Wait, so any app on Android with network access can just open a localhost port and then a browser script can share all your private browsing data via that port? Even on GrapheneOS? How is that not restricted?? What’s stopping your banking apps or “sandboxed” Google Play store from doing this and tracking everything?

https://www.theregister.com/2025/06/03/meta_pauses_android_tracking_tech/

#privacy #grapheneos #infosec

  • Alexstarfire
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    You’d need a script in the ad to send stuff to the port. Info doesn’t just magically appear at the port you’re listening to.

    I don’t know enough about ads to know if that’s possible. I also don’t know what info that ad would have access to. It wouldn’t be very useful if it didn’t have access to any info about the site serving the ad.

    • Andrew@mnstdn.monsterOP
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      @Alexstarfire it simply requests random_unique_ID.jpg… The app doesn’t even have to respond - it just takes note of the unique ID. Or in Meta’s case the website just sent a ping and got back a simple HTTP status 200 message. That was enough to confirm you had Facebook installed.
      There’s absolutely nothing stopping the app from serving up actual data, like a credit score from your banking app for example.

      • Alexstarfire
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Why would the app do anything like that? The same company is on both sides of this. They already have that data. The point is to link data from your browser to data they already have about you.

        • Andrew@mnstdn.monsterOP
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          They sell the info to the website! It’s a service. Ad networks. You can look up how this stuff works

          • Alexstarfire
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            They do, but they don’t need to do this in order to facilitate that. The company can just straight up sell the information on most cases. They’ve been doing that well before this exploit(?). Not quite sure how to classify whatever this is.

              • Alexstarfire
                link
                fedilink
                arrow-up
                1
                ·
                1 year ago

                You are conflating separate practices. This is to track your private browsing outside of the browser, which is new.

                • Andrew@mnstdn.monsterOP
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  1 year ago

                  Um yes, that’s the topic of discussion. Since you’re just reply-guying at this point I’m going to cut this off.

                  • Alexstarfire
                    link
                    fedilink
                    arrow-up
                    1
                    ·
                    1 year ago

                    I feel the same way. You start talking about something different but related then don’t like it when you get called out.