media.ccc.de
5 HN mentions · mentioned in 5 months, 2019–2022
43:37 · 26K views · Dec 30, 2018
A 35C3 talk by Privacy International researchers who captured and decrypted traffic between Android apps and Facebook servers. They show many apps send Facebook device and usage data immediately on launch, even for users without Facebook accounts.
HN cites it as the source for how Facebook's SDK tracks Android users by default.
5 comments from Hacker News
They shouldn't be sending me to the Play Store ITFP. I can't use Play because I've got no GApps in my phone, so I can't try their app unless I find a copy "somewhere" and convince myself it hasn't been poisoned. I got a reasonably up-to-date Firefox through APKPure, and later on after watching that 35C3 talk [1], I unzipped and grepped all those saved .apks to find the APKPure app itself and Firefox and LingoDeer had the same traces of Facebook's SDK in them. So that's off the table, huh? The ones that I saved from older phones after having gottten them through Play were all fine, but I can't update those without grabbing another phone and letting Google ... play in it. <ducks> Just the other day I asked the Waterfox team for an apk and an md5sum, for the same reason-- though I'd settle for the md5sum alone! But Mozilla has resources WF can barely dream of, and it apparently intends to be a champion for privacy, so this is kinda sad. [1] this video
the first things most apps try to do is attempt to connect w/ graph.facebook.com at launch (and periodically) this is true for your banking apps to music apps like Pandora and Spotify you can get Netguard, which functions as VPN/Firewall and get visibility into the data exfilitration that is happening right now on your Android phone (and block some of it). Similar things should exist on iPhone too CCC had some coverage recently, but this has been happening for a long long time - this video * google apps are also constantly trying to phone home and panic when they cannot connect to the mothership, causing signficant battery drain... I haven't seen them trying to call facebook directly though
This is tangential, but I really dislike how this YouTube channel always downloads the original video, strips it of all information regarding the speaker and the conference and uploads it to their channel. Even though the original is published under Creative Commons Attribution, it still bothers me that they 1) download and reupload (wouldn't this be better accomplished by a playlist?) 2) strip information that makes it appear they produce the content. I'm curious what other people think about this. Anyway, here is the source [1] from their video description. [1] this video
if this is related to the Facebook Mobile SDK it seems that it is sending a lot of data home by default and that setting it up for ethical data collection isn't straightforward for most developers[0] [0] at least for android, based on this talk: this video (35C3 - How Facebook tracks you on Android) edit: add video title
This [0] talk from Computer Chaos Club also points out how all applications that use Facebook as authentication option (or even without it) MUST send user data to Facebook Inc. This of course doesn't require a user to have a facebook account. [0] this video