Recent searches

No recent searches

Search options

Only available when logged in.
med-mastodon.com is one of the many independent Mastodon servers you can use to participate in the fediverse.
Medical community on Mastodon

Administered by:

Server stats:

364
active users

med-mastodon.com: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.1

#yandex

0 posts0 participants0 posts today
*
rexi

arstechnica.com/security/2025/

#tracking code #Meta and Russian #Yandex embed into millions of websites is #deanonymizing #android users by abusing legitimate #Internetprotocols, causing #Chrome and other browsers to surreptitiously send #uniqueidentifiers to #nativeapps installed on their devices…#Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.

Ars Technica · Meta and Yandex are de-anonymizing Android users’ web browsing identifiersBy Dan Goodin
Who Let The Dogs Out 🐾

Disclosure: Covert Web-to-App Tracking via Localhost on Android

#android #tracking #security #infosecurity #MetaFacebook #yandex

We disclose a novel tracking method by Meta and Yandex potentially affecting billions of Android users. We found that native Android apps—including Facebook, Instagram, and several Yandex apps including Maps and Browser—silently listen on fixed local ports for tracking purposes.

📢 UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below.

localmess.github.io/

层叠 - The Cascading

研究者发现 Yandex 和 Meta 向手机 App 后门发送 Web 端用户追踪信息。

- 安装了 Meta/Yandex 应用的设备会监听特定手机端口，而 Meta/Yandex 的网页端会尝试向此端口发送网页端用户 cookie 等内容，从而实现浏览器及 App 的身份关联。
- Yandex 被发现最早在 2017 年实行此行为，Meta 则是 2024 年。目前两家企业均已终止此追踪行为。
- 除 Brave 浏览器外，包括 Chrome、Edge、Firefox 等主流浏览器均未完全阻止此行为发生。Local Network Access 草案或会在将来完全杜绝此问题。

- arstechnica.com/~
- https://localmess.github.io/

linksrc: blog.gslin.org/~

#Privacy #Meta #Yandex

Telegram 原文

Ars Technica · Meta and Yandex are de-anonymizing Android users’ web browsing identifiersBy Dan Goodin
Replied in thread
Abimelech B. 🐧🇩🇪| wörk ™️

@guardingpearsoftware
Kontext:

It is plausible that users browsing the Internet and visiting sites integrating Yandex and Meta’s ID bridging between web and native apps, may not be fully aware of this behavior. In fact, the novel tracking method works even if the user:
- Is not logged in to Facebook, Instagram or Yandex on their mobile browsers
- Uses Incognito Mode
- Clears their cookies or other browsing data

This tracking method defeats Android's inter-process isolation and tracking protections based on partitioning, sandboxing, or clearing client-side state.

Auch wenn das heute von Meta abgestellt wurde, finde ich das weiterhin alles sehr bedenklich:

📢 UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed.

localmess.github.io bzw. archive.is/YhOYC

localmess.github.ioCovert Web-to-App Tracking via Localhost on Android
#android#facebook#meta
Guardian Project

#Meta #Facebook and #Yandex are always looking for new ways to spy on you and track you. #LocalMess is the latest in a long line of abusive methods to gather your private data. Having their mobile app installed gives them super powers. Uninstall it. If you must use these services, do not use their app, keep it in the browser, or even better, use a wrapper app, like

* f-droid.org/packages/it.rignan
* f-droid.org/packages/us.spotco

Here is a nice technical write up:
localmess.github.io/

f-droid.orgSlimSocial for Facebook | F-Droid - Free and Open Source Android App RepositoryBrowse Facebook
#tracking#privacy
AfterDawn

Härski vakoilu paljastui: Facebook salakuunteli millä sivuilla käyttäjät käyvät Chromen incognito-tilassa

Sekä Meta että Yandex ovat seuranneet salaa käyttäjiensä aktiviteetteja, myös ulkopuolisten selainten yksityisissä tiloissa. Tiedot on saatu yhdistettyä käyttäjän oman käyttäjäprofiilin tietoihin väärinkäyttämällä yleisiä verkkostandardeja.

dawn.fi/uutiset/2025/06/09/met

AfterDawn · Meta vakoili käyttäjien incognito-selailuaBy Petteri Pyyny
#yksityisyys#meta#facebook
Miguel Afonso Caetano

"We disclose a novel tracking method by Meta and Yandex potentially affecting billions of Android users. We found that native Android apps—including Facebook, Instagram, and several Yandex apps including Maps and Browser—silently listen on fixed local ports for tracking purposes.

These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users' visiting sites embedding their scripts.

This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users’ web activity."

localmess.github.io/

localmess.github.ioCovert Web-to-App Tracking via Localhost on Android
#CyberSecurity#Android#Meta
TrendingLive feeds
About