Hacker News Reader

Comment by wukerplank | Hacker News Reader

Wow that's creepy. It lists apps where a) I didn't use FB login/signup and b) used a different email address to sign up. How do they cross-reference that to me? Hand how can I prevent that outside of their tools (which I assume still violate my privacy)?

View on HN

What you can do to prevent this is:

1) Install https://www.eff.org/privacybadger to prevent trackers from being loaded

2) Install https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... to delete any cookies you might have accepted after a week time or so, which prevents the infinite gobbling-up of your data after innocently accepting a cookie once

3) Install the Google, Facebook, Twitter and Amazon containers to "separate" your browsing with these sites from the rest of your browsing. Links: https://addons.mozilla.org/en-US/firefox/addon/facebook-cont... https://addons.mozilla.org/en-US/firefox/addon/twitter-conta... https://addons.mozilla.org/en-US/firefox/addon/google-contai... https://addons.mozilla.org/en-US/firefox/addon/amazon-contai...

Also, if you are creeped out by this, just imagine the amount of data Google has on you. I'm convinced they have way more, just by virtue of every website having Google Analytics installed.

Those are good, but they don't work for what the GP is talking about. I'm seeing games/apps associated with my FB account even though I never logged in to FB with them or gave them any info. I literally just opened the app and that activity was associated with my FB account.

I have no idea how they're doing this, since they didn't even request storage access (or I didn't give it). Can any Android developer here chime in on how an app can figure out my Facebook ID even though I don't even have Facebook installed on my phone and didn't give any sort of credential or access to the app?

I think they cross-reference Android Advertising ID in their SDK. Have you ever logged to Facebook from your phone?

https://developers.facebook.com/docs/app-ads/targeting/mobil...

I have, either in the browser or in Swipe (a third-party app). I've never logged in to or installed the Facebook app or Messenger.

Try to opt out of Advertising ID (Settings -> Google -> ads) and see if apps continue to be associated with your facebook account. I suspect Swipe sent both your account ad advertising id during login.

I opted out of Google advertising a long time ago, I think in the end it was Instagram/WhatsApp that did the dirtywork.

Then FB left behind tracking data, and there's your link. Sigh.

How? It was running in a browser.

Once you've logged into facebook from the device, they likely created a device fingerprint for your device: https://en.wikipedia.org/wiki/Device_fingerprint . This would allow them to identify you even without a cookie or ad id to correlate against.

I don't think the browser fingerprint and native app fingerprint are the same, what you say sounds unlikely to me.

Fingerprinting across devices is possible too, using things like behavioral analytics, network traffic, timing, third-party data sources etc.

The third party data sources is the easy one. Log into service A on your computer and service A on your phone. Service A fingerprints both and sells the data to service B. Now service B knows how to correlate your behavior between devices even though you never logged in.

I’m sure you’ve logged in something on both your phone and computer. It doesn’t have to be Facebook.

Maybe same phone number on Google Play and Facebook or some other way the phone number IDs you?

Edit: This report[1] puts the blame mostly on Google ads ID.

[1] https://privacyinternational.org/report/2647/how-apps-androi...

That's possible, though if any app can get my number without asking for any permission I'm going to throw my phone away.

Are you using Instagram or WhatsApp?

Ahh, there we go, I forgot about those... That must be it, thanks.

The whole point of them buying WhatsApp was to have a backdoor into people's contacts (among other things).

I found a mere four items in my activity list, all from several months ago, probably when I mistakenly used the wrong container or had uBlock turned off. It's nice to see all my anti-tracking software is working!

I use Firefox Containers to limit and logged in FB activity to that & never log in using FB other than FB website itself. I have no FB apps (including WhatsApp).

I've been running uMatrix for a few months.

My firefox tracking-prevention (similar to EFF's one, but probably not as good) is always using maximum privacy settings.

I still have a few sites appear... AND for websites I've never even visited (that I'm aware of, & I'm the only user of this machine)

There seems to be some serious fingerprinting going on, more than simple cookies.

Agreed, even with all of the above I had about 15 or so sites in that Facebook list. I suspect it's because I was logged in to Facebook on my phone's browser for a while. Not sure why I even did that...

I thought Google Analytics had a decent privacy policy that would prevent Google from doing anything with GA data. But I remember some fuzzy wording like "your data" which could simply mean that Google considers GA data to be their data.

Has anyone done a good deep dive on what Google actually does with GA data?

Even before firefox containers, I used a dedicated profile for facebook only as well as using privacy badger and ublock origin. Facebook still collected data about me from external sites. I think mainly through my phone, possibly through linking phone number or email addresses.

By far the worst thing are android phone applications (not only FB official app). They have their spyware bundled and can slurp from you the data which are normally unaccessible by web browser, from phone number, imei, mail addresses to all your contacts and there is almost nothing you can do except installing vpn based firewall (like NetGuard) and block all access and add permissions one by one for each url. This should just be illegal.

How can phone apps with no permissions get my phone number?

> except installing vpn based firewall

So they can send the data instead?

From your friends :) Or you will allow it. To use it. On the other side you can at least control that the common advertisers wont get it (like fb). For everything else get root and xposed + xprivacy. But for most users that is too much. I just gave the easiest advice. I am running microg lineage, xprivacy lua and netguard. But I wonder was this as advice worth the letters used? ;) Will someone go trough the trouble to use it? To replace the rom, install everything, run everything in block mode and allow only what is really needed, like connection to my own mail server? My own ssh tunnel? Probably not. And then comes the master villan, google. How many will remove that one from the phone? Waste of words, right?

Anyway even netguard is far better than nothing, most apps dont need their own servers. And the largest data slurpers are known. For fb just block all fb domains.

I think they either:

- use Facebook pixel tracking on the site.

- hand over all of their user's email addresses to use for audience building.

Or most likely both. Creepy stuff indeed.

I use uBlock Origin and Privacy Badger on my desktop and phone, as well as Blokada, and yet Facebook still had a bunch of app activity even though I never ever sign in to stuff using FB (or even gave the apps my email or any other piece of personal data).

I literally just opened the app, granted no permissions, used it a bit, and Facebook associated it with my account. What the fuck.

They could be associating you server-side using persistent identifiers on your phone. For example, if an app has the Facebook SDK, it could send your IMEI to Facebook. Then, if you have a first-party Facebook app like Messenger, that too can send your IMEI to Facebook and link it back to your Facebook account.

Yep - all of above....

690 App/Sites for me! Not overly surprising really

I'm pretty sure that 95% from the activity that is listed for me comes from the Facebook tracking pixel, that every website has to embed if they want to (effectively) advertise on Facebook.

Some chat apps (like Viber and others) have Facebook SDK integrated in them, without any direct Facebook functionality people would use. Discovered after using NetgGuard, and seeing who is calling home, and not only home. (Why viber is making requests to graph.facebook.com anyway?)

Duolingo is a nice app for learning new languages, yet it might be using the same sdk, since it likes to call facebook.com domain.

Netflix is a good streaming service, but it has some option somewhere, which allows them to share data with others, and enabled by default. And yes, it's present in fb activity.

The list can go on...

There are developers who integrate dozens of SDKs, without any specific purpose for users, and not knowing what is happening. We need something like PrivacyBadger/ublockorigin for phones/laptops/routers/homes/cars. It's getting more than creepy.

And why would Facebook allow third-parties/businesses upload into FB info they have on their customers...

PS: analysis of how a simple menstrual tracking app is leaking data about the owner https://media.ccc.de/v/36c3-10693-no_body_s_business_but_min...

As an EU "customer" I'm rather surprised by this. There are services that I've signed up to since GDPR came into effect which I didn't get explicitly consent to do this. For example my business bank. Why would I give them permission to share data with my personal Facebook account? I will be digging into this more.

Sounds like the activities view could be some good evidence to give to a data protection commissioner.

Other commenters seem to have missed what you’re really saying here.

I’m on iPhone, and see apps listed where:

- I’ve never logged in on the web

- I’ve never clicked to open a link in a browser on-device

- Used a phone number to sign up that’s not associated with my fb account - Didn’t use email at all

For starters you can delete your facebook account .

I don't think that'd really be true, since they'd just have it stored in the background without you having a FB account (and wouldn't have the ability to see how bad it is)

not saying that's worth having an account though.

does that stop facebook from collecting data about you? I didn't think it did, and because you don't have an account it's not, or at least wasn't possible to control any privacy settings.

Technically, no. Legally, it means you haven't accepted their terms of service, so if/when (I hope) the political privacy landscape changes, it'll be more likely that you can sue, report a violation, request deletion, (or maybe they'd even preemptively delete it to cover their tracks / come into compliance with new laws).

That's an interesting thought. I've removed (deleted?) my Facebook account several months ago. Maybe I should have kept it around in order to manage it.

which I did a couple of years ago. Now I have no idea what they know about me. I use adblock and friends, but I wonder how much data about me they still manage to gather

When I view this link, I can see no activity.

Here is my secret: I deleted my facebook account several years ago. (before it was cool)

I love how links like this are (successfully?) attempting to pull people back in.

Fair point!

Reply on news.ycombinator.com