOS too, and the main reason it wasn't done there is due to restrictions on apps running in the background. This is nothing new that has been opened up because of those regulations.

Thorrez 1y ago

>You’re not affected if (and only if) ... >You always used the Brave browser or the DuckDuckGo search engine on mobile How does choice of search engine protect from this?

yegg 1y ago
I think they meant our browser.
joshstrange 1y ago
> How does choice of search engine protect from this? I don’t use android or either of those browsers but my guess is that either block the tracking pixel from loading in the first place or they’re more locked down on what they allow websites to reach out to (aka no Localhost access).
- Thorrez 1y ago
  I'm not asking about browsers, I'm asking about a search engine. How could a search engine block a tracking pixel? You click a link in the search engine and go to a website. The search engine can't control the website after you go there, can it?
  - joshstrange 1y ago
    DuckDuckGo and Brave have browsers on Android
    - mvdtnz 1y ago
      Are you being intentionally obtuse? Read the quote again, >You’re not affected if (and only if) ... >You always used the Brave browser or the DuckDuckGo search engine on mobile
    - Thorrez 1y ago
      The article says search engine, not browser.

wewewedxfgdf 1y ago

Makes me think of the Simpson's episode where Bart gets away with anything by saying "I'm sorry", and looking contrite.

JimDabell 1y ago

Previous discussion: Covert web-to-app tracking via localhost on Android (341 comments): https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115

1vuio0pswjnm7 1y ago
NB. Comment totals may still be increasing as discussion continues Washington Post's Privacy Tip: Stop Using Chrome, Delete Meta Apps (and Yandex) (328 comments) https://news.ycombinator.com/item?id=44210689 https://news.ycombinator.com/item?id=44210689 Meta found 'covertly tracking' Android users through Instagram and Facebook (95 comments) https://news.ycombinator.com/item?id=44182204 https://news.ycombinator.com/item?id=44182204 Meta pauses mobile port tracking tech on Android after researchers cry foul (28 comments) https://news.ycombinator.com/item?id=44175940 https://news.ycombinator.com/item?id=44175940 Covert web-to-app tracking via localhost on Android (6 comments) https://news.ycombinator.com/item?id=44169314 https://news.ycombinator.com/item?id=44169314 Covert Web-to-App Tracking via Localhost on Android (6 comments) https://news.ycombinator.com/item?id=44169314 https://news.ycombinator.com/item?id=44169314 Meta and Yandex Spying on Your Android Web Browsing Activity https://news.ycombinator.com/item?id=44177637 https://news.ycombinator.com/item?id=44177637 New research highlights privacy abuse involving Meta and Yandex https://news.ycombinator.com/item?id=44171535 https://news.ycombinator.com/item?id=44171535 Meta and Yandex exfiltrating tracking data on Android via WebRTC (3 comments) https://news.ycombinator.com/item?id=44176697 https://news.ycombinator.com/item?id=44176697

hurtuvac78 1y ago

This story got kicked out of front page quite suddenly, not sure how/why. Lots of points and comments.

N-Krause 1y ago
Yeah, would be interested to know why exactly EDIT: Ok probably because it basically is a repost. I just haven't seen it 6 days ago.
- ChrisMarshallNY 1y ago
  Lots of second posts stick around for a long time. I have seen that if a company is called out by name, in an inflammatory manner, the posts tend to drop out quickly. Sometimes, they come back. Conspiracy theorists say that only happens with YC-backed companies, but that may be selection bias. I have seen stories that call out a number of companies, disappear quickly. It's hard to say if that's OK or not. I think some of these stories are really nothing more than "hit pieces," but some of them are really on the money.

jmward01 1y ago

I'm just confused why Meta needed to do this. Isn't fingerprinting good enough to not risk building this? All I can think is they use something like this to prove out their other tracking tech is working (this is the test set effectively). It is obvious that they really have several of these types of tracking technologies so that if one gets found out/patched they can switch it off and say 'look we stopped' all while still tracking with impunity. It just seems dumb that they would keep something this blatant in use.

SoftTalker 1y ago
Sociopathic people are running the company. You tell them they can't do something, they take it as a challenge and try to do it without getting caught.
jaks6 1y ago
This provides them an easy way to build a labelled dataset for training the fingerprinting ML models.

sudahtigabulan 1y ago

Can this be avoided by running any Meta apps in Work Profile, and the browser in Main Profile?

pupppet 1y ago

Once again those of us in NA have to leave it to the European government to look out for us.

ghthor 1y ago
I mean, we can assume they are doing something bad and not install their software.
icedchai 1y ago
Yes, I just love all those cookie banners. Thanks!

teleforce 1y ago

"If you're not paying for the product, you are the product" - anonymous. Why is this very news is not in the HN front page for considerable amount of time is beyond me. It has the right recipe for top HN post namely users deception, sandbox bypass, privacy or lack thereof, web browser, Meta, etc.

eviks 1y ago
"If you're paying, you're still the product", so apparently other factors anon didn't mention are involved
- noisy_boy 1y ago
  "They will never stop trying/making you the product, until people trying/doing so go to jail".

_wire_ 1y ago

You've rented a device that connects to a worldwide communications network built on a principle of numerically exact message routing between every device and use it to run numerically exact programs from service providers to access services that host and consolidate the particulars of your identity within their servers rather than your device, and you are amazed that the device can persistently track everything you do with the device? What's the point of being Google or Apple except for precisely control of such central services?... ♪ Central Services, we do the work, you do the pleasure... ♪ "Have you considered your ducts?" ...And it just so happens that all the news you see is from the device and subject to this surveillance used to colonize your mind... Sounds democratic! The old Politburo could only dream of such tools for maintenance of a compliant, obedient proletariat. And with Central Services new "AI" you can get a brain implant to ensure your perfect conformity and access to the best paying jobs in the world, yours and your family's future will be secure. Be sure to invest in these securities, shop here, entertain and vacation there— leave the driving to us! Do it your way. "A new life awaits you in the Offworld Colonies. A chance to begin again in a golden land of opportunity and adventure. So c'mon America..." "...Every leap of civilization was built off the back of a disposable work force..."

jasonthorsness 1y ago

"The Meta Pixel script sends the _fbp cookie to the native Instagram or Facebook app via WebRTC (STUN) SDP Munging." Crazy to deploy a hack like this at the scale of Meta.

jobs_throwaway 1y ago
yeah...how does this get approved?
- strix_varius 1y ago
  "approved?" In a company where ads are the lifeblood and where the targeting specificity of ads determines their value, whichever engineers put this together are guaranteed to have gotten fantastic promo packets.
raxxorraxor 1y ago
Shouldn't a sensible CORS policy by the webserver block these access attempts? Of course the website owner wants the tracking, but I think they should also be a guilty party here next to Facebook, even if they just bought the service.

ls-a 1y ago

What's funny is that the engineers who implemented this are probably one of us here on HN. I don't think Zuck implemented this himself

hbossy 1y ago
That's what they need AI for. It won't say no.
- aunetx 1y ago
  The engineers did not say no either though.
  - hkt 1y ago
    They're hoping that in the long run AI won't say no and will be cheaper
  - steve_adams_86 1y ago
    My experience is that most won’t. I was someone who wouldn’t say no, once. For me it was because I was naive and didn’t believe people would work so hard to exploit others. In fact, one time there were users on an ad network I built who were breaking rules. I’d track them and try to figure out where they came from and who they actually are, only for them to drop out and open a new account. I’d report to my CEO about this, ask for advice, generally discuss strategies to prevent this kind of usage of the network. He seemed very concerned. But sure enough, eventually I figured out it was actually him all along. He was making tens of thousands of dollars in revenue per month doing literally the most shady stuff on the network. He was using my naivety to keep himself in the loop on internal compliance and stay a step ahead of me. I’ve worked with several people like this. They love the tech industry. I had to finally admit to myself that I worked with bad people and did bad things to develop the awareness and courage to start saying no and do something else. Once I was gone, he did the same thing with a younger developer who was eager to break into the industry. I actually work with him now, nearly 15 years later.
ryandrake 1y ago

ATechGuy 1y ago

If it does not cost them everything, they will not stop.

udev4096 1y ago

This is one of the reason you need to segregate your whole LAN. At the bare minimum, use VLANs to knock off these ruthless scanners. And obviously, this wouldn't be possible if you used a strong adblock list on whatever DNS you're running. They cannot touch the people who take proper measures. I also do not believe people who use Facebook really care about privacy. I am well aware of how mean this sounds but they fully deserve to be tracked

janalsncm 1y ago
> they fully deserve to be tracked Absolutely not. The law is still the law. The fact that Meta is able to break the law via technical means doesn’t mean victims deserve to be victimized. Just because someone is able to pick your lock at night doesn’t mean you deserve to be burglarized.
- udev4096 1y ago
  Get a better lock. If you don't care enough to not get lock picked, whose fault is it? The bar to avoid this form of tracking is not high at all. It's trivial for anyone who is willing to put some serious efforts in defending their privacy
  - comrh 1y ago
    You live in a tech bubble if you think it's trivial when most people don't even know what localhost is.
  - finnh 1y ago
    "trivial ... serious efforts" which is it? you contradict yourself in a single sentence.
  - oceansky 1y ago
    Absolutely no lock will prevent a sufficiently motivated thief. And the bar is high for the average person, who isn't much tech savvy at all.
  - 1y ago

deleted 1y ago

[deleted]

aorth 1y ago

Remember in 2014 when the Android Twitter app started sending a list of all your installed applications back to Twitter? https://news.bloomberglaw.com/privacy-and-data-security/twitter-starting-to-track-list-of-users-apps-on-mobile-devices https://news.bloomberglaw.com/privacy-and-data-security/twit... Ever since then I refused to install native versions of apps that could be used in a browser. I don't use Facebook or Instagram so I don't know if that works anymore, and I recall testing that they were intentionally crippling Facebook Messenger at one point. Then the past decade of native apps requesting tons of permissions and users just clicking agree. Why should Facebook be able to read my Wi-Fi network or Bluetooth? Of course there is something shady going on. Beacons tracking people walking around brick and mortar stores. https://en.wikipedia.org/wiki/Facebook_Bluetooth_Beacon https://en.wikipedia.org/wiki/Facebook_Bluetooth_Beacon Such a shame because native apps are so much more pleasant and performant to use than web apps.

dcminter 1y ago
> they were intentionally crippling Facebook Messenger at one point [in a browser] They were/did. I was using Messenger Lite for a bit which was ok, but they killed that and the mobile browser mode. I still need FB for some events and contacts, but I refuse to have the fat messenger app installed so now I end up using the damn thing in desktop mode which is ... painful. All I seem to see in my feed these days is "suggested for you" so it's a lot less addictive than it was back in the day. Not sure why they're so determined to drive the user base away, but that does seem to be the plan.
gausswho 1y ago
I felt a prude at the time but eschewed native apps for browser versions and haven't regretted. Didn't benefit from notification distraction anyway. Apple and Google just didn't get their houses in order to be taken seriously. If it ain't on F-Droid, I'll wait.
- boneitis 1y ago
  There is another can of worms hidden in plain sight right here, I feel like. From the article: You’re not affected if (and only if) You access Facebook and Instagram via the web, without having the apps installed on your phone This is only what's observably true of a particular app under the hood from straightforwardly jacking into it with Frida or performing any other deeper analysis. What's to say Meta/Google/OtherAnalyticsCorp/OtherMegaCorp hasn't already, on a large scale, colluded with[bought out] app developers to simply share session data out-of-band as another tentacle? Rather, is it even reasonable to assume they all haven't been doing this all this time? (Maybe these also fall squarely under what GDPR, DSA, and DMA were supposed to mitigate? I'm not an expert here.. just my cynicism kicking in.) I too go through fairly great pains to try to minimize unneeded apps on my device.

iamleppert 1y ago

The real flaw here is in WebRTC. WebRTC should be disabled by default, and behind a permissions dialog at least. Still, facebook could just disable chat or some feature and claim they need WebRTC and 99% of users would opt-in to it.

OptionOfT 1y ago

Reading though this, is it correct to say that they could've done a fetch("http://localhost:<port>/id=<id> http://localhost:<port>/id=<id>"), but then it would show up very conspicuously in the logs, and you couldn't talk to UDP ports with it?

brazzy 1y ago
I read this: > Android has many flaws, but in the relevant part here, it’s specifically designed to prevent apps from doing this — from listening to local ports like localhost. to mean that they could not do it via HTTP, and instead had to circumvent Android's privacy measures via WebRTC.

fifilura 1y ago

If this fine is collected. Will I get the money? Serious question. I don't generally mind paying taxes and all that. But in this case I feel I am the person offended and I should get some kind of compensation. I'd say €1-2000 would make me feel somewhat compensated.

BlarfMcFlarf 1y ago
Theoretically, fines replace tax revenue, so you get compensated by lower taxes. (Practically, spending and income are decoupled and taxes are mostly just an inflation management strategy.)
- fifilura 1y ago
  I can understand it of course. But in this case I feel personally offended. I would like to see the money handed to me.
  - remram 1y ago
    If most people in your country use Meta apps, whether it's a tax discount spread across the population or a payout spread across the userbase doesn't make a difference. Personally I would like to see some execs go to prison, rather than taxing/fining a monopolistic corporation, which achieves nothing.
    - fifilura 1y ago
      You don't have to explain taxes to me, it is a concept that is pretty easy to grasp, and - even though I understood it already - the grandparent post also explained it . And I touched the subject in my original post. I guess what I am looking for is some kind of personal apology. And that could be manifested in a refund to mu bank account. As I explained above. I don't think sending people to prison helps much. A personal check would open the eyes for a lot of people and make them realize that this company committed a crime. Against you. And you are worth it.
saintfire 1y ago

globalise83 1y ago

This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.

ribosometronome 1y ago
How would the EU fine American engineers who live and are paid in America?
- joelfried 1y ago
  They would fine them by having a court case and saying they are guilty and owe money. Collecting on it would be awfully difficult, but you know, people do like trips to Europe. That said, I think fining the company seems pretty plausible. They won't, but it'd be nice if they did.
- acatnamedjoe 1y ago
  Can't America fine them? Surely this is illegal there too?
  - pesus 1y ago
    There is probably little to no chance of that happening in the current political climate.
    - markus92 1y ago
      I can see the California or maybe even Texas AG go after them, wouldn’t be the first time.
- okanat 1y ago
  Well some of them definitely has savings in Europe and like to travel destinations in Europe.

tdiff 1y ago

What I don't get: - How come Yandex was doing it for years without being noticed. - Facebook must have known about this technique for years as well, why did they only enable it last year.

kgwxd 1y ago
They knew who was going to be president this year.
- bloppe 1y ago
  The American president doesn't really matter in this case. The EU is where they're going to get destroyed.
  - afavour 1y ago
    It’s quite possible that a different administration would punish FB for this. The current president being who he is, is the reason it doesn’t matter.

camillomiller 1y ago

The craziest part is that they are not liable of anything apparently under the basically non existent American privacy laws.

riddley 1y ago

I'm guessing I'll get down-voted for this, but what's to stop any browser/executable from trolling through /proc on Linux and knowing about what every process running as you is doing?

deleted 1y ago
[deleted]
hollerith 1y ago
File mode bits prevent processes not running as root from reading much of the info in /proc.
- mbreese 1y ago
  I don’t know… with a stock Linux, the information a user can get from top (via /proc, I assume), is pretty thorough. You can at least get a list of running programs, which by itself could be valuable.
  - hollerith 1y ago
    Good point. I withdraw my comment.
const_cast 1y ago
Nothing really. Desktop operating systems are basically grandfathered into the modern world. They have the old timey approach to application security. That being, applications can access everything on your computer, and there's no fine-grained permission systems. But, for OS that we've developed later, we kind of decided that's a problem, and applications are a vector for malware, and "trust" just isn't enough. So Android and iOS did the whole permissions thing. Now, we've gone back and added some stuff onto desktop operating systems. Of course Linux has containers these days on desktop. Like, I'm running Firefox right now - but Firefox can only access it's runtime folders and ~/Downloads. So, if there's a zero day sandbox breach, I won't get data stolen. There's also SELinux and Apparmor and stuff and you can really jump into the deep end with this. But, we largely view it as unnecessary because we're running open-source software from trusted repositories. We probably shouldn't view it that way.

12_throw_away 1y ago

I guess we don't call it a "0-day" if it's multinational corporation doing the illegal data exfiltration ...

BobbyTables2 1y ago

They’re getting off cheaply!

jonahbenton 1y ago

What about Whatsapp?

1vuio0pswjnm7 1y ago

"Meta faces simultaneous liability under the following regulations, listed from least to most severe: GDPR, DSA, and DMA (I'm not even including the ePrivacy Directive because it's laughable)." Also not included: https://www.courtlistener.com/docket/70448987/1/rose-v-meta-platforms-inc/ https://www.courtlistener.com/docket/70448987/1/rose-v-meta-... The wiretapping claims carry damages of $5,000 per violation. It could be he thinks this is laughable like the ePrivacy Directive. https://www.reuters.com/technology/metas-facebook-pay-90-million-settle-privacy-lawsuit-over-user-tracking-2022-02-15/ https://www.reuters.com/technology/metas-facebook-pay-90-mil... https://dicellolevitt.com/case-study/facebook-agrees-to-pay-90-million-to-settle-decade-long-data-privacy-class-action-involving-facebooks-secret-internet-tracking/ https://dicellolevitt.com/case-study/facebook-agrees-to-pay-...

account42 1y ago

Theoretical maximum fines are cool at all but at what point will wanton disregard for the law result in actual prison time for the people involved?

eqvinox 1y ago

> 1. The user opens the native Facebook or Instagram app, […] I'm not going full "it's your own fault for having those apps installed" — it really isn't — but people need to learn they shouldn't trust apps made by these giant adzillas. (Which to be fair you could also argue for Android as a whole, and Chrome). If Facebook and Instagram are "dominating the market" as the EU likes to say, maybe it's time to force allowing 3rd party frontend apps?

sdht0 1y ago
> people need to learn they shouldn't trust apps made by these giant adzillas. I do wish life were that simple. Users (including myself) get value out of natively installed apps. Until that changes, this suggestion is impractical.

ornornor 1y ago

“They trust me. Dumb fucks.” —-Zuckerberg As relevant as ever. https://news.ycombinator.com/item?id=19966959 https://news.ycombinator.com/item?id=19966959

eqvinox 1y ago

Interesting view on Mastodon arguing this might even be a criminal act, not just civil liability: https://infosec.exchange/@isotopp/114664494157616670 https://infosec.exchange/@isotopp/114664494157616670 > What Meta did wasn’t just a violation of GDPR. It involved bypassing built-in technical protections with the intent to extract and link data — potentially personally identifiable information (PII) — to users without their knowledge or consent. > That is the textbook definition of unauthorized access and data exfiltration.

ncr100 1y ago

In 2014 / 2015 I was digging through the code of the iOS Facebook app and found that it was loading, by string name, a dylib. I think it was a system dylib for networking, or sound, or something. It seemed like the wrong way to access a system service. That seemed unnecessarily sneaky and made me appreciate the sense of righteousness which I would have, if I were a SW dev @ FB at the time, to add such a technique to a world-tier app like FB.

deleted 1y ago

[deleted]

zeristor 1y ago

So Facebook collects this, and sells it. Perhaps sanctions on those that buy and use the data would help?

anonbanker 1y ago

Oh, this is bigger than just Android. SDP munging can cause all sorts of havoc on desktop clients as well. Bit of a blind spot in WebRTC implementations.