so this local mess thing is a pretty huge deal.

also, if youve ever wondered "how the fuck does instagram know this shit, are they listening to me?!"

well.. yes, they are (https://futurism.com/the-byte/facebook-partner-phones-listening-microphone)

but they, until the 3rd of this month, were playing hot potato with their tracking pixels that live on millions of sites, your browser, and fb/ig apps on your phone

https://localmess.github.io/
[edit] oops, had the wrong link for localmess writeup

In Leak, Facebook Partner Brags About Listening to Your Phone’s Microphone to Serve Ads for Stuff You Mention

One of Facebook's alleged marketing partners explained how it listens to users' smartphone microphones and advertises to them accordingly.

Futurism

the tl:dr is basically this:

- fb/ig open local ports on your phone
- your mobile browser hits a site, and facebooks javascript sends cookie data to "localhost:<that port>", so now fb/ig have data on the site you just visited

incognito mode doesnt matter, cuz you just outed yourself to them.

vpns dont matter, because both actions are 'on your device', using local sockets.

you cant trust facebook.

add graph.facebook.com to your firewall to prevent outbound traffic, or add it to your internal dns as 127.0.0.1.

the previous approach was "if you have to use their shit, use the mobile browser vs the app because the app does tons of shady shit"

well, turns out all their javascript all over the internet are like tiny landmines, and every time you step on one, they get a ping about what youre doing.

if you want a real fuckin horrorshow, take a look at the browser inspector next time you hit your bank website (any of em), your doctors site, or any other site and see JUST HOW MANYFUCKIN PLACES have it

why should facebook be getting a ping when i log into my bank, or my doctors website, or trying to book a flight?
@Viss Don't adblockers prevent the tracking pixels/scripts from being loaded?
@three only if theyre in the browser, and and on android you can only do that in mozilla based browsers, and not everybody does it. also, apps like instagram will try to pop an in-app browser instead of using your system one