Meta and Yandex are de-anonymizing Android users’ web browsing identifiers

[blaze@piefed.social]

This post did not contain any content.

[limerod@reddthat.com]

You are willingly giving away your data if you are not blocking trackers in your web browser and android apps.

I recommend Firefox +Ublock-origin for web browser and apps liker PersonalDNSFilter or Adguard android app if you can get a license for HTTPS filtering.

[turret3857@infosec.pub]

IronFox + Pi-Hole*

[swelter_spark@reddthat.com]

I use Tracker Control + Invizible Pro + Ironfox.

[swelter_spark@reddthat.com]

I use Tracker Control + Invizible Pro + Ironfox.

[b_tr3e@feddit.org]

Tsss... Firefox, NoScript, Ublock origin and Tracker control (via f-droid.org). Also actively cursing trackers' employees, their wives, children, houses and pets using tradited ancient Roman ban curses. (Yes, I am speaking Latin. And I do have a black cat.)

[ulrich@feddit.org]

I don't know that blocking trackers would solve this problem but it sounds like simply not installing the native apps would.

Meta and Yandex achieve the bypass by abusing basic functionality built into modern mobile browsers that allows browser-to-native app communications. The functionality lets browsers send web requests to local Android ports to establish various services, including media connections through the RTC protocol, file sharing, and developer debugging.

A conceptual diagram representing the exchange of identifiers between the web trackers running on the browser context and native Facebook, Instagram, and Yandex apps for Android.
While the technical underpinnings differ, both Meta Pixel and Yandex Metrica are performing a “weird protocol misuse” to gain unvetted access that Android provides to localhost ports on the 127.0.0.1 IP address. Browsers access these ports without user notification. Facebook, Instagram, and Yandex native apps silently listen on those ports, copy identifiers in real time, and link them to the user logged into the app.

[maximus421@lemmy.world]

You're willingly giving your data away as soon as you buy a smartphone. Just using FF and UBO isn't doing anything to help that.

I'm baffled as to how you seem to believe these two things somehow are making your personal data untouchable. There is no reality that exists where you aren't giving up an enormous amount of personal data.

Those things only help make the web less annoying.

[limerod@reddthat.com]

I'm not using any Meta or standard service to justify funneling any data from my side to them.

My setup blocks most trackers and ads than the average person. I do not even see ads on my phone be it a website or a native app. I reduce my reliance on google only to what's needed. Others do not get it unless needed. This reduces data collection to a high degree.

This loophole for example did not touch my phone since ads and trackers are already blocked to a high degree.

[maximus421@lemmy.world]

Aaaaand...

You're still giving hoards of data away.

Until you realize how this is possible, you and me cannot have this conversation.

[limerod@reddthat.com]

Well, I do need to exist a certain degree in this world/society by giving away from some data.
I'm already an outcast in a way that I do not use popular social media apps/websites most people use.

I can stop more data collection by installing Linux, AOSP, GrapheneOS with bare minimum apps from fdroid.

I could've done that but would be making my life more difficult for little gain.

[maximus421@lemmy.world]

Exactly. You get it.

Limiting the data being thrown out the window is doable. You'll see folks trying to "De-Google" which is understandable. But you're effectively changing the entire way you use the internet. So if that's something you're comfortable with, there's that.

[zak@lemmy.world]

This exploit involved Meta and Yandex apps running servers on your phone which Javascript embedded in trackers would communicate with. You'd have to both allow their trackers and have their apps installed to be affected.