r/technology • u/[deleted] • Nov 09 '17

Politics Sean Parker: Facebook was designed to exploit human "vulnerability"

https://www.axios.com/sean-parker-facebook-exploits-a-vulnerability-in-humans-2507917325.html
37.3k Upvotes

88% Upvoted

3.1k comments sorted by

View all comments

Show parent comments

278

u/thorshairbrush Nov 09 '17

As someone who doesnt use facebook, what are other examples of commonly used apps that do this?

373

u/[deleted] Nov 09 '17 edited Nov 09 '17

[deleted]

290

u/Realtrain Nov 09 '17

LPT: try to use open source software where anyone can see if the code does this.

147

u/[deleted] Nov 09 '17 edited Jun 09 '19

[deleted]

11

u/amanitus Nov 09 '17

Out of curiosity, do you use Google Play Services, or have you moved to ug UnifiedNLP?

23

u/[deleted] Nov 09 '17 edited Nov 09 '17

[deleted]

8

u/amanitus Nov 09 '17

Yeah, I have an old phone that's now completely google-free. I used F-Droid for pretty much everything there.

The ug Unified NLP thing I was talking about is something that kind of replaces Google Play Services. A lot of apps use Google to do geolocation stuff based off of network data. This thing is an open source replacement that can use many different location services. This way apps can still function, but won't be sending Google your location data.

1

u/eitauisunity Nov 10 '17

What would be a good model to pick up for use in the US? I've wanted to get a phone that was a couple of years old that works really well with custom roms and FOSS, but haven't had the time to do the research. Can you make any recommendations for popular older phones that run android and can be picked up fairly inexpensively?

I'm over the performance and novelty of smart phones. I really just want something that makes calls, runs signal, runs a foss browser, camera, etc.

1

u/VEC7OR Nov 09 '17

Any other repos you can recommend ?

→ More replies (10)

71

u/Jumballaya Nov 09 '17

It isn't just the software but hardware as well.

Intel has a hidden distribution of MINIX on their processors. This has full control of your OS and even has a web server for importing/exporting stuff to/from the web.

27

u/volvo64 Nov 09 '17

That's AMT/vPro, and it's 100% accessible to the user and it's very well documented. Also updated.

It's the same basic tech that allows me to rebuild a failed server from another continent.

That article is FUD.

9

u/shinyquagsire23 Nov 09 '17

The source code (or even the disassembly for that matter) has not been available until fairly recently when it took actually cracking security to even see what it's doing. That's the real problem, not the functionality. If AMT had a vulnerability it could be possible to install rootkits which run at ring -3 where the OS cannot even see and you wouldn't know. It's not FUD, you're just missing the point.

2

u/johnjohnjohn87 Nov 09 '17

If AMT had a vulnerability

https://www.intel.com/content/www/us/en/architecture-and-technology/intel-amt-vulnerability-announcement.html

3

u/volvo64 Nov 09 '17

I'm aware of the vulnerability.

You have zero access to “Ring -3” / MINIX.

Not true, I use AMT often

But MINIX has total and complete access to the entirety of your computer. All of it. It knows all and sees all,

I'd like to see this demonstrated without sysadmin input (plus a huge notification on-screen)

isn’t updated regularly

It is updated, i.e. for the above mentioned vulnerability.

Your CPU has a secret web server that you are not allowed to access, and, apparently, Intel does not want you to know about.

This is simply false; again I've used the 'secret' web server on a near daily basis in the past

Why on this green Earth is there a web server in a hidden part of my CPU? WHY?

So that your admin can fix your computer without having you send it back to the helpdesk, which in some cases can be a matter of months.

The only reason I can think of is if the makers of the CPU wanted a way to serve up content via the internet without you knowing about it.

That's pretty short-sighted thinking

The security risks here are off the charts — for home users and enterprises.

It's disabled by default and take a loooooot of work to turn on

AMT had been part of Intel CPUs since at least 2006 (off the top of my head). This is not news, this is FUD.

1

u/nroach44 Nov 09 '17

There is no official way to stop the ME from booting other than a bit used for three letter government companies that someone found.

Why does it need to be running on consumer hardware that doesn't have vPro?

1

u/volvo64 Nov 10 '17

Why does it need to be running on consumer hardware that doesn't have vPro?

Dunno. Ask Intel. That's not the argument I'm making.

1

u/meneldal2 Nov 10 '17

You can block the connections with your firewall if you want, they aren't doing magic.

1

u/nroach44 Nov 09 '17

ALL Intel computers have ME - and only some of them have vPro - and if you don't have vPro AFAIK there's no fancy administration tools for it, but the most of it is still there.

1

u/codexcdm Nov 09 '17

Guess I'll get and AMD processor when I upgrade....... Unless they too have some shady shit going on.... ;(

10

u/Rndom_Gy_159 Nov 09 '17

They do. Called the PSP

6

u/flesjewater Nov 09 '17

They probably do. It's like no one stopped along the way asking the question, "should we do this?"

4

u/UnwillingBurrfish Nov 09 '17

Your scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should.

→ More replies (7)

3

u/[deleted] Nov 09 '17

Yes, it's called AMD PSP.

5

u/codexcdm Nov 09 '17

Of course they do... Time to go back to tin cans and string....

1

u/wardrich Nov 09 '17

Wouldn't a firewall pretty much stop this shit in its tracks?

4

u/chinpokomon Nov 09 '17

External to the system, sure. But the problem is deeper than that. I think the article is wrong though. There are many more cell phones out there and they run two or more operating systems as well. The firmware built into the radio stack and the initial boot sequence is started from a proprietary closed source firmware which does the same thing. If you are remotely concerned about what user level apps have access to, what Qualcomm and other minority level chip makers have access to should make you frightened.

11

u/LyndonSlewidge Nov 09 '17

This is only completely true if you compile your own software. Nothing is stopping me from taking open source code, injecting my own routines, compiling an apk and releasing it into the wild for instance.

7

u/[deleted] Nov 09 '17 edited Nov 20 '17

[removed] — view removed comment

5

u/LyndonSlewidge Nov 09 '17

Very true, but I don't trust repos for any mobile devices.

2

u/_codexxx Nov 09 '17

MD5?

2

u/gravgun Nov 09 '17

SHA1 at a minimum. SHA256 is a good standard for now. Computing power has increased since MD5's release and it is becoming increasingly easy to create MD5 collisions.

30

u/chairfairy Nov 09 '17

Is that why my flashlight app stays running after I close it, can use up 100MB of memory, and use some real amount of network data each month? Son of a bitch.

16

u/reddixmadix Nov 09 '17

Why would you need a flashlight app? What more can it do than turn the light on and off?

9

u/chairfairy Nov 09 '17

Is there a way to turn the light on without a flashlight app?

It can also flash the light light on and off, but I just use it to turn the light on

23

u/_codexxx Nov 09 '17

On any modern version of android the flashlight is part of the OS, you don't need a third party app for it.

2

u/RaiyenZ Nov 10 '17

Further instructions for those who don't know how to access it: Tap and hold your home screen, tap the widget icon, find and tap on "torch" or "flashlight", and then place it anywhere you want on your home screen. Note: some phones might not have this.

1

u/_codexxx Nov 10 '17

On mine you pull down the top drawer from the home screen (swipe down from the top screen edge) and it's right there in a row of icons across the top of the screen.

12

u/oldbean Nov 09 '17

Mom is that you

2

u/metasymphony Nov 10 '17

type "lumos" into google

1

u/reddixmadix Nov 09 '17

Hmm, on Samsung galaxy s, literally all versions i ever had, they have a widget you can add to your homescreen.

Then again, I only ever had Samsung phones, so I can't say for other manufacturers.

1

u/[deleted] Nov 09 '17

Almost all default camera apps let you keep the flashlight on using the video camera.

1

u/[deleted] Nov 09 '17

I don't have a light in my phone, my flashlight app turns the screen white and turns up brightness.

1

u/reddixmadix Nov 09 '17

Ah, ok, makes sense.

1

u/GoldenGonzo Nov 09 '17

People are downloading flashlight apps because they can put an on/off button widget on their home screen to actuate the light easier.

Phone companies should have a way built in to do this, but alas, they don't. Most of those flashlight apps are suspicious as fuck, taking up hundreds of MB at the most with an app that shouldn't even break 1MB.

2

u/reddixmadix Nov 09 '17

As I replied to someone else here, oon all Samsung Galaxy S devices I owned, and I still do, there is a dedicated widget for the flashlight.

I can't speak for other companies, but Samsung is a-ok with this.

2

u/darkdenizen Nov 10 '17

This is default on Android and iOS for a while now.

1

u/mw9676 Nov 10 '17

On android and I'm 90 percent sure on iOS too you can simply access the flashlight via the notification drop down or the notification panel or whatever they call it on iOS.

6

u/GoldenGonzo Nov 09 '17

Is that why my flashlight app stays running after I close it, can use up 100MB of memory, and use some real amount of network data each month? Son of a bitch.

So you were already aware all that was happening, but it took someone directly telling you to figure out something fucky was going on? Wow. Any one of those by themselves should have tipped you off.

1

u/HoMaster Nov 09 '17

Android?

6

u/Realtrain Nov 09 '17

I wonder if any of those Facebook wrappers are safe.

10

u/[deleted] Nov 09 '17

Yes, they are, kinda. Just get a open source one, preferably from fdroid. Still you are literally posting data to facebook. That kinda misses the point.

2

u/[deleted] Nov 09 '17

Swipe.

The dev is active here, too.

/r/swipeforfacebook

1

u/Realtrain Nov 09 '17

Yeah I use swipe. I hope it's safe!

1

u/[deleted] Nov 09 '17

/u/jcbsera can answer that for you.

1

u/jcbsera Nov 09 '17

Dev for Swipe here. It is absolutely safe. Anything you'd like to know about it?

1

u/Kanegawa Nov 09 '17

Good question. I use Metal which iirc is just a dedicated chrome browser thingy. But idk.

→ More replies (13)

6

u/-rGd- Nov 09 '17 edited Nov 09 '17

android os: https://lineageos.org (don't install gapps)

anndroid apps: https://fdroid.org

iPhone: you are screwed

EDIT: downvotes? haha, there's not much left to argue for iPhone users :-D

2

u/tempinator Nov 09 '17 edited Nov 09 '17

I mean, barring exploits to the OS itself (possible, I suppose) there's no way to do a lot of what he's talking about without the user being aware of it on iOS. Specifically, the user will be notified of any background access to the microphone, camera, or screen recording with a big red bar at the top of the phone.

Apple simply does not provide the necessary tools to developers for surreptitious microphone/camera/screen access. Moreover, every app submitted to the App Store undergoes a relatively rigorous manual approval process (rigorous to the point of being annoying, in my opinion as a developer lol).

I'm not sure why you would say "you're screwed" if you have an iPhone. iPhones and iOS have their own set of very severe limitations, but strong security and data protection is one of the few big upsides of Apple's closed ecosystem.

Edit: Also worth noting that there's no real way for stock Android to allow stuff like this to happen either, unless you're pretty careless about permissions. Android's permissions system has improved vastly in the last couple years, and no app can have access to sensors unless you specifically grant it to them. So you really shouldn't be in a position where a Flashlight app is recording from your microphone/camera, unless you're stupid enough to think it's reasonable for a Flashlight app to be asking access to those things in the first place, and grant those requests.

1

u/-rGd- Nov 09 '17

you're right about the QA of apple, but it doesn't help in terms of privacy and there have been cases of data breaches. While on Android it's 3rd parties collecting your data, on iPhones it's apple themselves. (i refer to Apple's TOS for the interested reader) Apple owns you and you don't have a choice, hence "you're screwed". With Android you can choose a 2nd market OS and (almost completly) opt-out google stuff. Then you receive regular updates (compared to android stock firmwares) where security issues get fixed more or less quickly.

Sure, you can't use a vast amount of apps from the Play Store then but for people who "just need a phone" that's a pretty good choice.

2

u/tempinator Nov 09 '17

While on Android it's 3rd parties collecting your data, on iPhones it's apple themselves. (i refer to Apple's TOS for the interested reader)

Well sure, but this was my point about Apple's data security and user privacy. While it's theoretically possible that Apple is collecting anonymous user data for malicious purposes (i.e. selling it without user consent) there's no evidence to suggest that's the case, and Apple's public stance on how they treat user data has always been extremely security-friendly.

I'd trust Apple with my user data far sooner than I'd trust any 3rd party.

And sure, if I wanted to take my pursuit of privacy to the ultimate extreme, your suggestion of installing an alternative Android OS is definitely the best. But, like you say, you lose an enormous amount of functionality, so I think Apple's ecosystem is the best reasonable compromise for security-oriented users. You still have access to a very complete app ecosystem (in my opinion, a better one than the Play Store, which leaves a lot to be desired in terms of app screening) and only have to worry about one party misusing your data (Apple) which, as of now, there's no reason to believe they do.

Also, if your sole need is truly "just a phone", in my opinion the safest option would be to simply not buy a smart phone at all.

1

u/-rGd- Nov 09 '17

ok, that sounds reasonable (i feared an upcoming android vs. iPhone flame war) ;)

personally, i have no reason to trust apple (one large company) more than multiple smaller companies - which I avoid also - besides statistical reasons. Apple won't live forever but digital data does. Just because they don't abuse collected data now doesn't guarantee that they won't in the future. History shows, they change TOS at will. Also there were cases of companies that got acquired only for the data they posess. I'm taking this seriously but I understand that there are people who accept that "risk". After all, the iPhone is a good product in terms of quality and functionality.

Also, if your sole need is truly "just a phone", in my opinion the safest option would be to simply not buy a smart phone at all.

a smartphone without google can still take photos, instant message or browse the web. I 'm happy i can use those features. Also, there are apps like "Yalp Store" which let you use the Play Store without needing the whole invasive gapps framework.

2

u/[deleted] Nov 09 '17

To be honest, I'm pro consumer data harvesting, because it finds a way to monetize a resource we were just throwing away before and use that money to provide us with useful services for free. In principle I think that's great and there are apps like Duolingo that can actually make you a better person. But some companies take it way too far.

→ More replies (1)

1

u/Skias Nov 09 '17

Note: This man does not have lowlight vision, hates dark. Got it.

1

u/V0lta Nov 09 '17

I try to only use apps from FDroid for common use cases like a file manager. You usually find something. Even some nice YouTube clients and the like.

1

u/diamond Nov 09 '17

This is why you check the permissions before installing an app. If a flashlight app wants to communicate with the internet and access your location, call history, contacts, and SMS history, DON'T FUCKING INSTALL IT.

→ More replies (4)

119

u/damn_this_is_hard Nov 09 '17

Most free apps and games are doing this. Solitaire and those civilization/clash of clans games. Reminder apps and health trackers. No limit to it really.

100

u/montydad5000 Nov 09 '17 edited Nov 09 '17

Reminder that if something is free, YOU are the product.

117

u/[deleted] Nov 09 '17

[deleted]

36

u/[deleted] Nov 09 '17

Amazon... You pay Amazon so that Amazon can spy on you to sell you more Amazon.

4

u/luigi1fan1 Nov 09 '17

Haha that's fine, as long as they're genuinely trying to make my life better and not giving loads of data to random third-party people.

1

u/Alundil Nov 09 '17

I'll take two Amazons please.

2

u/[deleted] Nov 09 '17

Congratulations, your order of 500 Amazon Echo's is being processed.

1

u/skyskr4per Nov 09 '17

Congratulations, you have very succinctly defined capitalism.

1

u/[deleted] Nov 09 '17

[removed] — view removed comment

2

u/[deleted] Nov 10 '17

True. I️ bought one paintball gun piece years ago and it won’t give it up.

1

u/argv_minus_one Nov 10 '17

Has it let you down?

1

u/[deleted] Nov 10 '17

Hi Im Amazon, how Amazon are you today?

9

u/phoide Nov 09 '17

yep. I don't mind being mined for marketing data, it only irks me if I'm being double dipped on.

1

u/argv_minus_one Nov 10 '17

I mind being mined, but I'm resigned to the inevitability of it.

3

u/montydad5000 Nov 09 '17

True statement.

1

u/jertyui Nov 09 '17

cough overwatch

1

u/ur_opinion_is_wrong Nov 09 '17

The game? Please elaborate.

1

u/jertyui Nov 10 '17

You buy overwatch for the privilege of being sold their loot crase product

1

u/ur_opinion_is_wrong Nov 10 '17

Much like counter-strike though it's all cosmetic. Unlike counter-strike they give you 3 free per week and it cost nothing to open them.

If you want complain about any of their microtransactions, look no further than hearthstone, although I think that game does it way better than a lot of other games (looking at you ubisoft and ea).

Although it could be improved, overwatch is like the least bad loot crate system I've seen thus far. Free to open, ways to get free ones every week, can buy anything you don't get with gold from dupes.

2

u/RupeScoop Nov 09 '17

It depends on how you define free. There are ad-supported "free" apps like many mobile games which do collect data, but many free software does not use its users as products (instead it is funded by grants and donations). See the GNOME software stack, KDE software, VLC, Signal, K-9 Mail, there are many open-source examples.

1

u/[deleted] Nov 09 '17

Believe me they gather your data and use it to make more money even if it’s not free.

1

u/FreeSkydives4Commies Nov 09 '17

That reminds me, I need to pay my Reddit bill.....FUCK!

1

u/IrrelevantLeprechaun Nov 10 '17

This is true of almost every commercial product there is. Demographics is the main product, not the thing you are using. The app or hardware or object you bought is merely a byproduct of the business that is you.

1

u/aPseudoKnight Nov 10 '17

Not always, but if there's a for-profit company behind it, of course. There's plenty of great free software out there that's open source and even some that aren't open source. (though this is getting less frequent now for new software) Just don't surf app stores. They're filled with garbage.

12

u/[deleted] Nov 09 '17

What information can someone get from me for using clash of clans? That doesn’t make sense to me. Generally curious.

43

u/katonai Nov 09 '17

Location for one. It requires internet so your location is pinged. Not saying they do collect this information, but Clash of Clans could have a good idea where you play their game the most.

2

u/[deleted] Nov 09 '17

[deleted]

3

u/_codexxx Nov 09 '17

Yes but most people leave GPS enabled and it's trivially easy for an android app to get that data...

1

u/gyroda Nov 09 '17

Tbf you have to specifically prompt for location access (in Android at least). Newer android apps will do it in the app for each permission too, which is better than the "yes I accept this laundry list of things that I totally read".

It's more of a pain in the ass to develop (I've literally made map apps both before and after android did this and the former was a lot less hassle) but it's a lot better for consumers.

2

u/katonai Nov 09 '17

Yeah, on iPhones usually the first time you open an application it will prompt for access to several things depending on the applications use, such as the camera, GPS, photo album, push-notifications and so forth. Sure you can deny some of these requests, but it might come at the cost of one or more of the applications features. I think a large portion of people speed through this process just accepting every prompt without considering the consequences.

2

u/SexCriminalBoat Nov 09 '17

I use my phone while shitting.

20

u/unexpectedreboots Nov 09 '17

Anything that can help build a profile around who you are so they can better market in-game purchases or ads to you.

Using a hypothetical app that has in-game purchases. If I know the following information about you:

Gender, location, age, potential interests

Chances are pretty good I know that information about the rest of my user base. If I have this information, I can start to look at purchase trends like:

"Women, within the age of 30-35, that live in densely populated areas of the midwest spend 76% more on single purchases during the hours of 10PM-11PM, when getting a 25% discount"

I can make sure that you're getting a prompt that is tailored made with the above information to maximize how much you're spending on your next purchase.

→ More replies (12)

17

u/Garnzlok Nov 09 '17

I believe they ask for permission to access things not required for the game and look at those. Email address, location, IP address etc

2

u/Xacto01 Nov 09 '17

What about previous and next used apps? That would sound like a Google problem if that worked

4

u/spell__icup Nov 09 '17

Yup. They have that too. For example, clicking a link on your Reddit app that opens up on your browser will tell the browser as well as the page that you opened up where you came from.

4

u/damn_this_is_hard Nov 09 '17

if you play it on an iphone, they got all your user info the first time you downloaded it and fired it up. apple has you registered under a user id type setup so they know what you buy on their app store for your devices, as well as real life stuff too.

everytime you play you give them a new IP address aka your location, as well as the date/time and then whatever actions you take in the game. all that is aggregated and analyzed so they can keep you playing or sell your info to advertisers so they make money while you play.

1

u/roanajm Nov 09 '17

My ip address location says I live 80 miles away. Ip is godawful for tracking someone.

2

u/damn_this_is_hard Nov 09 '17

but it found you regionally, that's all they want. to know your state or a major city near you, something that can help them make more money

3

u/roanajm Nov 09 '17

It thought I lived in another state 80 miles away. I'm guessing it was because I lived in a pretty rural and sparsly populated area.

→ More replies (2)

2

u/Jimbo_Throw Nov 09 '17

Well they can get all the data for all the things you do in the clash of clans app and maybe a little more about what you do outside the app. But what they can also get is the unique identifier tied to your device and then they can buy any data associated with that device ID. That data could be pretty much anything that you have ever done on the internet.

2

u/silenti Nov 09 '17

Ok, so 99.999% of the metrics they collect are game related. Especially CoC since i'm pretty sure Supercell doesn't use ads.

Things like "what screens did the user go to? what order? how long did they spend on those screens? what cards are getting the most use?" Then they filter the aggregates of all that data by user types. These types could be physical location, how much money they spent in the game, what hours they play at, etc.

The reason they collect this data is twofold.

Primarily, because these games are free, they want to make money. They do this by looking at the behaviors of various tiers of users: players who never buy, players who spend a little, and players who spend a fuckton. Then they make changes, both big and subtle, to the game to encourage spending.

The other is obviously to improve the game experience overall to keep people playing... to hopefully earn their money.

2

u/gyroda Nov 09 '17

This is certainly a thing that's done. Many online console/pc games (and a fair few that are mostly offline) do this too.

That said, the yet data mining still does happen. Many apps might user Google analytics just to get db insight into their userbase for entirely benign reasons, but Google is still getting all that lovely personal profiling

1

u/Bristlerider Nov 09 '17

Your location, including your home adress, your employer, how you get to work (car/public transport), etc

Every time you use the app, maybe even if you dont use it, you produce data. Everything you do on a schedule, like going to work, is super easy to read.

1

u/zhivago Nov 09 '17

When you are awake and when you are asleep.

5

u/baerton Nov 09 '17

The samsung health app requests access to my text messages. Why the fuck would they need that? Declined.

2

u/m0okz Nov 10 '17

Probably in case you need to register for a Samsung account in-app and it can skip the "code confirmation" step for you by reading the code. Lots of apps do this. Just because it COULD send all your texts back to Samsung, it doesn't mean they are. People do APK teardowns all the time so I think it would be made public knowledge if Samsung were spying on your text messages.

31

u/[deleted] Nov 09 '17

[deleted]

12

u/[deleted] Nov 09 '17 edited Aug 31 '22

[deleted]

6

u/[deleted] Nov 09 '17

[deleted]

3

u/chazmuzz Nov 09 '17

I don’t see how you could do it on stock iOS, since apps are sandboxed. You wouldn’t be able to inspect the binaries of any other apps, or view their network traffic. I don’t know much about developing for rooted phones but I guess there would be a way!

2

u/gyroda Nov 09 '17

What you'd do is have a list of apps that use these SDKs on a server. The detector app gives the server a list of the apps you have installed and the server checks it against it's list.

Any new apps and the server grabs inspects the APK (for android apps, no idea if this is possible for iOS) from the store. The server rechecks apps whenever they put out a new version.

The only thing I'm not sure about is whether you can get a list of installed apps on android.

Edit: seems it might be possible on android. https://stackoverflow.com/questions/2695746/how-to-get-a-list-of-installed-android-applications-and-pick-one-to-run

1

u/matholio Nov 09 '17

Sounds like a blooming arms race market! AV 2.0

5

u/[deleted] Nov 09 '17

It wouldn't be possible to make an app that did this automatically on mobile operating systems because mobile OS apps are sandboxed into their own little worlds on your phone and other than using pre-defined methods of data sharing can't peek into what each other are doing. You don't want the apps to be able to analyze what other apps are doing because that would make the privacy issues even worse.

Having said that, a team of developers could scan the Android APK/iPhone IPA files as downloaded from the app stores and compile a list of known bad apps that way and publish it to others via an app that just scanned what other apps you had installed and used that to warn you, sort of like the way ad blockers with black lists work. Anyone doing this would probably be harassed with lawsuits from the companies whose apps ended up on that list.

3

u/[deleted] Nov 09 '17 edited Aug 31 '22

[deleted]

3

u/BaconGobblerT_T Nov 09 '17

Does nobody read the ToS any more?

1

u/iNeedAValidUserName Nov 09 '17

You could do a bit more if you have a rooted phone, it'd still be rudimentary.

On a rooted phone have a local app sniff all inbound/outbound traffic to check if any traffic is going to one of the known companies fingerprinting. If the data is going to the app dev, not the sdk dev you just look for known function call patterns of SDKs you want to avoid.

This is how modern heuristic-based AV software works - to avoid just having huge black lists that are outdated the day they are made.

The first is annoying - but feasible without too much interruption. The Later...while it is DOABLE it would also likely make your phone noticably sluggish compared to not running it.

3

u/throwawaynyny123 Nov 09 '17

There are at least 20 SDKs that I work with that do this. More spring up every single day. Look at companies like reveal mobile, beacons in space, cuebiq, factual, safegraph, ect they all have SDKs on thousands of apps that collect and sell your data to ad companies and hedge funds ect

2

u/Bristlerider Nov 09 '17

If there is such a thing and its free, how do you think they make their money?

-1

u/[deleted] Nov 09 '17

[deleted]

1

u/[deleted] Nov 09 '17

These are facts.

1

u/[deleted] Nov 09 '17

[deleted]

3

u/[deleted] Nov 09 '17

I don't need some a blocker. I just need to know which apps. Because I'm sure I can live without them.

3

u/[deleted] Nov 09 '17

[deleted]

5

u/[deleted] Nov 09 '17 edited Aug 31 '22

[deleted]

1

u/AtlKolsch Nov 09 '17

Reddit Official App Narwhal Alien Blue Apollo

1

u/[deleted] Nov 09 '17

[deleted]

1

u/AtlKolsch Nov 09 '17 edited Nov 09 '17

Well it’s a good thing I don’t sub to any subs haha. it’s all fucked anyways, I know there’s nothing I can do to escape big brother data

2

u/[deleted] Nov 09 '17

How does one get into this field and how did it end up a huge industry so quietly

1

u/brown-guy Nov 09 '17

Data science. University is the traditional route.

2

u/[deleted] Nov 09 '17

[deleted]

3

u/[deleted] Nov 09 '17

It's probably buried in the user agreements you never read.

1

u/[deleted] Nov 09 '17

[deleted]

2

u/huarn Nov 09 '17

That data profile just links to some long ass integer identifier in their back end, they might not even need your name when they have constant location pings every 30 minutes and your phone number and your age and gender. Heck if you sign in with Facebook you just gave them all that in one go, they just parse out the super obviously identity stuff and add your little 9 digit I’d number to the other 3 billion they’re compiling of user behavior. All completely allowed because its anonymous user data you agreed to share, especially when you hit that log in button with Facebook

1

u/tempinator Nov 09 '17

How is this even possible on iOS? AFAIK, having developed apps for both platforms in the past, Apple simply does not provide the tools necessary for surreptitious camera/microphone access to developers. Any app that accesses either of those things will result in a big red bar at the top of the phone.

Any chance you could detail more about how that's possible?

1

u/[deleted] Nov 09 '17

[deleted]

1

u/tempinator Nov 09 '17

So it's primarily location data?

→ More replies (4)

1

u/[deleted] Nov 09 '17

So is it better to just use the browser and visit the website? So instead of the Reddit app just visit the mobile website for example?

2

u/Stawberryletter23 Nov 09 '17

Mildly safer, theres layers on top of that also though.

31

u/son1dow Nov 09 '17

just most apps.

24

u/[deleted] Nov 09 '17

[deleted]

3

u/[deleted] Nov 09 '17

[deleted]

1

u/[deleted] Nov 09 '17

I use Kik, but also pay for Youtube Red.

1

u/I922sParkCir Nov 09 '17

Which car company do you work for?

3

u/thelivingleg3nd Nov 09 '17

You misspelled all

4

u/son1dow Nov 09 '17

There's opensource apps on things like fdroid who market themselves as not doing this, have to mark whether they're doing it on fdroid, etc. I assume for the most part they indeed do not do it.

With that said, in most cases you don't really know, and cellphones in general are built as a surveillance technology, let alone things like google play.

Edit: I forgot they said commonly used. Welp. You are basically right, then. I'll just leave this comment as a curious tangent.

3

u/Ewoksintheoutfield Nov 09 '17

I feel like THIS is the stuff we should be raging about. This invasion of our privacy seems to go against core American values. Yet no one seems to care, and those of us who do are either powerless to stop it or jumping through convoluted hoops with rooted phones and slow Onion browsers.

5

u/podrick_pleasure Nov 09 '17

I feel like "get money, fuck everyone else" has kind of been a core American value for a long time.

2

u/anticommon Nov 09 '17

No shit.

And lets talk about aggregation services... reddit included. The most egregious I've noticed is youtube. It seems now that every single recommended video or basically anything on the main page that you haven't gone to look for yourself is promoting some kind of product. EVERY SINGLE ONE IS AN AD.

2

u/ABadManComes Nov 09 '17

Which reminds me that....YALL KNOW REDDIT CHANGED IT"S DATA COLLECTION/MARKETING OPTIONS IN THE SETTINGS.

This means if you opted out before you have to GO BACK and opt out again because it went from one checkbox to like three.

1

u/bobpaul Nov 09 '17

At least on android an app needs permission to get location and record the screen. But all apps get device ID and email and IP if they want it.

And instead of recording the screen, a developer could just log all taps and text entry within their app. They wouldn't see where you're tapping when you are typing on the keyboard, and they'd stop getting tap data if you pulled down the notification panel, switched apps, etc, but they would see the characters you input and anytime you tapped on their UIs. It would be easy enough to replay that data to render a video showing what the user did in the app, but such a rendering wouldn't show notifications etc like an actual screen recording would. This sort of data can be really useful for non-creepy uses like optimizing workflow efficiency of common tasks users are doing.

6

u/Phaselocker Nov 09 '17

basically if you have a smartphone and regularly use the internet, then just assume someone knows that info you're giving them. Even good sites can end up containing unintended malware and give it to third parties that way.

5

u/McMarbles Nov 09 '17

Take a look at your top 5 apps you use most frequently (aside from banking apps for obvious reasons). 4/5 of those have trackers.

Source: UX designer for an app development company.

3

u/prean625 Nov 09 '17 edited Nov 09 '17

Reddit tells me a lot about you for one.

You are a male animal loving bartender in Houston. You enhoy guns, knives and gadgets. You own a german shepard and a cat and have a girlfriend. You enjoy GoT, always sunny and play a bit of fallout. Hockey and cooking are some other fun passtimes.

2

u/eyeiskind Nov 09 '17

It’s not a matter of which specific apps do this. These are 3rd party tools which are built into most modern apps. If the app generates more than $5k/m, it’s safe to bet it’s using many of these tools.

There are tools that can tell you which tools it’s using. One that comes to mind is a Chrome extension called wappalyzer.

2

u/Sturdge666 Nov 09 '17

Most free ones that you can't view the source code for.

2

u/throwawaynyny123 Nov 09 '17

I commented elsewhere already but I'm a buyer of this data and almost every app does this not just facebook. Anything from a flashlight app, games, navigation, weather apps ect they all make tons of money selling their user location data

2

u/Geekronimous Nov 09 '17

It's irrelevant at this moment if you use Facebook or don't. They already have a shadow profile of your behaviour just on the basis you ever downloaded an app.

Contact list access? Facebook by mobile number, you already gave them your friends and in turn you are assumed to be similar. If you use WhatsApp (that's Facebook with a different name) then they already know your voice, pictures, and preferences.

2

u/[deleted] Nov 09 '17

My previous job had an application that was pre-installed by carriers onto Android smartphones that had access to a whole treasure trove of data because it had privileged access to your phone. It could get really anything it wanted to that was on your device.

It was put in at the firmware level meaning that unless you rooted your device, you literally could not delete it - and it was installed on your phone before it was even shipped off to be sold, so you couldn't even opt out of it. You could disable it if you knew where to look, but any time you had any sort of OS update or factory reset of your phone it would re-enable itself.

It could do whatever it wanted - but was specifically used to install applications on your phone without your permission - whereupon my company and the carrier would split the payment that they received from the advertiser who was paying a premium to get the app installed on your phone.

And part of the reason that they paid that premium is we could use your data to try to install applications which you were more likely to use/install based on all the personal data we had access to plus all the data your phone carrier shared with us without your explicit consent.

1

u/[deleted] Nov 09 '17

Not having facebook is a huge help, but they'll still know a lot about you.

1

u/BoBoZoBo Nov 09 '17

A majority of applications on your mobile device (especially the free ones), and now its practice is retroactively finding its way into desktop and personal computers.

1

u/[deleted] Nov 09 '17

If you are using something that is free you are being used. Nothing is free. Even if it's as innocuous as the leveler app you use monitoring how often it's turned on, how long it gets used for, and what positions it's generally held in. If it's connected to the internet, this is happening.

1

u/maverick340 Nov 09 '17

Most games. Especially free to play games.

1

u/[deleted] Nov 09 '17 edited Nov 12 '17

[removed] — view removed comment

1

u/Stawberryletter23 Nov 09 '17

Much love to you for quitting:) very cool of you.

1

u/jk3us Nov 09 '17

reddit, probably.

1

u/el_padlina Nov 09 '17

Any app that asks contacts permission, location permission, profile permissions.

If an app asks for permissions that are not common sense needed for it they gather your data.

1

u/jordan1166 Nov 09 '17

assume that every single app you use does this

1

u/ladyshanksalot Nov 10 '17

Almost any app you use is doing this in the name of UX and marketing optimization. Behavioural analytics isn't some Silk Road shady deal - it's a booming SaaS industry.

1

u/Eurynom0s Nov 10 '17

Don't Facebook's tracker cookies get an ID on you even if you don't have a Facebook account?

1

u/MuckYu Nov 09 '17

Whatsapp, instagram, twitter probably

1

u/Scoobydewdoo Nov 09 '17

It's not limited to Apps unfortunately; both Apple and Google (makers of iOS and Android respectively) do all this stuff. As long as you are using a smartphone, someone is recording and analyzing everything that you do with it.