this post was submitted on 16 Jun 2025
45 points (97.9% liked)

Privacy

3349 readers
16 users here now

Icon base by Lorc under CC BY 3.0 with modifications to add a gradient

founded 2 years ago
MODERATORS
 

A sophisticated tracking method employed by Meta (Facebook) and Yandex that potentially affected billions of Android users through covert web-to-app communications via localhost sockets.

The technique allowed native Android apps, including Facebook and Instagram, to silently receive browser metadata, cookies, and commands from Meta Pixel scripts embedded on thousands of websites, effectively linking mobile browsing sessions to user identities and bypassing standard privacy protections.

all 10 comments
sorted by: hot top controversial new old
[–] coconut@programming.dev 5 points 7 months ago (1 children)

I still can't comprehend why any script on any webpage is allowed to communicate with the localhost on a mobile device.

[–] Squizzy@lemmy.world 1 points 7 months ago (2 children)

Could you explain what this means, I dont understand the localhost but I keep seeing it.

[–] vrighter@discuss.tchncs.de 6 points 7 months ago (2 children)

localhost is "this device".

connecting to localhost means connecting to something running on the same machine.

Browsers generally block connections to other domains (ex if you're on google.com, the browser won't simply let the site contact amazon.com willy-nilly).

But localhost is your own machine, so it is usually "trusted". Facebook exploited this fact to exfiltrate data from the browser to the other apps running on your own phone, which would, in turn be free to do with it as they please, because they're not the browser

[–] Squizzy@lemmy.world 2 points 7 months ago
[–] TheBat@lemmy.world 4 points 7 months ago (2 children)

Facebook (fuck their renaming) should be spilt into half a dozen different companies. Not going to happen in current shambolic regime in USA though.

[–] coconut@programming.dev 2 points 7 months ago (1 children)

They practically control personal communications in majority of the world and none of the governments seem to care.

[–] andybytes@programming.dev 1 points 7 months ago

Our government officials work for the corporate sector because government has been captured by corporations. So most plebs, you know, still worship the sun. And you know, the types like Nancy Pelosi definitely care, but what they care about is their stock portfolio. Not doing what we perceive as their jobs. But it's kind of interesting seeing how Europe has lost faith in the Yankee Empire and is slowly becoming more self-reliant and moving away from US companies. Which in turn, if we don't become completely like North Korea, and we can access the internet outside of the usa, it gives us the opportunity to possibly use some decent software, which makes me excited. And to be honest, I use a lot of software that's created by Europeans. So, it's kind of already like that. But then it'll just get better hopefully.