Hacker News Reader

Comment by monort | Hacker News Reader

I think they cross-reference Android Advertising ID in their SDK. Have you ever logged to Facebook from your phone?

https://developers.facebook.com/docs/app-ads/targeting/mobil...

I have, either in the browser or in Swipe (a third-party app). I've never logged in to or installed the Facebook app or Messenger.

Then FB left behind tracking data, and there's your link. Sigh.

How? It was running in a browser.

Once you've logged into facebook from the device, they likely created a device fingerprint for your device: https://en.wikipedia.org/wiki/Device_fingerprint . This would allow them to identify you even without a cookie or ad id to correlate against.

I don't think the browser fingerprint and native app fingerprint are the same, what you say sounds unlikely to me.

Fingerprinting across devices is possible too, using things like behavioral analytics, network traffic, timing, third-party data sources etc.

The third party data sources is the easy one. Log into service A on your computer and service A on your phone. Service A fingerprints both and sells the data to service B. Now service B knows how to correlate your behavior between devices even though you never logged in.

I’m sure you’ve logged in something on both your phone and computer. It doesn’t have to be Facebook.

Try to opt out of Advertising ID (Settings -> Google -> ads) and see if apps continue to be associated with your facebook account. I suspect Swipe sent both your account ad advertising id during login.

I opted out of Google advertising a long time ago, I think in the end it was Instagram/WhatsApp that did the dirtywork.

Reply on news.ycombinator.com