If you're on Android, using a firewall app like NetGuard or TrackerControl can block those background processes from phoning home, even if you cant completely uninstall the apps due to work/family.
post
Its probably "better" to use apps like Hermit (Android) and Friendly Social Browser (iOS) for a more compartmentalized while still retaining a bit of the "proper app" feel if thats helpful to weaning yourself off needing to have every platform's first party app and their inevitable tracking
Easy solution: dont have a Facebook account.
Don’t worry, Facebook still creates a shadow profile to know who you are and track you
I know all about this, but I'm at that point where I don't give a fuck anymore. I browse the web with no cookies, and everything that Facebook has is a fake definition of who I am. It's zuck's own little world and it doesn't concern me anymore.
zuck is a fucking pervert who masturbates to my own private information and I cannot do anything about it, so why would I care? I have way more important things to do (like taking care of my family), and people and politicians don't want to do anything about it.
Sure it doesn't affect you, but your data is an important statistic to train zuck's algorithm to keep the other rubes, and children, doom scrolling on that shit platform.
In fact, based on a whistleblower testimony zuck would probably sell your data to the CCP to gain access to their population.
32 billion still is nothing for these scumbags
JAIL MARC ZUCKERBERG ALREADY. That is still what we do with criminals, is it not?
im wondering, does using uBlock help in any way? can they block metas pixel and thereby protect you?
Yes. Because it blocks the meta pixel script from loading to begin with.
I would say it prevents the downloading and execution of such a script. DNS adblock would probably help too.
there is a blocklist with a name like block outsider intrusion to lan, but it's off by default
You’re not affected if (and only if)
You always used the Brave browser or the DuckDuckGo search engine on mobile
I found that odd, but reading the more technical write up (linked in the article) it seems Brave blocks localhost communication.
The Chrome proposal references a single use case. I've never seen a website that sets up my local devices, but is this a new thing?
Why did localhost not get blocked earlier? This seems like a huge hole browsers have ignored for years.
Also the DuckDuckGo exception doesn't make sense to me. Does DuckDuckGo have Facebook trackers on it to begin with? Whatever site DuckDuckGo sends you to, if they have the trackers, you'll get tracked.
I suspect they might mean duckduckgo browser and not search engine?
I completely forgot that existed! Double checking the technical article they do correctly label it as a browser in their testing matrix/grid.
I just got confused by the clear "Brave browser" call out. When I hear DuckDuckGo I definitely don't think browser.
Good catch!
On pc jetbrains toolbox uses localhost to login via browser for some reason, which was blocked by one of my extensions
Also if you don't have the Facebook or instagram apps on your phone.
Because if they were to block it, it would break lots of things, like when they broke file:// and users have no way to turn it back on except enable dev mode or debug mode, let alone having some easy way to toggle it on a per domain or per container basis..
Its reliant on running a normie phone and OS, and running the native FB, instagram, or other apps in the Meta constellation. These apps create persistent services that internally backchannel sensitive browser data back to them via internal ports. All browser traffic on devices running these apps should be considered compromised.
The solution is to run Graphene or other de-googled OS and avoid Meta apps like the plague.
The solution is to have stronger privacy laws.
If everyone followed your solution then Graphene will become the normie os and Facebook will start targeting it. Choosing an esoteric system for yourself is a good way for a free people to protect their privacy, but it won't scale.
When we write our new constitution we need to include privacy as a right.
grapheneOS isn't security through obscurity, they make efforts to harden the phone's privacy. You're right that, if it was mainstream, Meta would target it directly though.
The solution is to remove the profit motive from acquiring, selling, and monetizing our data. Laws alone don't stop big corps from doing things.
The solution is to have stronger privacy laws.
Many people have the power to make certain privacy attacks impossible right now. I consider making that change better for those people than adding a law which can't stop the behavior, but just adds a negative incentive.
I wouldn't wait around for the law to prosecute MITM attacks, I would use end to end encryption.
Choosing an esoteric system for yourself is a good way for a free people to protect their privacy, but it won't scale.
If this is referencing using a barely-used system as a privacy or security protection, then I would regard that as bad protection.
Everyone using GrapheneOS would be a net security upgrade. All the protections in place wouldn't just fade away now that Facebook wants to spy on that OS. They're still in place; Facebook's job is still harder than it otherwise would be.
The problem is that GrapheneOS is only available for Pixel devices.
I really wish they would support other manufacturers, because I don't really trust Google to make decent hardware (and to be frank, I don't trust them with anything at all).
I use e/os which is at least de-googled & based on Lineage
Its not exactly Graphene but it works on 8+ old devices of various manifacturers
I am very keen to get a Fairphone with e/os next time I switch devices.
Does it work well with Android Auto? I can't drive much without a map and my music playlist.
did not test that but here is a page how to "google" the "de-googled" os for supporting that
https://doc.e.foundation/support-topics/android-auto
because of that lineage could be a better option
About Fairphone: there is an alternative (Shiftphone) that is more expensive but with the main plus points of having a higher storage option and the mainboard is replaceable, they also have somewhere a cheap (~200€) phone that should work if you really just need a phone
(i mention that as an option, because having choice is always better even if it ends up being the first thing that gets choosen)
The solution is public execution of at least a few tech CEOs. Then you'll see how quick the invisible hand of the market seems to stop demanding profit maximization via spyware.
Don't forget to also select a few shareholders for the sacrifice, those are what CEOs try to please.
Almost sounds like you're blaming the user while also not understanding that a de-google phone isn't the solution because it's not part of the tracking.
While this is true, it's worth clarifying that GrapheneOS in particular is able to run apps sandboxed, so they can't communicate with eachother as they can on a stock OS.
Having said that, no one should expect that their right to privacy is given (or fought for), unless they take it first. Yes, laws and all, but user education is the bigger issue.
Users were onboarded onto the Internet before they had an understanding of the differences between cyberspace and meatspace, and how that could affect them. Placing the blame (and solutions) solely on third-parties is a dangerous mistake.
No, it is Meta and these companies fault, but I focus on things I can actually control. Just spewing the party line default Lemmy opinion of "capitalism is the problem, blah" doesn't do anything to solve the problem.
Educating people so they understand how the surveillance works, and explaining that there are alternatives, actually gets us closer to a solution.
I used Facebook on my GOS phone. I thank Meta for refreshing my weariness of big corp.
The solution is to
run Graphene or other de-googled OS andavoid Metaappslike the plague.
FTFY
Doesn't matter what OS you use.
Hmmm. That reminds me that I need to check to make sure the router is blocking all Facebook traffic.
I can't see from this article whether "could cost" means there are lawsuits ongoing/pending, or just the author has speculated what the fine could be if there were a lawsuit?
Despite the fact that this article explains the same thing like 5 times in a row as if I'm an idiot ... uh, damn, Meta. Let me make sure I don't have your apps on my phone.
As if they'd impose maximum penalties, no matter how deserved. But hey, fingers crossed!
And imho the whole issue can be avoided by using mobile websites and/or alternative app front-ends for meta services, if you can't steer clear of them altogether.
And blocking apps from using background data should seal the deal.
I have webrtc completely disabled in browsers.
I tell everyone, and I abide by : never use an app if you can use the website. If they only have an app be prepared to be fucked.
I also use a VPN / firewall / DNS filter (by domain and by IP). Rethink or invizible provide all 3 in 1 on android. On linux rotating VPNs, rotating local DNS resolvers [dnscrypt-proxy with local doh with blacklists], and strict firewall rules.
*Facebook* , *meta*, *Instagram* etc are blocked in and out. As are Google "safety" domains, and a lot of their APIs.
Privacy may be inconvenient, but selling (giving away for likes) your soul to the devil could cost you a lot more.
Same here, in my productive browser (Fennc on mobile, stock Firefox on desktop) WebRTC is blocked. I keep a chrome variant around in case anything truly doesn't work (Cromite on mobile, Edge on Windows, since I have to use some MS applications for work that I don't care to install on my system).
I rotate VPN servers, not services though.
Ok, I'm a cranky old nerd. I'll say some silly shit here ...
Nobody should have the Facebook or Instagram apps installed on their phone.
For one thing, those are websites. You don't need the app.
For another, they kill your battery because they are so damn busy spying on you.
Really, there have absolutely always been known privacy issues with those. This whole thing was known well before they proved the exact method
Until this phone, Facebook always came installed and couldn't be uninstall without hacking the phone.
In the phones I've had, you could deactivate it even if it can't be uninstalled.
It could cost Meta 32 billion.
US law: "Best I can do is 15 thousand."
EU law: "How about percentage of global revenue per infraction?"
Meta: "Okay. 0.00001%".
They don't ask them what they want to pay or what they claim the revenue was, they look at the numbers:
Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.
https://gdpr-info.eu/issues/fines-penalties/
Although realistically speaking they're probably just getting fined for one "infringement", despite committing quite a lot.
Sounds like they can't track people that don't have their app. So, not something I need to worry about.
...but what about everyone you are frequently interacting with? Not as bad obviously but I don't think you fully escape the effect is what I am saying.
That doesn't matter for this particular issue as far as I can tell. This is about tracking what Facebook a user does on their device outside of the Facebook app. Even if I used my friend's phone who uses Facebook, it would count toward their profile. Same as if someone else watches stuff on your Netflix profile.
I don't have the Facebook app nor do I have an account. This method of tracking is useless for those like me.
Facebook definitely has pictures of me that others have posted. People talking about me, etc. Not sure there's anything I can do about that.
Meta casts a wide net with all their apps. Maybe someone deletes their Facebook app but still needs WhatsApp to communicate with family, for example. I love the idea of that app in particular "not looking at your messages" while it learns about all your out-of-app browsing behavior without your knowledge or consent.
FYI you sound incredibly self-centered and unpleasant.
Because I don't use Facebook? That's new.
Of course it's self centring; you're not thinking about the money billionaires could make from your data, you communist! How will their children eat?
Because you indicate that you don't care if it happens to others as long as it doesn't happen to you.
You're reading a lot into the two sentences I posted. AKA, making shit up.
In real life people think it is weird that I don't use apps; even if this is obvious to us, we are also a bunch of anarchists on a defederated internet forum. Explanations and examples like this will help us protect the normal people who don't think like us (yet).
I'm curious if Meta could do this with their apps, can other apps do something similar?
I doubt a lot of Lemmy users have got those apps on their phones. Although I am curious about how it would affect people who, say, used Island or similar (leverage the Work profile) to install them as I have seen that suggested in privacy communities before. Would Meta only be able to access other apps installed to that profile - if you had a browser installed in it too for example?
Really curious how Android sandboxing was so easily defeated. Were those ports left open for extensions or something? I need to read up on this exploit. It’s so brazen, but also shouldn’t be possible. 8 years of stolen data. Wild.
Update: apparently it’s worse than I expected.
Access to localhost is simply not restricted by the OS at all. Inter-app communication via localhost is unregulated, even within a browser runtime “sandbox” (not a true sandbox apparently).
The only reason Brave wasn’t affected is that it required additional user permission for localhost access, so the tracking script halts in that browser to avoid detection.
The reason this is worse is that it means not only can a browser tab “talk” to local apps through specific ports, it can use any port, can talk to other browser tabs, and apps can share data with each other without restriction. If I’m understanding the scope of this loophole, it’s a glaring vulnerability that’s been there from the beginning, and it’s unlikely Meta is the only company to exploit it.
ETA: this is what I gathered from reading the paper. I still need to do my own testing to confirm. In the meantime if anyone knows more feel free to correct any of the above.
Isn't that their revenue for a quarter? If so this is nothing...
I'm so glad I've never installed any of meta's apps and never used any of their services and never will.
I bet they're doing this with WhatsApp too. The "privacy" focussed messenger service. I just wish there was a way to get everyone I know to stop living in it like a fish in water.
You wont like the rest I have to tell you. The problem isnt whatsapp. Its the system. Its needs to go.
It's an exploit in android, yes. But it's meta who found it and instead of responsibly reporting it they took advantage. A parasitic move from a company that shouldn't exist.
They. Don't. Care.
You’re not affected if (and only if)
-
You access Facebook and Instagram via the web, without having the apps installed on your phone
-
You browse on desktop computers or use iOS (iPhones)
-
You always used the Brave browser or the DuckDuckGo search engine on mobile
all 8 comments