News for hackers. Stuff that matters.

A comment on Washington Post's Privacy Tip: Stop Using Chrome, Delete Meta Apps (and Yandex). Parent comment

Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by bink on Saturday June 07, 2025 @06:44PM (#44213177)
It does sound fantastical. A piece of code that can violate the same origin policy would be a huge vulnerability. Meta could be working with other sites to share data on users via code running on both sites, but snooping on tax data without the IRS helping? Unlikely.

I can only assume they're suggesting that companies like Intuit and H&R Block are sharing this data with Meta, but that seems like a huge violation of privacy and with tax data it might even be illegal.

[ Parent | on HN ]
Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by macNchz on Saturday June 07, 2025 @07:48PM (#44213466)
It's effectively malware—this article has some more detail: https://arstechnica.com/security/2025/06/meta-and-yandex-are...

Basically, they created a channel between the browser and a localhost webserver running in their native apps, by abusing the ability to set arbitrary metadata on WebRTC connections. That way, they were able to exfiltrate tracking cookies out of the browser's sandbox to the native app, where they could be associated with your logged-in user identity.

[ Parent | on HN ]
Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by zzleeper on Saturday June 07, 2025 @11:14PM (#44214312)
Is there any way to fix it within Android? damn...
[ Parent | on HN ]
Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by petre on Sunday June 08, 2025 @12:43AM (#44214593)
Yes, don't install their native apps.
[ Parent | on HN ]
Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by dogtierstatus on Monday June 09, 2025 @05:38AM (#44222757)
that's great but cheaper android phones come with built-in Meta apps/services which cant even be uninstalled.
[ Parent | on HN ]
Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by petre on Wednesday June 18, 2025 @07:55AM (#44309080)
You can still disable them and I think also uninstall with adb.
[ Parent | on HN ]
Re:Washington Post's Privacy Tip: Stop Using Chrome, Delete ... by tholdem on Sunday June 08, 2025 @11:50AM (#44217695)
You are implying Meta and others were able to just siphon data from any website via WebRTC using their native apps, but this was not the case. They were only able to track which websites you visited if that website already embedded the company tracking. Many websites do, but not all.
[ Parent | on HN ]