394
Meta could track your browser sessions even in incognito and link them with your real identity (www.zeropartydata.es)
submitted 1 year ago by to c/privacy@lemmy.ml
55 comments fedilink hide all child comments
 

Meta devised an ingenious system (“localhost tracking”) that bypassed Android’s sandbox protections to identify you while browsing on your mobile phone — even if you used a VPN, the browser’s incognito mode, and refused or deleted cookies in every session.

This is the process through which Meta (Facebook/Instagram) managed to link what you do in your browser (for example, visiting a news site or an online store) with your real identity (your Facebook or Instagram account), even if you never logged into your account through the browser or anything like that.

Meta accomplishes this through two invisible channels that exchange information:

(i) The Facebook or Instagram app running in the background on your phone, even when you’re not using it.

(ii) Meta’s tracking scripts (the now-pulled illegal brainchild uncovered last week), which operate inside your mobile web browser.

you are viewing a single comment's thread
view the rest of the comments
[–] 37 points 1 year ago* (last edited 1 year ago) (1 child)

Since January Google has been using browser fingerprinting and IP triangulation to track across incognito windows.

Meta wants in the game as well. Nothing done on a phone with Meta apps is done in isolation.

Edit: seems like only vanilla mobile browsers affected. Brave was not vulnerable, DDG minimally so, and I expect Iron/Waterfox with uBlock would also not have allowed tracking.

https://securityonline.info/androids-secret-tracking-meta-yandex-abused-localhost-for-user-data/

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 9 points 1 year ago (1 child)

    What is IP triangulation?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 16 points 1 year ago

    Let's say you use a VPN, and all your internet traffic comes from an IP in London. 178.238.10.1.

    It doesn't matter if you have a VPN, if you log in to anything with any account tied to your real name (yourname@gmail.com), your email and anything done on that London IP are all linked. Google builds a profile on you based on the activity on that IP. AND your browser profile. Private/incognito window or not, if there's a Google tracker on the site, they connect it all. Google doesn't care about private windows. If you go to reddit in a private window on the same IP as your gmail, Google sees that and tracks every page you look at.

    So let's say that you log into your email from work. Google now has a treasure trove of new info about you and people you know. Same for FB, who uses the fact that you and someone else were logged on from the same IP range to suggest new friends.

    Let's pretend that you live in China and still have access to a VPN and want to learn about the Tienanmen Square Massacre. But the government can ask Google about you. What do you need?

    • an IP never ever used with an account associated with an account with your real name.
    • a no-log VPN that won't tattle on you if asked what sites did you access on a specific date.
    • a browser fingerprint never ever associated with an account tied to your real name.
  • permalink
  • fedilink
  • source
  • parent