Hacker News Reader

Comment by dejawu | Hacker News Reader

I got fed up with Tinder's Android client and reverse-engineered their API (this was back when the Android security model let you use mitmproxy). Two things stood out to me:

1. The AI was kind of hacky. Updates were done by polling rather than push. There were a lot of unused fields - for example, "remaining likes" would hang at 100 until the likes were used up, then it would go straight to 0.

2. They tracked absolutely every action you took and sent it to a different server from the API requests. Opening settings, opening your own profile, opening someone else's profile - it was all logged. They knew exactly what you were doing in the app and for how long.

It wouldn't surprise me nowadays if this is standard practice but it was eye-opening to see it happening firsthand.

View on HN

> 2. They tracked absolutely every action you took and sent it to a different server from the API requests. Opening settings, opening your own profile, opening someone else's profile - it was all logged. They knew exactly what you were doing in the app and for how long.

Are there always-connected apps that don't do things like this? It's always seemed like an obvious source of usage research data that the product team isn't going to want you to forego.

A lot of apps are A/B tested for new features, I would assume this is where the results come from.

Number 2 is standard. In my experience It's a form of logging more than a form of data collection.

What's the difference between logging and data collection?

I work on a web application, and would love to have some metrics which I would consider "logging". The distinction I would make is,

- Data collection is about learning things about your users - Logging is about learning what your users were doing when Something Went Wrong.

Obviously, there's a _ton_ of overlap here, in that a lot of (all of?) the info one uses collects for one purpose could be used for the other. As a developer of the UI, however, my main concern is not about learning more about our users (our UX people already do that), but rather about understanding what happened, or which features are actually being used (so that we can know if they are safe to prune).

In reply to and0, you also need to keep in mind that companies alao might need to know which behaviors did NOT cause a crash to figure out the root cause of a crash as a sort of control group.

I think a simple test for how innocent the UI logging is would be: does it get uploaded all the time or logged locally until a crash happens?

If a company is hitting an external API with every interaction, I'm guessing it's for gathering data on user behavior. The question then is whether or not it's anonymous.

I wouldn't say it's more for logging, it's most likely for analytics purposes. A/B tests, funnels (how many people who install the app launch it, how many create an account, how many swipe right, how many swipe right a bunch, how many write a message, how many write a bunch of messages, how many buy the subscription, what page did they click it off of, how 'attractive' (some arbitrary number based on how many swipe rights, possibly) was the person they decided to buy the subscription for, etc.

Note, most sites that do analytics don't really care about who you are, individually, as a person, just how can they categorize you and your activities so they can generalize it and find ways to "improve the user experience" (read: improve how many users spend mucho dinero on our services).

And it's gotten to the point that they're never satisfied and want as much data as they can get away with so they can analyze it from a billion angles and tell the developers to change everything about the app every other week in the chase for better numbers.

is it feasible to do this protocol reverse engineering without mitmproxy?

You would have to tear apart the Android app itself. If it isn't obfuscated, it usually comes out pretty clean. Depends on how they implement things from there, but you could in theory reconstruct all their calls to their backend from the code. If they have an API/HTTP client that wraps it up nicely it often simplifies this chore from a static analysis perspective.

You can still use MiTM HTTP proxies pretty easily. If they don't pin certificates it is trivial. If they do pin certificates you have to understand how they are doing it and break that. Often trivial to easy, but requires an app-specific approach.

We haven't met an Android or iOS app using HTTPS that we could not MiTM yet. Usually without a lot of effort. Some times with a small to moderate amount of effort (a couple hours to a day of poking the app/code/certs).

Reply on news.ycombinator.com