Technology

70916 readers

3420 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

L4s@hackingne.ws

512

Meta and Yandex are de-anonymizing Android users’ web browsing identifiers - Ars Technica (arstechnica.com)

submitted 3 days ago by otter@lemmy.ca to c/technology@lemmy.world

58 comments fedilink hide all child comments

Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.

The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources. Defenses such as state partitioning and storage partitioning, which are built into all major browsers, store site cookies and other data associated with a website in containers that are unique to every top-level website domain to ensure they're off-limits for every other site.

you are viewing a single comment's thread
view the rest of the comments

[–] ayyy@sh.itjust.works 5 points 3 days ago (1 children)

Using such a unique browser version is very de-anonymizing.

[–] InternetCitizen2@lemmy.world 1 points 3 days ago (1 children)

Could add a user agent spoof?

[–] ayyy@sh.itjust.works 3 points 3 days ago (1 children)

Even then, most tracking is done through fingerprinting.

[–] Lv_InSaNe_vL@lemmy.world 2 points 3 days ago* (last edited 3 days ago) (1 children)

Yeah it makes me laugh when people talk about "don't use cookies" or "block ads" like companies didn't switch to more advanced techniques (like hell, I saw a paper where they could fingerprint you just simply by how you interact with the webpage) 15 years ago.

There is no way to use the modern web without getting fingerprinted.

[–] ayyy@sh.itjust.works 3 points 3 days ago (1 children)

Well “block ads” is also shorthand for “block as many 3rd-party requests as possible while maintaining the desired content” which absolutely improves your privacy and prevents a lot of fingerprinting scripts from ever loading.

[–] Lv_InSaNe_vL@lemmy.world 3 points 3 days ago (1 children)

That's the thing though, websites have gone away from "fingerprinting scripts" and have started finger printing you by what you serve, how and when you access it, and other things that they can all collect purely on the server side. The rest is just for advertising and data collection for improvements.

[–] LainTrain@lemmy.dbzer0.com 2 points 3 days ago

All of this is far easier to subvert than tracking scripts (and cookies and port scans) which literally as evidenced by the article in the OP are not techniques that companies have "gone away" from at all, at least not by entirely replacing them.