Slashdot Mirror
Researchers Identify 44 Trackers in More Than 300 Android Apps (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: A collaborative effort between the Yale Privacy Lab and Exodus Privacy has shed light on dozens of invasive trackers that are embedded within Android apps and record user activity, sometimes without user consent. The results of this study come to show that the practice of collecting user data via third-party tracking code has become rampant among Android app developers and is now on par with what's happening on most of today's popular websites. The two investigative teams found tracking scripts not only in lesser known Android applications, where one might expect app developers to use such practices to monetize their small userbases, but also inside highly popular apps -- such as Uber, Twitter, Tinder, Soundcloud, or Spotify. The Yale and Exodus investigation resulted in the creation of a dedicated website that now lists all apps using tracking code and a list of trackers, used by these apps. In total, researchers said they identified 44 trackers embedded in over 300 Android apps.
This stuff will NEVER cease until Google themselves stops being the greatest Data Sink of all time, and puts some actual Privacy into Android. ...and we ALL know when that will be.
The new moviepass app doesn't even try to hide that they track you even when the app isn't open, keeping your gps full blaze.
Reverse tracking would be that whenever someone tracks your life, you get the legal right to track them back. So if the CEO of Company X puts a tracker on your Android phone peering into your private life, for example, you'd get the legal right to track that CEO back and peer into HIS private life and habits. If a big data company is collecting data on you, your spouse, your kids, you would have the legal right to collect big data on THAT big data company's activities, including insight into that company's most private activities. Watch how quickly all tracking stops when such a law is passed.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
Android users never leave their moms basement so these trackers are useless
From the article:
"In total, researchers said they identified 44 trackers embedded in over 300 Android apps. Overall, three-quarters of the 300+ apps Exodus analyzed contained at least one tracking component, with Google's CrashLytics and DoubleClick being the most popular trackers.
While some trackers collected only app crash reports (such as Google's CrashLytics), some of these trackers also collected app usage info and user details, some of which were sensitive in nature."
So, a majority of the apps are "contaminated" only with a plug-in from Google that collects "only app crash reports" - but somehow this indicates a massive privacy breach in 300+ Android apps? I think they may be a little overly paranoid on this one. Get back to me with legit numbers of "real, scary" tracking plug-ins...
A computer once beat me at chess, but it was no match for me at kick boxing -- Emo Phillips
As opposed to what? All the ones where the users begged to be tracked?
Is this a problem iPhones too, or is this just an android problem?
Maybe that reason is more careful app review, or the fact that it's not nearly so easy to collect interesting data from an iOS app because the user has to agree to access and the app has to declare its intent to access (which is also part of the review), nor or iOS apps as freely able to run all the time.
I've no doubt there are some trackers embedded in iOS apps, but I would think it would be a lot more limited scene because few apps would garner much use or ability to mine data.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Do they have an app that I can install to check the apps on my phone? Not that it will do me much good if I still want to run those apps.
What I really want is a fake location service that returns a fake cell phone tower ID and fake GPS, but based on a real location of my choice. Then apps that want location data will get the fake location except for ones that I want to give the real location to (for example, Waze).
So, where is the App that scans for these, and blocks the data endpoints?
I have Ad-Away from the F-Droid store, but I'm betting that my patched hosts file doesn't block them all.
Make America grate again!
That why I only use a professionally coded and reviewed iOS, which is built using a real OS: UNIX. That piece of junk called Android is based on Linux, which is a third rate Unix wannabe.
If in 2017 you're still using a smartphone then you're signing off on being monitored, tracked, and surveilled continuosly, plain and simple. Dump the smartphone, get the cheapest dumbphone you can manage to have, only turn it on when you really need to use it, and otherwise learn to do without. Enough people do this and the wireless companies and phone manufacturers will get the idea: stop spying on people or you'll lose money.
Developers have bills too.
Every app at every company I've worked at has implemented Crashlytics / analytics services so that developers can fix issues, and marketing can get off to user events inside the app. This is exactly the same on iOS. There are no doubt apps out there that sell user data (I mean It's the damn business model of the internet) but it's not the primary use of these trackers.
"The Yale and Exodus investigation resulted in the creation of a dedicated website that now lists all apps using tracking code and a list of trackers, used by these apps."
I know the link is buried in the story, but why not link to it directly, especially since it was mentioned in the summary.
http://reports.exodus-privacy.eu.org/reports/apps/
Some of knew that virtually every app made by a commercial enterprise had trackers to extract data. This is why so much money has been spent on creating apps for phones instead of Phone friendly websites: you can get a LOT more data and have viewer options to block it. Otherwise it would be cheaper in development and maintenance to do a mobile friendly website. Data mining is the biggest business in the world right now and google is one of the leaders of this charge. Now, for those who WANT to get rid of this you can start by using an OS that doens't have google #$% apps preinstalled. LinageOS ( https://www.lineageos.org/ ) or Replicant OS (https://www.replicant.us/) as well as a phone that you can lock down microphones, cameras, and wireless that is linux based (https://puri.sm/) with no google spyware nonsense. If you have a more trusted on your Android compatible phone using LinageOS, CyanogenMod (old) or Replicant, you can get apps more trustworthy from FOSS using the F-Droid app (https://f-droid.org/). At least the apps are less likely to track you. Most don't ask for weird permissions like most commercial apps from, say the Google store tend to do. Hope that helps everyone remove the chains from their phones.
"Imagination is more important than knowledge" - Einstein
These trackers are all installed by Santa! How else is he going to know if you're being naughty or nice.
You better watch out,
You better not cry,
You better not pout,
I'm telling you why,
Santa Clause is tracking your phone.
He sees you when you're naked,
he watches you undress,
he tracks your phones movement,
upon his G. P.S.
"That's the way to do it" - Punch
Why mention this if you're not even going to link to it?! Here's the URL that should have been plastered in the summary, and made more visible in TFA
Say you have downloaded an application to stream a particular movie from a particular provider. This movie is an adaptation of a novel whose copyright has expired in country A but not yet in country B, whose copyright term is longer than that of country A. This means the provider holds the rights to stream the movie to viewers in country A, not to viewers in country B. Without tracking the user's true location, how should the provider determine whether it has the rights to stream the movie to a particular viewer?
Why not link to the source of the story instead of some commercial middleman? Is it all about kickbacks? Here's the list: https://reports.exodus-privacy...
...omphaloskepsis often...
I miss Space Trader on my Palm V
Ironically TFA is on a site that's full of trackers. I'm using the EFF's Privacy Badger extension, and I get:
detected 23 potential trackers on this page.
Get the free NetGuard firewall. Block everything except what you need to access the web. I even block everything google. No one gets out when NetGuard is running.
One can setup an OpenVPN with 'squid' as a proxy on the VPN. Configure OpenVPN to have clients direct all traffic through the VPN. And add an 'acl' to block all regex patterns in a file pointed to in squid.conf
Look at the GitHub link provided in the article. Under the "trackers" link, each entry has "Exodus Detection Rules" with regex patterns that you can have "squid" block.
You can add advertisers and other annoying site patterns to that list,
Connect to the VPN from your phone and things should be better.
On Android 5+, apps now have pops up (one time) for you to grant it permission to use those permissions.
If you have LineageOS, you can turn off everything including network for apps.
...they're even recording my kegel exercise history damnit!