Meta and Yandex are de-anonymizing Android users’ web browsing identifiers - Ars Technica
Technology
58
Beiträge
39
Kommentatoren
756
Aufrufe
-
Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.
The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources. Defenses such as state partitioning and storage partitioning, which are built into all major browsers, store site cookies and other data associated with a website in containers that are unique to every top-level website domain to ensure they're off-limits for every other site.
We found that browsers such as Chrome, Firefox and Edge are susceptible to this form of browsing history leakage in both default and private browsing modes. Brave browser was unaffected by this issue due to their blocklist and the blocking of requests to the localhost; and DuckDuckGo was only minimally affected due to missing domains in their blocklist.
Aside from having uBlock Origin and not having any Meta/Yandex apps installed, anyone aware of additional Firefox settings that could help shut this nonsense down?
-
I am assuming all of this trash is blocked by uBlock Origin?
EasyPrivacy should block Meta and Yandex pixels by default. If you have the knowledge you can put uBO in "hard mode" which will block all 3p connections. It requires you to know which CDNs to allow or websites will be broken.
-
No WhatsApp?
I'd nail my foot to the floor before I installed WhatsApp.
-
Are you suggesting something like LineageOS is a better choice?
(Seriously asking: I've got a new-to-me Pixel that I'm looking to switch to a degoogled-ish ROM on, and Graphene and Lineage were the two front-runners.)
I'm running Graphene and I'm very happy with it.
-
Well, it's always been a cat and mouse game.
Just earlier today, I got a pop-up on YouTube about how they would block me after 3 videos because I use an ad blocker. Jump to now and everything is fine again. Thank you, uBlock Origin!
Fair warning: Last week one of my accounts was seemingly shadowbanned, and now gets "This content isn't available" on every video.
Logging out plays videos, making a new brand account worked, etc. and no notification from youtube.
-
EasyPrivacy should block Meta and Yandex pixels by default. If you have the knowledge you can put uBO in "hard mode" which will block all 3p connections. It requires you to know which CDNs to allow or websites will be broken.
I am aware of hardmode, I used to use NoScript.
It's a bit too much work these days.
-
No WhatsApp?
Got me on that one! I forgot about WhatsApp.
For what it's worth I didn't have it logged in until last week when I needed to get in touch with someone.
I will need to log out.
-
Block all tracking scripts and use Firefox Nightly with ublock when possible.
Using such a unique browser version is very de-anonymizing.
-
Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.
The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources. Defenses such as state partitioning and storage partitioning, which are built into all major browsers, store site cookies and other data associated with a website in containers that are unique to every top-level website domain to ensure they're off-limits for every other site.
Phew, glad i dodged that bullet by buying an iphone. (/s)
-
I'm guessing you use Firefox? It's much better at evading that tracking.
Nah I saw it on FF as well. Forcing an update on the "Quick Fixes" blocklist on uBlock Origin got rid of it.
-
Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.
The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources. Defenses such as state partitioning and storage partitioning, which are built into all major browsers, store site cookies and other data associated with a website in containers that are unique to every top-level website domain to ensure they're off-limits for every other site.
De-anonymising Yandex
Me: Ha! Good thing I am not Russian!
De-anonymising Meta
Me: Damn..and it is hard for me to let go because my social circle use Meta-owned social media and couldn't care less about privacy....I am toast...
-
We found that browsers such as Chrome, Firefox and Edge are susceptible to this form of browsing history leakage in both default and private browsing modes. Brave browser was unaffected by this issue due to their blocklist and the blocking of requests to the localhost; and DuckDuckGo was only minimally affected due to missing domains in their blocklist.
Aside from having uBlock Origin and not having any Meta/Yandex apps installed, anyone aware of additional Firefox settings that could help shut this nonsense down?
I know that people here generally like to shit on Brave, but it seems that the claim "Privacy by default" has held up in this context.
-
Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.
The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources. Defenses such as state partitioning and storage partitioning, which are built into all major browsers, store site cookies and other data associated with a website in containers that are unique to every top-level website domain to ensure they're off-limits for every other site.
Its russian, i've never used it and never will. Surprised so many
️'s advocated for it.. -
Using such a unique browser version is very de-anonymizing.
Could add a user agent spoof?
-
Could add a user agent spoof?
Even then, most tracking is done through fingerprinting.
-
Well, it's always been a cat and mouse game.
Just earlier today, I got a pop-up on YouTube about how they would block me after 3 videos because I use an ad blocker. Jump to now and everything is fine again. Thank you, uBlock Origin!
If you happen to use BlockTube, disable it. It's currently triggering the adblock detection.
-
De-anonymising Yandex
Me: Ha! Good thing I am not Russian!
De-anonymising Meta
Me: Damn..and it is hard for me to let go because my social circle use Meta-owned social media and couldn't care less about privacy....I am toast...
I used to be in your situation and one day I just told everyone I was leaving and if they want to contact me they would have to use Signal. You can't change most people's minds and Meta knows it, that's how they keep their monopoly
-
Are you suggesting something like LineageOS is a better choice?
(Seriously asking: I've got a new-to-me Pixel that I'm looking to switch to a degoogled-ish ROM on, and Graphene and Lineage were the two front-runners.)
If it's a Pixel anyway, GrapheneOS has a few nice security and privacy features that LineageOS doesn't have (yet?).
I think both are pretty great and much better than most alternates.
-
That's the fun part. They come preinstalled!
I'm so quick to install a custom ROM, I forgot the Meta spyware comes pre-installed on many phones. Ugh.
-
I am assuming all of this trash is blocked by uBlock Origin?
Check that "Filter lists > Privacy > Block outsider intrusion into LAN" is enabled and you should be fine
