7 ms·
Facebook scans system libraries on Android and uploads them to their server
- cstross 7y agoHow is this not utterly illegal in the EU, per GDPR? (Which was drafted to stop indiscriminate data acquisition on human subjects: I'm assuming that metadata about the core libraries on your phone, in conjunction with FB's user metadata, are trivially de-anonymizable.)
- cameronbrown 7y agoIt's not metadata, is IS the binaries.
- cstross 7y agoI'm pretty sure you can fingerprint a device by gathering data about the binaries (and versions thereof) installed on it. I'm pretty sure that Facebook also know whose instance of the FB app is running on the device in question. Ergo, the data can be deanonymized and gives them more insights into what their users are doing … including, oh, competing platforms and apps? The traditional model of computer security assumes that there's one device (the computer) which may have multiple users, so the emphasis is on identifying the user to the device. But today, one user may have one or more computers (smartphones/tablets/laptops), so the emphasis is on linking devices to users and thereby tracking usage patterns across devices. Which lands it straight in GDPR territory.
- cameronbrown 7y agoNo I meant they're outright uploading binaries, not just metadata.
- londons_explore 7y ago> I'm pretty sure you can fingerprint a device by gathering data about the binaries Actually, probably not. These libraries are the base system image, which is read-only, and typically will only identify which model of phone it is. It might identify you if you have a custom android build you've done yourself though.
- jethro_tell 7y agoShit, there are dozens of us. Dozens
- shawnz 7y agoHow does this provide any more data for fingerprinting than just checking the model of the phone?
- wongarsu 7y agoMy previous phone got an OS patch every few months. You would get most of this by reading the phone model and Android version, but there's probably a smidge more information in the library versions
- brador 7y agoHarder to spoof, less likely to be faked, plus additional meta information.
- shawnz 7y agoFor starters, I'm not convinced it would be harder to spoof that than the library information (which also seems pretty easy to spoof if not easier). But even if that were the case, why would they spend this level of engineering effort just to be able to fingerprint people in that extremely rare case of having a spoofed phone model? Do you think that kind of customer would even be receptive to targeted ads in the first place? It just doesn't make sense to me.
- brador 7y agoTracking value increases with rarity. Data is packaged and sold, not simply stored and empty cells can go for crazy money if the target is hot enough. How much would you pay for Elons verified personal number?
- londons_explore 7y agoI would assume system libraries don't count as personally identifiable data (after all, millions of people have those same libraries), so the gdpr doesn't apply.
- makomk 7y agoIn general, I don't think this is going to collect any more identifiable data than just logging the phone model and Android build ID would; under almost all circumstances every build should correspond to exactly one set of system libraries, and they could match across upgrades just as easily with just the build metadata. Generally, every phone of the same model sold by the same carrier in the same country will have the exact same Android build with the exact same system libraries. The main benefit that Facebook likely get out of this is that it helps them debug crashes on devices they don't have themselves.
- izacus 7y agoUnder which provision would this be illegal though? It's the operating system image Facebook can get by just buying the exact same model of phone the user owns. I'm having trouble finding under which definition of GDPR managed personal data does this fall over. The only angle I see is copyright infringement for copying libraries owned by the phone manufacturer... but even that I'm not sure if it's really illegal in this case. Worth filing a complaint anyway I guess.
- wongmjane 7y agoPrevious discussion: https://news.ycombinator.com/item?id=20839689 https://news.ycombinator.com/item?id=20839689
- gothack 7y agoAnother reason I'm glad I quit
- troseph 7y agoAndroid or Facebook?
- ropiwqefjnpoa 7y agoBoth for me. But my drug of choice is Instagram, so FB still has me...
- ulfw 7y agoBoth. No point using an operating system that is a malware and privacy nightmare, just so I can fiddle with it more. It's not a computer, it's just a phone. And no point using Facebook, really. Still with Whatsapp (and passively Instagram) as my friends are massively on those.
- leggomylibro 7y agoWhatsapp and Instagram are Facebook. The same company owns and runs all three.
- ulfw 7y agoI am well aware of that. Thus I mentioned I am still with those apps (involuntarily). So still with Facebook Inc, but not Facebook.com/App
- amelius 7y agoFingerprinting on steroids?
- Nextgrid 7y agoIt's copying the actual libraries, so it's more like cutting off actual fingers rather than just taking the prints.
- anandchowdhary 7y agoMaybe more like making a copy of your fingers and keeping them while leaving your actual fingers intact.
- 0x0 7y agoIf the actual files are uploaded(?), doesn't this constitute reverse software piracy? Under what license are the uploaded files covered by? Can facebook require the end users to supply the source code for GPL-licensed library binaries uploaded through this system? What about proprietary oem blobs that are often covered by a no-redistribution license or EULA? What if I am an AOSP or vendor developer working on unreleased R&D next-version Android?
- amelius 7y agoNice angle but I guess the defense is that the user explicitly gave Facebook permission to read those files.
- rocqua 7y agoIf I buy a book, I'm allowed to read that book, but I am not allowed to copy it.
- spunker540 7y agoYou are allowed to copy it, you just can’t sell copies of it.
- rocqua 7y agoThe first line of wikipedia: "Copyright is the exclusive right, given to the creator of a creative work, to reproduce the work" You probably won't be in trouble until you start trying to distribute your copies, but the prohibited thing is copying. Hence the term copy-right.
- EarthMephit 7y agoYou are not allowed to copy it, or sell copies of it Under fair-use laws (which vary country to country), you can usually copy a small portion of the work for non-profit educational use https://en.wikipedia.org/wiki/Fair_use https://en.wikipedia.org/wiki/Fair_use
- 7y ago
- tanilama 7y agoHow does this pass through their legal team?
- solarkraft 7y agoI suspect they don't run anything through their legal team, only ask them to help after they've fucked up. This has the advantage of getting away with things the legal team would advise against, which I think they do a lot.
- tanilama 7y agoIf that is true...This is a culture inbreeding disaster...
- IloveHN84 7y agoWhat about the breaking of GDPR as well?
- z3t4 7y agoApps should be statically linked and the kernel should not allow any access to the hdd or fs. Where you have to opt in to what folders the app is able to read or write to. Same for network access and any other hardware, camera, mic, etc.
- londons_explore 7y agoFrequently those static libraries provide device-specific functionality. For example, the Jpeg decompressor on my phone uses custom silicon, and is a systemwide shared library.
- heavenlyblue 7y agoIs there any way to make memory pages executable, but not readable?
- wongarsu 7y agoKernel modules are executable, but not readable (by userspace processes). Or just have it in a different process and talk over IPC.
- namanaggarwal 7y agoThis is pretty bad.
- buildzr 7y agoOkay what is the purpose of this even? Sure, everyone is going to talk about fingerprinting, but let's face it, there are way easier and more reliable methods of doing that than system libraries that mostly match between same devices. Must be for some sort of debugging? Still seems insane...
- londons_explore 7y agoThere are hundreds of thousands of variants of android phones. Facebook wants their app to work on all of them, but cant track down all of those physical devices. Instead, I bet they load all the libraries into a big test bench and check all features of the app work with all possible hardware. It wouldn't be perfect, since I bet many of those libraries rely on custom system services, kernel interfaces, etc, but I bet it helps them track down a bunch of issues before they impact real users.
- shawnz 7y agoMy guess is that it helps to detect spamming tools, flash game cheats, malware that affects Facebook apps, etc.
- js2 7y agoAs someone who’s built my company’s mobile crash reporting solution, I have a guess why they might do this. It’s is extremely difficult to diagnose Android native code crashes. Unlike iOS where it is both straightforward to unwind on the phone, and where Apple makes the iOS system symbols available for symbolizing system frames in a stack trace, neither of these things are true on Android. My first approach for my company’s Android crash manager SDK was to use Google Breakpad. This works by capturing a snapshot of stack memory at the time of the crash. Unwinding then occurs on a backend server. But to unwind successfully, absent a frame pointer register, you need unwind info to provide to the unwinder. This simply isn’t available except for Nexus devices for which you can download the system images from Google. And even on devices where the code was compiled with a frame pointer, you still need symbols so you know what each frame’s function was. Another approach is to unwind on the device. In my experience, using libunwind, this is successful about 50% of the time. It also risks hanging the app, which looks even worse to the user than just crashing. Years ago, I briefly considered having our crash SDK, optionally and with user consent, extract the symbols and unwind data from the libraries on the device and upload them to our backend. I dismissed it as too expensive to do on a user’s phone. Instead, we crowd source as much as we can from our employee phones. Android native code crashes remain a bear to diagnose. Especially annoying since Android itself collects a ton of diagnostic data about your app when it crashes - it just doesn’t make it easily, or in some cases at all, accessible to the app itself.
- deleted 7y ago[deleted]
- lugg 7y agoThis is clearly not for crash reporting. They're sucking up libs to figure out what apps their users use. Could be a few reasons, could be boring metrics, could be anticompetitive identification of acquisition targets, could be oppo research, could be user profiling. None of these things I'm ok with Facebook getting off my phone.
- Shish2k 7y ago> They're sucking up libs to figure out what apps their users use. Hypothesis 1, debugging: requires full copies of system libraries Hypothesis 2, fingerprinting: requires hashes of application libraries Evidence: full copies of system libraries are being uploaded How are you using that evidence to be so confident in hypothesis 2 and confidently against hypothesis 1?
- arien 7y agoWhat about the Instagram and WhatsApp apps? Do they behave the same way?
- FeatureIncomple 7y agoI'm really interested in an answer for this question, since WhatsApp is the only Facebook app I have installed/keep an account. Unfortunately, everyone uses WhatsApp in Brazil, and very few people uses Telegram, for example. This makes it kinda impossible to be Facebook-free here.
- pbhjpbhj 7y agoWouldn't they just hash the libraries, surely they can get copies by legal means, like buy "a few" phones?