35C3 - How Facebook tracks you on Android
media.ccc.de0 HN recommenders · 2019–2022
26K views · talk · dated · Uploaded 2018-12-30
A 35C3 talk by Privacy International researchers who captured and decrypted traffic between Android apps and Facebook servers. They show many apps send Facebook device and usage data immediately on launch, even for users without Facebook accounts.
HN cites it as the source for how Facebook's SDK tracks Android users by default.
51:32Behind the Scenes of iOS Security
Black Hat
12:01Why Electronic Voting Is Still A Bad Idea
Tom Scott
51:22USENIX Security '18-Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
USENIX
42:50Defcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
59:2328c3: The Science of Insecurity
28c3
7:26This Video Is Sponsored By ███ VPN
Tom Scott
7:49America Keeps Rejecting an ID Card It Already Has
CGP Grey
49:47DEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome
DEFCONConference
5 comments from Hacker News
if this is related to the Facebook Mobile SDK it seems that it is sending a lot of data home by default and that setting it up for ethical data collection isn't straightforward for most developers[0] [0] at least for android, based on this talk: [VIDEO] (35C3 - How Facebook tracks you on Android) edit: add video title
They shouldn't be sending me to the Play Store ITFP. I can't use Play because I've got no GApps in my phone, so I can't try their app unless I find a copy "somewhere" and convince myself it hasn't been poisoned. I got a reasonably up-to-date Firefox through APKPure, and later on after watching that 35C3 talk [1], I unzipped and grepped all those saved .apks to find the APKPure app itself and Firefox and LingoDeer had the same traces of Facebook's SDK in them. So that's off the table, huh? The ones that I saved from older phones after having gottten them through Play were all fine, but I can't update those without grabbing another phone and letting Google ... play in it. <ducks> Just the other day I asked the Waterfox team for an apk and an md5sum, for the same reason-- though I'd settle for the md5sum alone! But Mozilla has resources WF can barely dream of, and it apparently intends to be a champion for privacy, so this is kinda sad. [1] [VIDEO]
This is tangential, but I really dislike how this YouTube channel always downloads the original video, strips it of all information regarding the speaker and the conference and uploads it to their channel. Even though the original is published under Creative Commons Attribution, it still bothers me that they 1) download and reupload (wouldn't this be better accomplished by a playlist?) 2) strip information that makes it appear they produce the content. I'm curious what other people think about this. Anyway, here is the source [1] from their video description. [1] [VIDEO]
the first things most apps try to do is attempt to connect w/ graph.facebook.com at launch (and periodically) this is true for your banking apps to music apps like Pandora and Spotify you can get Netguard, which functions as VPN/Firewall and get visibility into the data exfilitration that is happening right now on your Android phone (and block some of it). Similar things should exist on iPhone too CCC had some coverage recently, but this has been happening for a long long time - [VIDEO] * google apps are also constantly trying to phone home and panic when they cannot connect to the mothership, causing signficant battery drain... I haven't seen them trying to call facebook directly though
This [0] talk from Computer Chaos Club also points out how all applications that use Facebook as authentication option (or even without it) MUST send user data to Facebook Inc. This of course doesn't require a user to have a facebook account. [0] [VIDEO]