390
submitted 1 month ago by george@feddit.org to c/privacy@lemmy.ml

Meta devised an ingenious system (“localhost tracking”) that bypassed Android’s sandbox protections to identify you while browsing on your mobile phone — even if you used a VPN, the browser’s incognito mode, and refused or deleted cookies in every session.

This is the process through which Meta (Facebook/Instagram) managed to link what you do in your browser (for example, visiting a news site or an online store) with your real identity (your Facebook or Instagram account), even if you never logged into your account through the browser or anything like that.

Meta accomplishes this through two invisible channels that exchange information:

(i) The Facebook or Instagram app running in the background on your phone, even when you’re not using it.

(ii) Meta’s tracking scripts (the now-pulled illegal brainchild uncovered last week), which operate inside your mobile web browser.

all 50 comments
sorted by: hot top controversial new old
[-] tfowinder@lemmy.ml 113 points 1 month ago

Meta is cancer for any platform.

I feel my mobile becomes dirty once I download any of that shit.

[-] NeedyPlatter@lemmy.ca 14 points 1 month ago* (last edited 1 month ago)

Same Unfortunately, I use Marketplace for some things and Meta made it damn near impossible to use a browser for posting marketplace listings and responding to DM's

[-] skisnow@lemmy.ca 10 points 1 month ago

I live in a slightly less developed country where as far as 90% of the population are concerned, Facebook is the internet.

I hate it with a passion, but if I don't have a login then there's no way for me to find details of pretty much any business or event in the city.

[-] O_R_I_O_N@lemm.ee 3 points 1 month ago

Craiglist and eBay still exists

[-] NeedyPlatter@lemmy.ca 18 points 1 month ago

Yes, but Facebook has more people so the items I'm selling typically get picked up pretty fast.

[-] felsiq@lemmy.zip 12 points 1 month ago

This is the problem with the network effect, everybody using marketplace is saying the same thing. I’m not trying to shame you in particular for this or anything but I think it’s important to consider that at some point if we don’t just make the move off anyway, nobody ever will

[-] O_R_I_O_N@lemm.ee 1 points 1 month ago

That's a ridiculous assertion. More items that EBay? Where'd you get that idea?

[-] Gork@sopuli.xyz 13 points 1 month ago

People are generally closer physically in Facebook marketplace compared to the global eBay market.

[-] NeedyPlatter@lemmy.ca 3 points 1 month ago

This is a big factor for me. Attracting local people means that I can meet up in person and not have to spend additional money for shipping ,or worry that the item arrived damaged or is lost during transit.

[-] lobut@lemmy.ca 45 points 1 month ago

I can't remember which one of my phones, probably a Samsung that had Facebook installed and couldn't get rid of it. People were like, you can just not open it or something. There's a good reason I don't want it on my device.

[-] NotMyOldRedditName@lemmy.world 20 points 1 month ago

I had one of theirs like that. You could disable it instead of uninstall, and this wouldn't happen, but you couldn't uninstall it.

[-] Peffse@lemmy.world 4 points 1 month ago

The real fun started with Android 12. Google introduced the ability for some preloaded apps to avoid being disabled and prevent ADB shell disable.

[-] hansolo@lemmy.today 37 points 1 month ago* (last edited 1 month ago)

Since January Google has been using browser fingerprinting and IP triangulation to track across incognito windows.

Meta wants in the game as well. Nothing done on a phone with Meta apps is done in isolation.

Edit: seems like only vanilla mobile browsers affected. Brave was not vulnerable, DDG minimally so, and I expect Iron/Waterfox with uBlock would also not have allowed tracking.

https://securityonline.info/androids-secret-tracking-meta-yandex-abused-localhost-for-user-data/

[-] Jarvis2323@programming.dev 9 points 1 month ago
[-] hansolo@lemmy.today 16 points 1 month ago

Let's say you use a VPN, and all your internet traffic comes from an IP in London. 178.238.10.1.

It doesn't matter if you have a VPN, if you log in to anything with any account tied to your real name (yourname@gmail.com), your email and anything done on that London IP are all linked. Google builds a profile on you based on the activity on that IP. AND your browser profile. Private/incognito window or not, if there's a Google tracker on the site, they connect it all. Google doesn't care about private windows. If you go to reddit in a private window on the same IP as your gmail, Google sees that and tracks every page you look at.

So let's say that you log into your email from work. Google now has a treasure trove of new info about you and people you know. Same for FB, who uses the fact that you and someone else were logged on from the same IP range to suggest new friends.

Let's pretend that you live in China and still have access to a VPN and want to learn about the Tienanmen Square Massacre. But the government can ask Google about you. What do you need?

  • an IP never ever used with an account associated with an account with your real name.
  • a no-log VPN that won't tattle on you if asked what sites did you access on a specific date.
  • a browser fingerprint never ever associated with an account tied to your real name.
[-] skisnow@lemmy.ca 25 points 1 month ago

I did a 'download all your data' on Facebook a while back and there wasn't anything about my tracked browser history. Does this mean they've also violated the "users should be able to see the data you have on them" article of the GDPR as well?

I'm guessing they're trying to hide behind weasel shit about the ids being anonymized or something as though it wasn't trivially easy for them to deanonymize....

[-] HelloRoot@lemy.lol 17 points 1 month ago* (last edited 1 month ago)
[-] cardfire@sh.itjust.works 16 points 1 month ago

Yeah, but I saw it this time. And thus, got to learn.

[-] fmstrat@lemmy.nowsci.com 2 points 1 month ago

These were all cross posts. Use a different client.

[-] HelloRoot@lemy.lol 1 points 1 month ago

Yes, by different users at different times, thats my point.

[-] fmstrat@lemmy.nowsci.com 3 points 1 month ago

But the conversation is unique in each community. And each community may not have federated to every instance. This is the Fediverse, not a single site with sub communities.

I do think it would be nice if a client/backend could:

  • Take any cross-post link from the main post
  • Query any description/comments for cross posts
  • Add to the currently displayed comments
  • Tack on descriptions as comment blocks with an @ to the cross posting OP to the displayed description
  • Mark cross-posts as read when main is read

This would be easier in Lemmy, but could be done with a client, Thunder might be interested.

[-] HelloRoot@lemy.lol 1 points 1 month ago* (last edited 1 month ago)

It was posted 3x to the Privacy@lemmy.ml community. Or at least it looks to me like 3 different accounts posted the same thing to this very community.

I don't really care about how it works, I'm just tired of the chan-esque experience where I have to question my sanity because I see the same posts every day.

Just because people that don't actually participate in a given community, thus not seeing the older posts, share the same article because they look for a community that fits and dump it there.

Some subreddits had bots that detected and removed reposts and guided OP to the original post for them to add their discussion points.

[-] fmstrat@lemmy.nowsci.com 2 points 1 month ago

That sounds like a helpful bot.

[-] HelloRoot@lemy.lol 2 points 1 month ago

if (link was posted this week) {don't post}

[-] ultranaut@lemmy.world 16 points 1 month ago

I block Meta via NextDNS, living that Zuck free life is good.

[-] Libra@lemmy.ml 13 points 1 month ago

Or you could just not use their toxic bullshit. I haven't logged into Facebook in like 6 years.

[-] wizardbeard@lemmy.dbzer0.com 16 points 1 month ago

Yeah, but they'll still create a shadow profile on you and track your data anyway. Have a friend with an account? Your name and phone number is known to them. Even without a true identity attached, they will track you from your own devices, and then correlate that with everything else they can at every opportunity.

Also, Facebook is preinstalled as a system app (cannot be uninstalled without adb) on various manufacturer's and carrier's android builds.

[-] Libra@lemmy.ml 3 points 1 month ago

IIRC Facebook was not installed by default on my Samsung A32, and there is no trace of it now so I don't think I removed it. shrug Otherwise, use privacy features in your browser/on your device

[-] zenforyen@feddit.org 3 points 1 month ago

Be brave, do it. I just did it a few months ago. Just push the trigger and delete it. Let it go. They will of course keep the data, but at least not legally anymore.

[-] Libra@lemmy.ml 2 points 1 month ago

I haven't deleted it because there are a couple of people I might theoretically need to get in touch with at some point that I don't have contact with otherwise.

[-] zenforyen@feddit.org 2 points 1 month ago

Fair enough.

I held on to this possibility for similar reasons for years, but after some honest self reflection I cannot say there would be anyone from my past life who is still important and I have no other means to contact, my Facebook bubble from 10 years ago and more is long dead, i.e. similarly inactive.

Maybe giving people an email address, phone number or username somewhere else via Facebook message before leaving for good could also be a solution.

[-] Sir_Kevin@lemmy.dbzer0.com 1 points 1 month ago

You can still use a browser for that occasion. Meanwhile the app is doing things in the background.

[-] Libra@lemmy.ml 1 points 1 month ago

I haven't had the app installed since I got my phone. I don't believe it was installed by default, or if it was I removed it immediately.

[-] airikr@lemmy.ml 10 points 1 month ago

I am so happy that I deleted my account on Fecesbook back in 2019. Plus, I am blocking Meta through RethinkDNS. Can't be more happy!

[-] jaschen306@sh.itjust.works 9 points 1 month ago

I have my own company that helps companies websites. There is a company called 6sense that scares the crap out of me. They are able to use Facebook, insta, and reddit. They are able to assign an id to you, even in incog.

They have some crazy algorithm that can eventually match you to the real you. Then stick you in a cohort to sell to you.

Even if you use brave or Firefox. Doesn't matter.

[-] Almacca@aussie.zone 10 points 1 month ago* (last edited 1 month ago)

It's actually kind of amusing and pathetic to me that they're doing all this malignant privacy breaching, and putting such massive effort into it, but then only using it to serve you advertising, which I largely ignore anyway.

[-] drspawndisaster@sh.itjust.works 5 points 1 month ago

Some people still think it's only advertising and that the advertisements don't work. That's even scarier.

[-] serenissi@lemmy.world 4 points 1 month ago* (last edited 1 month ago)

Who says any of my ~~stalking~~ OSInt accounts is my real identity?

Edit: /s ofc. Who would use those crappy apps on phone anyway.

[-] atlien51@lemm.ee 4 points 1 month ago

Can they do this on iPhone

Also they can only do this if you got fb installed right? Cause I uninstalled insta a while ago

[-] Zenith@lemm.ee 10 points 1 month ago

Any meta service no just FB

[-] atlien51@lemm.ee 5 points 1 month ago

I’m asking if they can still do this if u uninstalled the app on iPhone, the post talks abt android

[-] Zerush@lemmy.ml 1 points 1 month ago

The OS is irrelevant, are the apps which track you

[-] Zerush@lemmy.ml 2 points 1 month ago

Whatscrap, Instaspam, Messenger, MetaAI....

[-] AngrySquirrel@lemm.ee 1 points 1 month ago

Shit. My dad had me install what's app inorder to contact him while he was living abroad.

[-] mintiefresh@piefed.ca 3 points 1 month ago

So would using Firefox and group containers protect against this?

[-] loutr@sh.itjust.works 8 points 1 month ago* (last edited 1 month ago)

Nah, the script connects to a server run by the Instagram or Facebook app and feeds it info, bypassing isolation mechanisms entirely. I think ublock or other script-blocking add-ons might work though.

[-] george@feddit.org 6 points 1 month ago

It says Firefox was also affected. They just mention Brave as not being affected

this post was submitted on 14 Jun 2025
390 points (100.0% liked)

Privacy

40761 readers
740 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS