500
submitted 2 weeks ago by otter@lemmy.ca to c/technology@lemmy.world

Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.

The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources. Defenses such as state partitioning and storage partitioning, which are built into all major browsers, store site cookies and other data associated with a website in containers that are unique to every top-level website domain to ensure they're off-limits for every other site.

top 50 comments
sorted by: hot top controversial new old
[-] einkorn@feddit.org 134 points 2 weeks ago

Well, it's always been a cat and mouse game.

Just earlier today, I got a pop-up on YouTube about how they would block me after 3 videos because I use an ad blocker. Jump to now and everything is fine again. Thank you, uBlock Origin!

[-] Kerb@discuss.tchncs.de 47 points 2 weeks ago

they still try that?

i can't remember the last time i have seen one of those warnings.

[-] cygnus@lemmy.ca 35 points 2 weeks ago

I'm guessing you use Firefox? It's much better at evading that tracking.

[-] chronicledmonocle@lemmy.world 5 points 2 weeks ago

Nah I saw it on FF as well. Forcing an update on the "Quick Fixes" blocklist on uBlock Origin got rid of it.

[-] UnderpantsWeevil@lemmy.world 11 points 2 weeks ago

The business cycle dictates that companies try to re-implement bad ideas every six months to two years.

If the idea was good, they'd have implemented it and made their money. Only bad ideas are still ripe for exploitation and new economic growth, because you haven't had someone as smart as me to make them work right.

[-] Sixtyforce@sh.itjust.works 5 points 2 weeks ago

Google doesn't do global roll outs with their updates. The anti adblock stuff especially. They target only some % of randomly selected users to spread confusion online, and I would guess their hope is to frustrate people into disabling ad blockers on Youtube after reading a bunch of misinformation and placebo bad advice when looking for tech support.

[-] raltoid@lemmy.world 22 points 2 weeks ago* (last edited 2 weeks ago)

Fair warning: Last week one of my accounts was seemingly shadowbanned, and now gets "This content isn't available" on every video.

Logging out plays videos, making a new brand account worked, etc. and no notification from youtube.

load more comments (1 replies)
[-] Snowpix@lemmy.ca 3 points 2 weeks ago

If you happen to use BlockTube, disable it. It's currently triggering the adblock detection.

load more comments (1 replies)
[-] General_Effort@lemmy.world 64 points 2 weeks ago

Useless article, but at least they link the source: https://localmess.github.io/

We disclose a novel tracking method by Meta and Yandex potentially affecting billions of Android users. We found that native Android apps—including Facebook, Instagram, and several Yandex apps including Maps and Browser—silently listen on fixed local ports for tracking purposes.

These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users' visiting sites embedding their scripts.

📢 UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed.

[-] pineapplepizza@lemm.ee 4 points 2 weeks ago

Thanks for the update, pitchforks down people. Let's go back to blindly trusting these anti consumer cabals.

load more comments (1 replies)
[-] jjjalljs@ttrpg.network 39 points 2 weeks ago

Meta should be broken up and its leadership barred from working in tech (or politics)

[-] MimicJar@lemmy.world 10 points 2 weeks ago* (last edited 2 weeks ago)

and its leadership barred ~~from working in tech (or politics)~~

[-] Alphane_Moon@lemmy.world 31 points 2 weeks ago

I am assuming all of this trash is blocked by uBlock Origin?

[-] carrylex@lemmy.world 10 points 2 weeks ago

Check that "Filter lists > Privacy > Block outsider intrusion into LAN" is enabled and you should be fine

[-] Frellwit@lemmy.world 6 points 2 weeks ago

EasyPrivacy should block Meta and Yandex pixels by default. If you have the knowledge you can put uBO in "hard mode" which will block all 3p connections. It requires you to know which CDNs to allow or websites will be broken.

[-] Alphane_Moon@lemmy.world 3 points 2 weeks ago

I am aware of hardmode, I used to use NoScript.

It's a bit too much work these days.

[-] RvTV95XBeo@sh.itjust.works 23 points 2 weeks ago* (last edited 2 weeks ago)

We found that browsers such as Chrome, Firefox and Edge are susceptible to this form of browsing history leakage in both default and private browsing modes. Brave browser was unaffected by this issue due to their blocklist and the blocking of requests to the localhost; and DuckDuckGo was only minimally affected due to missing domains in their blocklist.

Aside from having uBlock Origin and not having any Meta/Yandex apps installed, anyone aware of additional Firefox settings that could help shut this nonsense down?

[-] Saleh@feddit.org 10 points 2 weeks ago

I know that people here generally like to shit on Brave, but it seems that the claim "Privacy by default" has held up in this context.

load more comments (1 replies)
[-] Quibblekrust@thelemmy.club 5 points 2 weeks ago* (last edited 2 weeks ago)

I feel like that's all you need. You don't have their apps installed, so the problem is already solved. If you use uBlock Origin to block their trackers, the problem is solved. So you've solved it twice.

[-] RvTV95XBeo@sh.itjust.works 2 points 2 weeks ago

Yes and no, I've treated the symptoms, but not the problem. All it takes is a trillion dollar company buying a new domain every once in a while to foil uBlock, and now that it's more known, anyone can create an an app that opens ports and listens for trackers.

Would love it if Firefox would let me block all requests to localhost.

[-] TankovayaDiviziya@lemmy.world 18 points 2 weeks ago

De-anonymising Yandex

Me: Ha! Good thing I am not Russian!

De-anonymising Meta

Me: Damn..and it is hard for me to let go because my social circle use Meta-owned social media and couldn't care less about privacy....I am toast...

[-] theseer@lemmy.zip 16 points 2 weeks ago

I used to be in your situation and one day I just told everyone I was leaving and if they want to contact me they would have to use Signal. You can't change most people's minds and Meta knows it, that's how they keep their monopoly

[-] cupcakezealot@lemmy.blahaj.zone 5 points 2 weeks ago

laughs in adguard

[-] lechekaflan@lemmy.world 5 points 2 weeks ago* (last edited 2 weeks ago)

Not surprising, it's always expected from tech corporations, where at the end of the day it's profit and favor with conservative politicians. If they're not trying to use information gathered on people to bad government looking to cut costs ("saving taxpayers' money") by removing minority beneficiaries, they love to shove content you don't even want.

Why I never use my real name online.

[-] LainTrain@lemmy.dbzer0.com 4 points 2 weeks ago

Block all tracking scripts and use Firefox Nightly with ublock when possible.

[-] grue@lemmy.world 12 points 2 weeks ago

Not sure about the "nightly" part (as opposed to beta or stable), but yes.

[-] LainTrain@lemmy.dbzer0.com 2 points 2 weeks ago

I prefer nightly because about:config is accessible unlike on the mainline version. Does Beta also allow that?

[-] limerod@reddthat.com 3 points 2 weeks ago

Beta does and unlike nightly doesn't update every night.

There's also Fennec on fdroid if you need something stable with about:config support.

[-] ayyy@sh.itjust.works 5 points 2 weeks ago

Using such a unique browser version is very de-anonymizing.

load more comments (6 replies)
[-] Eeyore_Syndrome@sh.itjust.works 2 points 2 weeks ago* (last edited 2 weeks ago)

Consider getting a modern Pixel w/GrapheneOS!

  • Slaps his lap.

It has the Vanadium.

[-] grue@lemmy.world 3 points 2 weeks ago* (last edited 2 weeks ago)

Are you suggesting something like LineageOS is a better choice?

(Seriously asking: I've got a new-to-me Pixel that I'm looking to switch to a degoogled-ish ROM on, and Graphene and Lineage were the two front-runners.)

[-] TheLowestStone@lemmy.world 6 points 2 weeks ago* (last edited 2 weeks ago)

I'm running Graphene and I'm very happy with it.

[-] pinball_wizard@lemmy.zip 4 points 2 weeks ago* (last edited 2 weeks ago)

If it's a Pixel anyway, GrapheneOS has a few nice security and privacy features that LineageOS doesn't have (yet?).

I think both are pretty great and much better than most alternates.

[-] avidamoeba@lemmy.ca 2 points 2 weeks ago* (last edited 2 weeks ago)

Does anyone know if there's additional sandboxing of local ports happening for apps running in Private Space?

E: Checked myself. Can access servers in Private Space from non-Private Space browsers and vice versa. So Facebook installed in Private Space is no bueno. Even if the time to transfer data is limited since Private Space is running for short periods of time, it's likely enough to pass a token while browsing some sites.

load more comments
view more: next ›
this post was submitted on 03 Jun 2025
500 points (99.8% liked)

Technology

71802 readers
1948 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS