No shit...
this post was submitted on 04 Jun 2025
52 points (100.0% liked)
Hacker News
1678 readers
208 users here now
Posts from the RSS Feed of HackerNews.
The feed sometimes contains ads and posts that have been removed by the mod team at HN.
founded 9 months ago
MODERATORS
How were they doing this, technically speaking? The article is devoid of practically anytechnical detail
Better link? https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/
Meta and Yandex achieve the bypass by abusing basic functionality built into modern mobile browsers that allows browser-to-native app communications. The functionality lets browsers send web requests to local Android ports to establish various services, including media connections through the RTC protocol, file sharing, and developer debugging.
While the technical underpinnings differ, both Meta Pixel and Yandex Metrica are performing a “weird protocol misuse” to gain unvetted access that Android provides to localhost ports on the 127.0.0.1 IP address. Browsers access these ports without user notification. Facebook, Instagram, and Yandex native apps silently listen on those ports, copy identifiers in real time, and link them to the user logged into the app.
Yes, thank you.
They used a protocol called WebRTC that allows for establishing direct P2P connections to establish a connection to the Facebook app running on your phone. The FB app knew your identity so it was able to link your in browser actions with your FB identity.
Can we get mobile companies to start treating Facebook’s apps as threat vectors?
North Korea phone: Oh no they track you
Every US company: Yay I need my data stealing app to know who I'm mad at
There's a difference between companies stealing data to sell or target ads to you and the government tracking everything you do so they can black bag you if you're too subversive. Neither is great but uninstalling Facebook isn't that hard.
I'm going to assume that is and US private company has your data, they probably already sold it to the government.
so a company harvesting data, and a government doing it are practically the same
lets not forget that the US government also has its data harvesting programs.
Sure, but again, the US isn't black bagging me. They're too busy doing it to immigrants.
Wait. Shit.
I was in a hefty argument with my brother about ads, so I got insta on my iPhone. I googled things and talked about other stuff.
Still no ads.
They probably heard your argument and didn’t show you relevant ads just to spike the bowl. 😝
What a surprise, fucking scumbags