Mastodawn

Korallenherz Jun 11

Apparently, if you have facebook or Instagram installed on your phone, #Meta was able to track your browsing habits and link them to your real identity even if you never logged in on the web, used incognito mode or a VPN. I hope Meta gets hit with every fine in the book.

https://www.zeropartydata.es/p/localhost-tracking-explained-it-could

“Localhost tracking” explained. It could cost Meta 32 billion.

You just can't finish off Zuckerberg.

Zero Party Data

inamruzui Jun 11

@Gargron @Linux

Linux Is Best Jun 11

@Kuniti_shino @Gargron

Yep - I talked about this in my posting. I kept telling people to uninstall their apps for over a year.

inamruzui Jun 11

@Linux @Gargron yea and would get rid of my highly modded oculus quest 2 if i could afford to replace it and get a deckard (if it came out) since facebook integrated so much telemetry in it (saw from blokada)
(oculess which can disable things completely breaks it)

Linux Is Best 6d ago

@Kuniti_shino @Gargron

Let me share something creepy about oculus? We use it to map people's homes. As you walk around with that thing, we use it to identify products you have, and provide ads based on what is found in your house. We also use (sell) this information for companies looking to design homes, and how people use them. I also know that the layout of people's homes is being used to train AI, plus improve facial recognition of anyone in your home.

inamruzui 6d ago

@Linux @Gargron aware

The mic is also disabled (damaged ribbon cable) on the headset and i notice even with the mic disabled it tries to activate the "ai" voice thing

@Linux @Gargron @Kuniti_shino i wonder if this also works in this setup: all obscure shit apps are running in the work profile of android. managed via shelter, when finished usingz shelter can freeze the apps.

@Linux @Gargron @Kuniti_shino The only Meta app that I have installed is whatsapp, and just because it is so fucking impossible to convince most of my contacts (family etc) to switch to signal (for instance).
Whatsapp is not in that list, but It is quite likely that the same issue applies.

@Linux @Gargron @Kuniti_shino My question is. Is there a "box" that can isolate whatsapp in your android (or /e/OS, in my case?

Queroseno 6d ago

@aurochs @Linux @Gargron @Kuniti_shino

I jump into here for a solution, a rubbish solution indeed, but a solution nevertheless.

You can use beeper, configure it whatsapp, install beeper on your phone and remove whatsapp, or use whatsapp in a secondary phone that lives turned off in your drawer.

Now this is not a perfect solution, it has some advantages like, now you can't receive whatsapp calls (this is a feature) but the caller will think you are ignoring the call.

You have absolutely broken the E2E, now you trust beeper with your information. You also break E2E not only for you, but everyone that contacts you.

Finally, all the metadata that Meta has and share with whoever might require it, it is still there, I think. Just with beeper in between, but connection, messages sent at what time, etc... is there to be used against you.

You can't decipher privacy images, audios or text in beeper. You used to be able to, but they removed it.

However, you don't have a meta app installed.

I did said it was a shitty solution.

@aurochs @Linux @Gargron @Kuniti_shino Maybe this? https://f-droid.org/packages/io.kuenzler.whatsappwebtogo/

WhatsApp Web To Go - Mobile Client for WhatsApp We | F-Droid - Free and Open Source Android App Repository

Access WhatsApp Web on your mobile device - send pictures, audio and video

@mudaste @Linux @Gargron @Kuniti_shino Interesting, but does it prevent tracking in any manner?

@aurochs @Linux @Gargron @Kuniti_shino I suppose what this app does is isolate WhatsApp from the rest of the system by acting as a sandbox.

Little Art Histories 6d ago

@aurochs @Linux @Gargron @Kuniti_shino The family is not a problem, they all are willing to do a switch but the official things like school messages, my music club, dog trainer, etc. are a problem.

@art_histories @aurochs @Linux @Gargron @Kuniti_shino
Exactly! I got my family to switch. Not so easy with the local club. I just run WhatsApp on an old phone, which has been wiped and is used for nothing else.

@art_histories @aurochs @Linux @Gargron @Kuniti_shino We have to start, and then, slowly, all that people will abandon WhatsApp (when they know you are not using anymore).

It's like a snow ball, each time bigger

Strider Longshanks 3d ago

@art_histories @aurochs @Linux @Gargron @Kuniti_shino had this very issue last week on a business trip abroad with fellow professionals from different firms. Virtually all of them were on WhatsApp and chose that as the means by which we were to communicate within the group. In the run-up to the trip I mentioned I was on Signal only and that provoked a variety of disdainful smirking. What can I say, there's still a lot of education to be done.🤷

Le Freak 🐧6d ago

@aurochs @Linux @Gargron @Kuniti_shino

Exactly this, I wish more people switched to either signaal or session.

Emanuel Pina Jun 11

@Gargron As usual, the fine, if happening, will be a small fraction of their annual revenue. So, it'll be more a tax for doing business than exactly a fine.

Piranahallama 1d ago

@emanuel @Gargron when the fines are smaller than the profit they become the cost of doing business.

Looking at when meta seemingly introduced this and profits they got some benefit, but with growth it's not huge. Assuming max fine which I doubt will happen.

As horrible as censorship or refusing a company doing business feels, sometimes it's the only answer if you can profit your way out of fines.

Dark Phoenix 🇺🇦🇨🇦🇬🇱🇵🇦🇵🇸🏳️‍🌈Jun 11

@Gargron if this goes to a class action, I want in.

@Gargron Mark Suckerberg's #meta is as #evil as #bigtech goes - one needs look no further than at what IG does to kids - so this is no surprise. On hindsight, good decision not to use neither f*book nor IG.
#breakupBigtech

Aulia Masna Jun 11

“You’re not affected if (and only if)

• You access Facebook and Instagram via the web, without having the apps installed on your phone
• You browse on desktop computers or use iOS (iPhones)
• You always used the Brave browser or the DuckDuckGo search engine on mobile”

@aulia @Gargron does brave protect against tracking pixels?

Pianosaurus 🕴Jun 11

@aulia @Gargron "or the DuckDuckGo search engine". I wonder if this part is a misunderstanding. The tracking works by using webrtc to localhost (locally installed app) from JS on a page. How you got to that page seems irrellevant to me.

@pianosaurus @aulia @Gargron WebRTC is the biggest fucking cancer. Why is this shit on by default everywhere? This feature literally exposes your actual IP and thus location to anyone accessing it because it thinks you want to do P2P video chat. ?!

Pianosaurus 🕴Jun 11

@rejzor @aulia @Gargron On a phone with locally installed apps, I just assume my IP is public knowledge anyway. Seems like a safer assumption. I agree though that WebRTC should not work everywhere by default. Why not ask the user, like browsers would for microphone and camera access?

@pianosaurus @aulia @Gargron Not only that, some browsers allow easy disabling of WebRTC in settings, Firefox for example requires you to use about:config "secret" settings page. On Android, you can't even do it in Firefox because there is no access to these settings like it is on desktop.

Marcos Dione 6d ago

@pianosaurus @aulia @Gargron I just noticed that uBlockOrigin (which on desktop I use in firewall mode, all 3rd parties disabled) has complained about 127.0.0.1. Maybe its this. I think I set it to allow; time to change that.

Arjen Haayman 6d ago

@aulia @Gargron That 3rd bullet point is a mystery. This thing is not browser or search-engine dependent

Aulia Masna 6d ago

@haayman @Gargron perhaps but that’s what they said on the post

Arjen Haayman 6d ago

@aulia @Gargron I know. Raised eyebrows there

Eugen Rochko 6d ago

@haayman @aulia There is a DuckDuckGo browser. Maybe that’s what they meant.

Szymon Nowicki 6d ago

@Gargron @haayman @aulia still not relevant, even MS Edge has nowadays tracking blockers built-in. All browsers except Chrome.

William B Peckham 6d ago

@hey @Gargron @haayman @aulia I love your faith in chrome being without trackers. It just has different ones. Excellent reason for using a FOSS browser. I'm looking forward to Ladybird getting finished up and released.

@Gargron @haayman @aulia maybe they mean the app tracking protection feature from DuckDuckGo, which doesn't have to do anything with browsing. It sounds like that would protect against this.

sandywb14 Jun 11

@Gargron This is huge.

Lazarou Monkey Terror 🚀💙🌈Jun 11

@Gargron Meta have plundered from the Commons. It's time to make them pay it back.
#Meta

ZenHeathen 🏳️‍🌈Jun 11

@Gargron Facebook is evil

young man yells at the cloud Jun 11

@Gargron "You’re not affected if (and only if)

You access Facebook and Instagram via the web, without having the apps installed on your phone

You browse on desktop computers or use iOS (iPhones)

You always used the Brave browser or the DuckDuckGo search engine on mobile

"

This is not what "if (and only if)" means.

Mïkê 💚 👑🐉🗡️🏳️‍⚧️Jun 11

@bamboombibbitybop @Gargron How so? It seems right to me

young man yells at the cloud 6d ago

@mikelovesbikes @Gargron you could also not have a Facebook account, or not have the app installed, etc.

Plus, implying Brave browser or the DDG app is the only way to protect against this is not true. For example, Firefox with the NoScript extension would have stopped this too.

ProgGrrl ❌👑Jun 11

📌

Rich 🌈 🟥 🍁 🟥Jun 11

@Gargron I wish. But rules are for other people than tech bros.

Violet Madder Jun 11

I thought everyone already knew this was happening.

Honestly, everyone who understands this shit has been outraged the entire time. Are courts or antitrust things or privacy laws even relevant anymore? Is everybody really waiting around for cops to fix it?

Mx Verda Jun 11

@violetmadder @rich @Gargron If Mark Zuckerberg wouldn't let his kids use Facebook, then he needs to stop pushing anyone's kids to use it, whether they survived past 18 years old yet or not.

@Gargron unfortunately, no surprise here 😭😭😭

Dave Carlson Jun 11

@Gargron this is so creepy!

it's like those "i know what you did" crypto scan emails but for real

@Gargron Known for some time. They monitored the speaker vibrations. In some instances, converted the phone call to text. The difference between the various notifications, vibrations for phone calls, messages, notifications. makes for good data points.

Similar to carriers and FBI forensically reversing someone tracks. Don't need the number, when you have everyone's data points, cell pings. Not everyone can be everywhere at the same time and patterns emerge.

Tokyo Outsider (337ppm)Jun 11

@Gargron Thank you for sharing. Weren't Google's rigorous security audits of all apps on its app store supposed to catch things like this? 🤔

Darwin Woodka Jun 11

@Gargron haven't allowed it on my phone in years and it is fully banished to Duckduckgo on the computer

@Gargron Is it able to track Tor Browser activity on Android as well? 💀

Farshid Hakimy / فرشید 6d ago

@romanumbral @Gargron localhost seems to be blocked on the Tor browser
https://tor.stackexchange.com/questions/11994/how-to-access-local-host-through-tor-browser#22464

@farshidhakimy @Gargron Phew, thank goodness

wanttoknow72004 Jun 11

@Gargron Has a class action suit been filed?

Vanni Di Ponzano ⁂🚴 ❤️ ☕ 🍎Jun 11

whack these guys hard!

And as for Zuckerberg... 4 years in the dungeon.

You CAN just finish off Zuckerberg

Theresacityinmymind Jun 11

...says the guy who invited Meta to interact with Mastodon.

mcSlibinas Jun 11

@Theresacityinmymind @Gargron and what? Even your instance allowing to reach threads you can block meta for yourself.
What's the point of your comment? 👀