International researchers have uncovered covert tracking tactics, which Meta and Yandex deploys, for the purpose of allowing their Android applications to monitor users' web browsing habits, even when users believe they are browsing privately. The technique, which affects billions of Android users, exploits a systemic loophole to link anonymous browsing sessions with user identities simply by connecting websites' tracking scripts directly to native smartphone applications. Meta began deploying this deceptive method in September 2024. Yandex has been deploying it without detection since 2017.
It only works when users have Facebook, Instagram, or various Yandex applications installed on their Android devices who visit websites with Meta Pixel or Yandex Metrica tracking scripts (embedded on about 20% of the popular websites). These scripts are capable of establishing connections, through localhost ports to communicate directly with native apps, which in turn allows these scripts to bypass Android's privacy protections. Notably, this even includes the incognito mode, VPN usage, and the operating system's application's (or app's) sandboxing function; developed to prevent such data sharing. The covert tactic essentialy enables companies to associate web cookies and browsing histories with unique device identifiers; such as Android Advertising IDs, which (in effect) de-anonymizes these users' online activities.
Google and Mozilla responded by indicating they are investigating potential violations of their platforms' terms of service. Such activities would be in violation of its terms of service and a betrayal of the privacy expectations of its Android users, according to Google and Mozilla; that both announced it is in the process of developing protections for its Firefox users on Android against this tracking method. Meta nor Yandex responded to a request for comment.
Curiously, hours after the research became public, the investigators have observed that Meta's tracking communications had ceased entirely, with code references to the tracking cookies largely removed; likely a response to these revelations. This raises questions about the effectiveness of existing privacy tools and provokes thought about privacy implications. Unlike traditional cookie-based tracking, this method circumvents user attempts to maintain browsing privacy entirely through standard protective measures. The technique also creates vulnerabilities beyond the intended tracking. Researchers demonstrated that malicious third-party applications could potentially eavesdrop on users' browsing activity by listening on the same localhost ports, accessing browsing histories across multiple browsers including Chrome, Firefox, and Edge. How could this activity go unnoticed without detection and what does it say about the security measures in place?
Is it safe to say such tracking methods researchers discovered constitute serious violations of user privacy expectations? The timing of this discovery is coinciding with increasing regulatory scrutiny of tech companies' data collection practices along with a growing user adoption of privacy protection tools. Based on this revelattion, bypassing these widely adopted privacy tools doesn't really seem an uncommon practice. Is this activity in violation of these platforms' terms of services? Does it violate International Laws? Time will tell!
Source Link
Floor Covering Media publishes
blog articles called Flooring Briefs.
Floor Covering Media is
a social media network.
Retrieve timely, objective news and
information at https://www.floorsearch.info.
