←back to thread

Everyone knows your location: tracking myself down through in-app ads

(timsh.org)
1957 points apokryptein | 6 comments | 02 Feb 25 17:07 UTC | HN request time: 0.625s | source | bottom
Show context
psanford ◴[02 Feb 25 17:34 UTC] No.42910143[source]▶
Don't use mobile apps that could just be websites.
replies(2): >>42910164 #>>42914279 #
dylan604 ◴[02 Feb 25 17:36 UTC] No.42910164[source]▶
Extended to add don’t use websites without blockers. If they are willing to track via app, why would we think they would not track via browser?
replies(2): >>42910436 #>>42911704 #
nicbou ◴[02 Feb 25 18:11 UTC] No.42910436[source]▶
The browser has less access to your system, and usually only if you give a specific website permission to use these features. Mobile operating systems are slowly changing that though.
replies(1): >>42914282 #
1. scarface_74 ◴[03 Feb 25 02:30 UTC] No.42914282[source]▶
Have you looked at the latest JS standards?
replies(2): >>42914687 #>>42915359 #
2. amatecha ◴[03 Feb 25 03:41 UTC] No.42914687[source]▶
(and if you haven't... check out the APIs available to the developers/owners of all the websites you browse: https://developer.mozilla.org/en-US/docs/Web/API )
replies(1): >>42915348 #
3. mirkodrummer ◴[03 Feb 25 05:46 UTC] No.42915348[source]▶
what should imply checking available web apis? the comments is correct, browser can't access your location without explicit confirmation from the user, the same apply for other web apis, or at least mention a bunch of them which you know don't apply instead of linkin MDN
replies(1): >>42915507 #
4. mirkodrummer ◴[03 Feb 25 05:49 UTC] No.42915359[source]▶
what is contained in the latest js standard that does let you collect fine grained information of your users without their consent? web apis that have to deal with sensitive data all requires explicit user confirmation to be used
replies(1): >>42917471 #
5. amatecha ◴[03 Feb 25 06:22 UTC] No.42915507{3}[source]▶
The more APIs available for JS to interact with, the more granular and detailed browser fingerprinting can be. For example, how your browser renders WebGL can differ depending on what graphics card (and drivers) you have. The resulting values can be read back and stored to create a detailed fingerprint of who you are -- this could potentially be done by Google Fonts or AdSense or any number of the countless ad and analytics frameworks loaded on basically all websites.

Good overview about how fingerprinting works: https://www.privacyaffairs.com/browser-fingerprinting/

Browse the source in the following directory to see a plethora of examples of how web APIs are used to fingerprint users -- and this is just one publicly-accessible library we can easily review the source code of (proprietary, obfuscated ones likely use additional methods): https://github.com/fingerprintjs/fingerprintjs/tree/master/s...

One example used in multiple places in the above repo is "matchMedia"[0] which was a Web API method added a while ago (well, many years ago) to give a programmatic result of whether a given CSS media query matches or not. This can be used to detect, for example, user preferences like whether the display is HDR-capable[1], or the Accessibility setting "reduce motion" is enabled[2].

[0] https://developer.mozilla.org/en-US/docs/Web/API/Window/matc...

[1] https://github.com/fingerprintjs/fingerprintjs/blob/master/s...

[2] https://github.com/fingerprintjs/fingerprintjs/blob/master/s...

6. scarface_74 ◴[03 Feb 25 12:24 UTC] No.42917471[source]▶
The more access to your system that a web page has, the better it can fingerprint you. All of those ApIs aren’t going to be opt in