Covert Web-to-App Tracking via Localhost on Android

Re:Covert Web-to-App Tracking via Localhost on Android by johnisgood on Tuesday June 03, 2025 @01:03PM (#44172170)

I tend to buy stock Android, e.g. Motorola moto g30, etc. It still has lots of Google stuff, but you can get rid of them, and I have a work profile specifically designed for Google-related stuff, and my personal profile is de-Googled as much as possible.

[ Parent | on HN ]

Re:Covert Web-to-App Tracking via Localhost on Android by danieldk on Tuesday June 03, 2025 @02:56PM (#44173376)

I would recommend everyone who wants a clean Android to look into Google Pixel phones. Aside from being mostly bloat-free (and most bloat can be uninstalled), it is one of the few phones that supports unlocking/relocking and a secure open source alternative (GrapheneOS).

[ Parent | on HN ]

Re:Covert Web-to-App Tracking via Localhost on Android by pkaeding on Tuesday June 03, 2025 @10:44PM (#44176756)

Does grapheneos prevent this? In what way? I know apps like ShareViaHTTP [1] are able to open ports (listening not just on the loopback address). If I installed a meta app, could it still run its listener that scripts on webpages could talk to?

[1]: https://f-droid.org/packages/com.MarcosDiez.shareviahttp

[ Parent | on HN ]

Re:Covert Web-to-App Tracking via Localhost on Android by danieldk on Wednesday June 04, 2025 @02:12AM (#44177683)

I didn't say that. Only that GrapheneOS does not come with any adware/malware preinstalled. That said, their default browser did block one of the attack vectors:

https://grapheneos.social/@GrapheneOS/114620254209885149

[ Parent | on HN ]