Hacker News 100 @hn100@social.lansky.name
Public

Covert Web-to-App Tracking via Localhost on Android

Link: localmess.github.io/
Discussion: news.ycombinator.com/item?id=4

Covert Web-to-App Tracking via Localhost on Android

How does this work? While there are subtle differences in the way Meta and Yandex bridge web and mobile contexts and identifiers, both of them essentially misuse the unvetted access to localhost sockets. The Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs.

localmess.github.io

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://social.lansky.name/users/hn100/statuses/114620026761043988 on your instance and quote it. (Note that quoting is not supported in Mastodon.)