Mastodawn

Viss Jun 11, 2025

the tl:dr is basically this:

- fb/ig open local ports on your phone
- your mobile browser hits a site, and facebooks javascript sends cookie data to "localhost:<that port>", so now fb/ig have data on the site you just visited

incognito mode doesnt matter, cuz you just outed yourself to them.

vpns dont matter, because both actions are 'on your device', using local sockets.

you cant trust facebook.

Viss Jun 11, 2025

add graph.facebook.com to your firewall to prevent outbound traffic, or add it to your internal dns as 127.0.0.1.

@Viss I'm shocked actually, that it wasn't already on the (mostly standard) blocklists I had on pi-hole. Trivial to add now, of course.

@tim_lavoie the tracking pixel may have been in things like ublock, but i dunno about graph.facebook.com. id hafta go look. but its definitely in my firewall now

@Viss Right, you need something that inspects the contents for the pixel I think, IIRC it was just www.facebook.com (which I would be fine to block, but…)

If the graph is fair game to nuke though, I see no downsides even for the rest of the home network.

@tim_lavoie you gotta block in multiple places. firefox on mobile and an in browser blocker, then something like adguard or pfsense at the firewall

@Viss For sure, family's mobile devices are the leaders in nonsense requests, or attempts at same (judging from pi-hole).
I should get something software-based for my wife's iOS devices at least, for the the things that aren't domain-level blocks.

@tim_lavoie is that even possible on apple?

Tim Lavoie

@Viss There are apps that claim to help, often commercial. I do have free AdGuard on my phone, but not sure how much it actually sees.

I suspect anything that works at the Safari level is probably fine, and anything that is blobbed into random apps' ad APIs is a shit-show.

@Viss By the way, nobody's complained about the couple-hundred-ish blocked requests to graph.facebook.com in the last few hours, so I think that can stay there.

@tim_lavoie excellent

@Viss Oh for sure, though I suspect I should make a point of blocking DNS over HTTPS too, both for my own visibility, and because I expect the app vendors to lean on easy bypasses.

@tim_lavoie disable it everywhere you can. @da_667 was right - that shit was invented to bypass your ability to introspect what dns queries are happening. which means telemetry, usually.