Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Those are good, but they don't work for what the GP is talking about. I'm seeing games/apps associated with my FB account even though I never logged in to FB with them or gave them any info. I literally just opened the app and that activity was associated with my FB account.

I have no idea how they're doing this, since they didn't even request storage access (or I didn't give it). Can any Android developer here chime in on how an app can figure out my Facebook ID even though I don't even have Facebook installed on my phone and didn't give any sort of credential or access to the app?



I think they cross-reference Android Advertising ID in their SDK. Have you ever logged to Facebook from your phone?

https://developers.facebook.com/docs/app-ads/targeting/mobil...


I have, either in the browser or in Swipe (a third-party app). I've never logged in to or installed the Facebook app or Messenger.


Try to opt out of Advertising ID (Settings -> Google -> ads) and see if apps continue to be associated with your facebook account. I suspect Swipe sent both your account ad advertising id during login.


I opted out of Google advertising a long time ago, I think in the end it was Instagram/WhatsApp that did the dirtywork.


Then FB left behind tracking data, and there's your link. Sigh.


How? It was running in a browser.


Once you've logged into facebook from the device, they likely created a device fingerprint for your device: https://en.wikipedia.org/wiki/Device_fingerprint . This would allow them to identify you even without a cookie or ad id to correlate against.


I don't think the browser fingerprint and native app fingerprint are the same, what you say sounds unlikely to me.


Fingerprinting across devices is possible too, using things like behavioral analytics, network traffic, timing, third-party data sources etc.

The third party data sources is the easy one. Log into service A on your computer and service A on your phone. Service A fingerprints both and sells the data to service B. Now service B knows how to correlate your behavior between devices even though you never logged in.

I’m sure you’ve logged in something on both your phone and computer. It doesn’t have to be Facebook.


Maybe same phone number on Google Play and Facebook or some other way the phone number IDs you?

Edit: This report[1] puts the blame mostly on Google ads ID.

[1] https://privacyinternational.org/report/2647/how-apps-androi...


That's possible, though if any app can get my number without asking for any permission I'm going to throw my phone away.


Are you using Instagram or WhatsApp?


Ahh, there we go, I forgot about those... That must be it, thanks.


The whole point of them buying WhatsApp was to have a backdoor into people's contacts (among other things).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: