Hacker News Reader

Comment by raw_anon_1111 | Hacker News Reader

And you don’t realize that social media apps put cookies on other websites so they know you have been to another website and then start showing you ads based on your interests?

Apps can’t tell what you do in other unaffiliated apps nearly as easily at least now on iOS that there is no globally unique identifier that apps can use to track you.

View on HN

Apps require you to sign in so they've got you immediately. They can share all your activity with whoever they want. Websites (many) do not require you to login (youtube, reddit, hacker news, etc....)

Apps also try to open all links into their own webview, a webview in which they can track all activity.

Even if you don’t log in, Facebook can tell that you were looking for something on a third party site.

And that was something that apps on iOS tried to do - see what other apps you were using by opening a url - Apple started restricting that years ago.

reddit in mobile forces you to use the app

Not old.Reddit.con

> They can share all your activity with whoever they want.

Ummmm.... You are aware of the GDPR?

Your data cannot be shared with anybody without your explicit opt-in consent. If you choose to give this consent, then more fool you.

Except for the government once the EU passes Chat Control…

All privacy-respecting browsers block 3rd party cookies by default now, which prevents that kind of tracking. There's still other forms of fingerprinting they can use, but those can be used in apps as well.

What are these other forms that apps can use?

A combination of data about your browser/os/hardware/locale configuration https://amiunique.org

You realize you just made my point for me that websites can track you more easily than apps…

FWIW: the website completely errored out on my iPhone until I turned my ad blocker off in Safari.

Whoops, I misread your post, my bad.

But I guess apps can run web views that have access to all the same fingerprinting as a standalone browser, minus any ad-blocking plugins (on iOS at least)

With a browser, you have the ability to block cookies, block whole hosts/domains, alter DOM content, alter tracking URL's, and (often) disable low level features you don't like. With apps, not so much.

And still waiting for examples of how apps can track you better. If the server wants to track you by your originating IP, all of the client side blocking will do nothing

VPN, TOR...

And once you install a VPN on your phone it also keeps apps from revealing your IP address.

Some apps can/will detect that an OS-level VPN has been activated though, and refuse to work at all. Spectrum TV does this for example, as well as some banking and other types of apps.

Yes and sites can also fairly reliably detect when a user is coming from a well known IP address block belonging to a VPN or VPS provider. It’s a built in feature of I know at least AWS

https://aws.amazon.com/about-aws/whats-new/2020/03/aws-waf-a...

Assuming you are using a "well known IP address block belonging to a VPN or VPS provider", yes, but it is also possible to setup VPNs/proxies outside of well-known IP blocks.

What is your definition of "track you" in this context?

If it's to pinpoint a unique device accessing a website even through VPNs and/or other IP changes, there are an untold number of ways that apps can track you better than a website.

Apps have access to many device-specific APIs in addition to all the web ones, and every additional bit of information used can be added to the mix to create an even more unique fingerprint of the specific device accessing a website.

For example with phones, an app (even if it's mostly just a webview) may now also have access to your phone model, phone number, maybe your contacts or GPS location, and many other things.

A website Can easily deduce your phone model based on the browser agent attribute which tells the operating system and the screen resolution with a fair degree of certainty, an app can’t get your phone number, it can get your GPS with your permission. But so can a web page with your permission. There is a standard JavaScript API for it. Contacts are also gated by permissions.

And there is a Contact Picker API for browsers

https://developer.mozilla.org/en-US/docs/Web/API/Contact_Pic...

> an app can’t get your phone number

Apps can absolutely get your phone number:

https://stackoverflow.com/questions/2480288/programmatically...

Reply on news.ycombinator.com