Hackers' Pub

Syntax	Description	Examples
`"` keyword `"`	Finds the string within quotes, including spaces. Case-insensitive. (Escape quotes inside with `\"`)	`"Hackers' Pub"`
`from:` handle	Finds content written by the specified user.	`from:hongminhee` `from:hongminhee@hollo.social`
`lang:` ISO 639-1	Finds content written in the specified language.	`lang:en`
`#` tag	Finds content with the specified tag. Case-insensitive.	`#HackersPub`
condition condition	Finds content that satisfies both conditions on either side of the space (logical AND).	`"Hackers' Pub" lang:en`
condition `OR` condition	Finds content that satisfies at least one of the conditions on either side of the OR operator (logical OR).	`#HackersPub OR "Hackers' Pub" lang:en`
`(` condition `)`	Combines the operators within the parentheses first.	`(#HackersPub OR "Hackers' Pub" OR "Hackers Pub") lang:en`

Jan Wildeboer 😷 @jwildeboer@social.wildeboer.net

6/3/2025, 3:24:41 PM

Public

So there's a new disclosure on how Facebook/Meta and Yandex used local ports on Android devices to track and de-anonymise users since years (Apple iOS seems to not be affected, Android only)

Q: Why did Facebook stop using this technique on the day of your public release?

A: We don’t know ¯\_(ツ)_/¯, but we're happy to see that Android users are no longer affected by this type abuse after our disclosure (for now).

https://localmess.github.io

Covert Web-to-App Tracking via Localhost on Android

How does this work? While there are subtle differences in the way Meta and Yandex bridge web and mobile contexts and identifiers, both of them essentially misuse the unvetted access to localhost sockets. The Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs.

localmess.github.io

If you have a fediverse account, you can quote this note from your own instance. Search https://social.wildeboer.net/users/jwildeboer/statuses/114620123151656825 on your instance and quote it. (Note that quoting is not supported in Mastodon.)