How Facebook Tracks You on Android (2018) [video] | Hacker News Reader

How Facebook Tracks You on Android (2018) [video]

media.ccc.de

141 pointsk0t0n031 comments

Previous discussion: https://news.ycombinator.com/item?id=18788658

Missed that one. Thanks!

Completely anecdotal: I have no facebook apps or social media on my android except for whatsapp, and I never use anything else from them. I see between 400 and 500 calls to graph.facebook.com _every day_

Install NetGuard https://github.com/M66B/NetGuard (no root needed) and block them.

I am also using XPrivacy Lua (you need rooted phone) https://github.com/M66B/XPrivacyLua to give applications fake details like android id, gps coordinates, contacts etc.

For a nice addition, uninstall all google software and use microg instead.

NetGuard looks nice. I do think their reason for not having an F-Droid release is unsatisfactory, though.

https://github.com/M66B/NetGuard/blob/master/FAQ.md#user-con...

That same logic applies to the Play Store, as it's up to the whims of Google if they roll out your update.

He probably pulled out classic "its for security reason" PR stunt. :D

Anyway, the guy is legend since its XPrivacy hit android...

I see a few on iOS from time to time, but they are blocked by Adblock Pro with a hosts file listing Facebook servers.

WhatsApp is a facebook app.

Ha, the person you're replying to even wrote "except for Whatsapp"! That's curious...

Websites and apps use Facebook apis. Nothing conspiritorial about that

On the contrary, it fits the definition of conspiracy pretty well.

Explain.

I’ll give you a definition of “conspiracy”: a group of actors that coordinate in secret to achieve something harmful or unethical.

I’m not sure what to explain.

Its not really a secret if it outright tells you what is happening. Its like claiming at all 3rd party JS is a conspiracy.

Facebook has bought their way into tracking people who are not users of their service with no notification and no opportunity to opt in or out.

It would be helpful to be more upfront in the video about why Facebook is tracking this, because it looks like it's Facebook Analytics for Apps - (https://analytics.facebook.com/get-started/Apps#fq), which puts this on par with Google Analytics for Apps - (https://developers.google.com/analytics/solutions/mobile) in terms of problematic behaviour.

So it is unclear if this is data that is provided to Facebook servers but not accessible to Facebook, similar to options for Google's Analytics platforms, or if it is harvested by Facebook by permission of the app creator. Both options being shady, as it's not told to the user, but this video feels more like it's saying Facebook is actively tracking people, not App Designers are giving Facebook permission to track you in exchange for marketing analytics.

The data that is being provided is significantly too high, and the user should be made aware, but this video seems to only discuss it being API calls to the Analytics interface when using the app. I'd definitely expect there to be API calls when using an app, but how User ID tracking is done is probably the most potentially dangerous part here.

Does Facebook Analytics for Apps segment the data from that of Facebook or combine it? Is there any policy even stated that says it's not used for other things. I would suspect, but have not looked, that all the data is combined together and used for selling ads and in other ways.

If that is the case, an app that is using it to get analytics for themselves is also sending lots of data to Facebook to be used for their other purposes.

Is this information transparent to anyone? This can lead to the tracking failing GDPR or other laws.

Now, if it was only analytics for apps for the benefit of the app owner and not shared... things might be different legally speaking.

Of course IANAL and they may have much more to say.

At the 7:00 minute mark, they show that the company has false or misleading advertising, can that company be sued for this?

It's pretty amazing that Facebook got such a foothold here that all these high profile apps use their SDK. Are they just using it for log-in? Are their mobile ads better than Google's for developers? I assume that Google provide all the same tools for their own ads, analytics etc. and presumably similar tracking by Google is already baked in and unavoidable.

Login is a big thing but if I can get away with it, I'll simply use a web view Facebook authentication instead. Adding all that framework weight for something the average user only uses once and will be a jarring experience from the rest of the app no matter what you do is not worth it to me.

> Are their mobile ads better than Google's for developers?

The situation may have changed but last time I worked (as a PM) with people doing mobile marketing back in 2015, Facebook App install campaigns were _massively_ better than anyone else. You could get installs for under $3 per user and the performance was fantastic eg 1000 times more installs in the same time as the next best network.

Facebook may have upped their prices since and Googles App install products have got a lot better, especially on YouTube

As mentioned in the video, but not afaics in the description, the page from the presenters at https://privacyinternational.org/appdata has the testing environment if you want to extend or replicate these results, as well as the report itself and its documentation, along with a March 2019 update.[1]

1: https://privacyinternational.org/blog/2758/guess-what-facebo...

How hypocritical it is to both boast that you are privacy focused, while blatantly invading users privacy at the same time!? I think their days are numbered, but hopefully we get rid of them sooner than later.

This is tangential, but I really dislike how this YouTube channel always downloads the original video, strips it of all information regarding the speaker and the conference and uploads it to their channel. Even though the original is published under Creative Commons Attribution, it still bothers me that they 1) download and reupload (wouldn't this be better accomplished by a playlist?) 2) strip information that makes it appear they produce the content. I'm curious what other people think about this.

Anyway, here is the source [1] from their video description.

[1] https://www.youtube.com/watch?v=y0vlD7r-kTc

OK, we've changed to that from https://www.youtube.com/watch?v=OTt1AVRQyx0.

Can we link to the CCC page instead? It has the video along with additional resources: https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...

Sure. Changed from https://www.youtube.com/watch?v=y0vlD7r-kTc.

Not to mention that they're breaking the license by not indicating that they've made changes to the original work. As far as 2) is concerned, that's allowed by Creative Commons Attribution, but it must be indicated that the changes were made. Just the fact that they've cropped the video makes their video a modification.

From[0]:

> How do I properly attribute material offered under a Creative Commons license?

> You must also indicate if you have modified the work—for example, if you have taken an excerpt, or cropped a photo.

[0] https://creativecommons.org/faq/#how-do-i-properly-attribute...

stripping is not good but corralling and filtering videos maybe not so bad. maybe in the future content id can let people know of people from which a given video originates? that would be a useful exploration feature.

I'd like curated content to have a larger presence as well. I wonder If enhancing playlists could accomplish this. You can add metadata and arrange while the video remains on its channel.

On the other hand I doubt a lot of reuploading is done in earnest.

Original full length video from 35C3: https://www.youtube.com/watch?v=y0vlD7r-kTc [How Facebook Tracks You On Android]

Reply on news.ycombinator.com