5 ms·

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it was -- briefly, for Meta. But Meta seems to have rebounded very quickly, maybe Snap not so quickly. The rumor I've heard is that Meta threw every brain they had against the problem of finding new ways to track app users, which presumably involves some similar type of fingerprinting. The revenue success strongly indicates were successful. But if this is true, nobody has much written about it.

dec0dedab0de 1y ago
probably just ignored them. Aren't those privacy protections basically you saying "pretty please don't track me?"
- willis936 1y ago
  If we're exploring the space of "they're lying" isn't a simpler explanation be that they're lying about their revenue?
  - pc86 1y ago
    The consequences for lying about revenue as a public company are many orders of magnitude worse than lying about compliance with some private contract or TOS.
    - PenguinCoder 1y ago
      Mess with someone's personal privacy, non-issue. Mess with investors money, instant problem.. Money is more important than people, to these groups.
      - pc86 1y ago
        Good luck arguing "defrauding the entire investment market to the tune of potentially billions of dollars and submitting fraudulent 10K form(s) under penalty of perjury" is not on its face worse than violating a private company's terms of service.
  - cr125rider 1y ago
    No. The SEC gets very grumpy with public companies if they do that.
- tagraves 1y ago
  Not on iOS, as I understand it. If you "Ask app not to track" on iOS then the app cannot access your IDFA, which was the ID that previously was used to track a device across apps.
- rafram 1y ago
  You're confusing IDFA with Do Not Track.
gherkinnn 1y ago
https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.
- metalliqaz 1y ago
  I find it is useful to do so for all corporations.
  - kstrauser 1y ago
    Sure, but most aren’t able to execute on their evil so effectively.
  - amelius 1y ago
    Apple included?
    - metalliqaz 1y ago
      Yes. Apple is a huge corporation and I feel confident that such an entity would happily harm any person or group of persons in the pursuit of profit.
      - amelius 1y ago
        Are there any examples?
        antiframe 1y ago
        I get the impression that Apple would rather have lower hardware manufacturing costs than ensure fair working conditions, as an example of harming people in the pursuit of profit. [1] Perhaps that's not "bad enough" but I think the general sentiment that corporations value profits over harms to people (especially since they often try to distance themselves by offshoring, etc) applies to Apple as well. [1]: https://www.bbc.com/news/business-30532463 https://www.bbc.com/news/business-30532463
prasadjoglekar 1y ago
IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.
- kytazo 1y ago
  My impression would be the opposite. IPv6s get constantly rotated by most ISPs. MACs are always randomized, even when connecting to the same network. At least as far as modern devices go. Am I wrong?
  - aorloff 1y ago
    IPv6 isn't the boogeyman for tracking in general, because so much still relies on IPv4
  - vel0city 1y ago
    > IPv6s get constantly rotated by most ISPs I've had the same prefix for five years now. And yeah, sure, my device cycles through ephemeral IPv6 addresses often, but always within the same prefix. Group IPs somewhere between /64s and /56 and you'll essentially get a household identity, at least for a few days to a few years.
    - kstrauser 1y ago
      Yep. The addresses in an IPv6 /56 or so are about the same as an IPv4 address as far as identifying a single location.
  - SpaghettiCthulu 1y ago
    Last I heard, the default on Android was to randomize MAC address across networks but keep them static for each network.
    - homebrewer 1y ago
      It's actually well documented. What you're describing is the default (mostly), but it's more complicated than that. Proper randomization can be enabled through the developer settings. https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior https://source.android.com/docs/core/connect/wifi-mac-random...
resource_waste 1y ago
>what is Meta doing to get around Apple's iOS privacy protections? A strong relationship to Apple and cross-value marketing. Surely these rules only apply to middle sized and smaller companies. We've seen Apple get caught bending the rules for big players, even if they don't admit it.
Beijinger 1y ago
"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library collects data from multiple JavaScript APIs offered by your web browser. For example, websites can see web browser version, number of CPUs on your device, screen size, number of touchpoints, video/audio codecs, operating system and many other details that you would not want a typical news website to see." My "rugged" browser for regular browsing has plug-ins that randomize all this data.
- RiverCrochet 1y ago
  what plugins do you use/recommend?
  - Beijinger 1y ago
    You could try these: Browser Plugs Fingerprint Privacy Randomizer Clear URLs [I don't care about cockies] Privacy Badger Random User-Agent Switcher Temporary Containers uBlock Origin Canvas Blocker NoScript Font Fingerprint Defender Not all sites will work with it. For banking and plan ticket booking, I always recommend a separate, but major (e.g. Chrome) browser without any plug-ins.
    - gruez 1y ago
      >Random User-Agent Switcher Don't bother. User agent spoofing is easily detectable and it's trivial to figure out your real user-agent based on js implementation differences or TLS fingerprinting. All this does is get you banned/flagged by security vendors, on top of sticking out like a sore thumb. >Canvas Blocker >Font Fingerprint Defender Also easy to easy to detect because randomized values will put you in the bucket of "uses privacy extension" users, which is probably a smaller bucket than whatever hardware profile you're on (eg. macbook pro m3 14").
Hilift 1y ago
> what is Meta doing to get around Apple's iOS privacy protections? Money always finds a way. Everyone thought the changes made a few years ago would hurt Meta but they make $70 billion net profit. At a minimum, they only need a good relationship with advertisers, and a (sort of measurable) increase from a campaign. Also ads are different now. One address may see the same five seconds of an ad hundreds of times. That is a much easier ecosystem to correlate targets through data enrichment.
- 0cf8612b2e1e 1y ago
  Let’s pretend that the Apple restriction is 100% effective- how much impact would you expect to Meta’s bottom line? Sure, Meta would love to know every spicy detail of your life, but just following in app activity probably reveals more than enough to sway advertisers. Meta hoovers up every detail because they can. Knowing that user #7227724 spends 23 minutes a day in Spotify might make the ad targeting 0.4% more accurate, but does not seem like the lynchpin for the entire business.

dec0dedab0de 1y ago

probably just ignored them. Aren't those privacy protections basically you saying "pretty please don't track me?"

willis936 1y ago
If we're exploring the space of "they're lying" isn't a simpler explanation be that they're lying about their revenue?
- pc86 1y ago
  The consequences for lying about revenue as a public company are many orders of magnitude worse than lying about compliance with some private contract or TOS.
  - PenguinCoder 1y ago
    Mess with someone's personal privacy, non-issue. Mess with investors money, instant problem.. Money is more important than people, to these groups.
    - pc86 1y ago
      Good luck arguing "defrauding the entire investment market to the tune of potentially billions of dollars and submitting fraudulent 10K form(s) under penalty of perjury" is not on its face worse than violating a private company's terms of service.
- cr125rider 1y ago
  No. The SEC gets very grumpy with public companies if they do that.
tagraves 1y ago
Not on iOS, as I understand it. If you "Ask app not to track" on iOS then the app cannot access your IDFA, which was the ID that previously was used to track a device across apps.
rafram 1y ago
You're confusing IDFA with Do Not Track.

gherkinnn 1y ago

https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.

metalliqaz 1y ago
I find it is useful to do so for all corporations.
- kstrauser 1y ago
  Sure, but most aren’t able to execute on their evil so effectively.
- amelius 1y ago
  Apple included?
  - metalliqaz 1y ago
    Yes. Apple is a huge corporation and I feel confident that such an entity would happily harm any person or group of persons in the pursuit of profit.
    - amelius 1y ago
      Are there any examples?
      - antiframe 1y ago
        I get the impression that Apple would rather have lower hardware manufacturing costs than ensure fair working conditions, as an example of harming people in the pursuit of profit. [1] Perhaps that's not "bad enough" but I think the general sentiment that corporations value profits over harms to people (especially since they often try to distance themselves by offshoring, etc) applies to Apple as well. [1]: https://www.bbc.com/news/business-30532463 https://www.bbc.com/news/business-30532463

prasadjoglekar 1y ago

IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.

kytazo 1y ago
My impression would be the opposite. IPv6s get constantly rotated by most ISPs. MACs are always randomized, even when connecting to the same network. At least as far as modern devices go. Am I wrong?
- aorloff 1y ago
  IPv6 isn't the boogeyman for tracking in general, because so much still relies on IPv4
- vel0city 1y ago
  > IPv6s get constantly rotated by most ISPs I've had the same prefix for five years now. And yeah, sure, my device cycles through ephemeral IPv6 addresses often, but always within the same prefix. Group IPs somewhere between /64s and /56 and you'll essentially get a household identity, at least for a few days to a few years.
  - kstrauser 1y ago
    Yep. The addresses in an IPv6 /56 or so are about the same as an IPv4 address as far as identifying a single location.
- SpaghettiCthulu 1y ago
  Last I heard, the default on Android was to randomize MAC address across networks but keep them static for each network.
  - homebrewer 1y ago
    It's actually well documented. What you're describing is the default (mostly), but it's more complicated than that. Proper randomization can be enabled through the developer settings. https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior https://source.android.com/docs/core/connect/wifi-mac-random...

resource_waste 1y ago

>what is Meta doing to get around Apple's iOS privacy protections? A strong relationship to Apple and cross-value marketing. Surely these rules only apply to middle sized and smaller companies. We've seen Apple get caught bending the rules for big players, even if they don't admit it.

Beijinger 1y ago

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library collects data from multiple JavaScript APIs offered by your web browser. For example, websites can see web browser version, number of CPUs on your device, screen size, number of touchpoints, video/audio codecs, operating system and many other details that you would not want a typical news website to see." My "rugged" browser for regular browsing has plug-ins that randomize all this data.

RiverCrochet 1y ago
what plugins do you use/recommend?
- Beijinger 1y ago
  You could try these: Browser Plugs Fingerprint Privacy Randomizer Clear URLs [I don't care about cockies] Privacy Badger Random User-Agent Switcher Temporary Containers uBlock Origin Canvas Blocker NoScript Font Fingerprint Defender Not all sites will work with it. For banking and plan ticket booking, I always recommend a separate, but major (e.g. Chrome) browser without any plug-ins.
  - gruez 1y ago
    >Random User-Agent Switcher Don't bother. User agent spoofing is easily detectable and it's trivial to figure out your real user-agent based on js implementation differences or TLS fingerprinting. All this does is get you banned/flagged by security vendors, on top of sticking out like a sore thumb. >Canvas Blocker >Font Fingerprint Defender Also easy to easy to detect because randomized values will put you in the bucket of "uses privacy extension" users, which is probably a smaller bucket than whatever hardware profile you're on (eg. macbook pro m3 14").

Hilift 1y ago

> what is Meta doing to get around Apple's iOS privacy protections? Money always finds a way. Everyone thought the changes made a few years ago would hurt Meta but they make $70 billion net profit. At a minimum, they only need a good relationship with advertisers, and a (sort of measurable) increase from a campaign. Also ads are different now. One address may see the same five seconds of an ad hundreds of times. That is a much easier ecosystem to correlate targets through data enrichment.

0cf8612b2e1e 1y ago
Let’s pretend that the Apple restriction is 100% effective- how much impact would you expect to Meta’s bottom line? Sure, Meta would love to know every spicy detail of your life, but just following in app activity probably reveals more than enough to sway advertisers. Meta hoovers up every detail because they can. Knowing that user #7227724 spends 23 minutes a day in Spotify might make the ad targeting 0.4% more accurate, but does not seem like the lynchpin for the entire business.