For the best experience on desktop, install the Chrome extension to track your reading on news.ycombinator.com
Hacker Newsnew | past | comments | ask | show | jobs | submit | history | more cpv's commentsregister

There's also this http://moveordiegame.com/

Not affiliated, seen the talk from GDC about it.


> Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles

Probably these can have a different impact if your threat model is a bit different (money, status, living area, position held, etc).

Reminds me the story about an investigative reporter known in these parts, who was swatted: https://krebsonsecurity.com/2013/03/the-world-has-no-room-fo...

or received a drug package from an investigated person, basically it was a trap: https://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroi...

The journalist knew about this and informed the police beforehand. Happy end.

To add a little more, I have seen people posting on social media answers to posts like "your favorite car, your place of birth, name of mother, name of pet". Guess who uses those words for similar secret questions?

Some personal identifiable information can be used to fabricate fake IDs, for various purposes.

And if we have a linked graph with all the personal, job, address, interacted people, geo-places, etc, it can get creepy (sounds like Facebook, but much more open).

Not saying we all should get paranoid, but leaked data could be used in different ways.


You can get NetGuard on Android and see how often and what is called (facebook.com, graph.facebook.com, other vendors, platforms, IPs, etc). You can choose to block what is not needed. Kind of uBlockOrigin for Android. Sometimes stuff breaks.

And a lot of stuff is not related to FB Login.

Facebook launched Facebook Off Activity a while ago https://news.ycombinator.com/item?id=22178917

You can go to your profile, and check which third parties, or advertisers uploaded contact data of you, download backup data to see in json files which apps what sent about you ("App activated", "Made some purchase").


Maybe this will motivate product owners, developers, marketers, to start thinking before implementing a dozen of SDKs in a mobile app (or website). It's understandable when you need some analytics/crash reporting, but it becomes a privacy and ethics question when a lot of data is wandering around, and even better, crashes your app. And the users will blame you, they don't even know how many SDKs are there and what they are doing.


> And the users will blame you

Rightfully so. If you add an SDK to you app, it's your fault if the SDK causes your app to crash.


There is also Mozilla's Send.firefox.com, which could be self-hosted https://github.com/mozilla/send


Have you found good alternatives? I'm looking at meteoblue at the moment.


Apps like netguard open the eyes.

And it was sad to see in facebook offline activity how much data was linked to me, from apps which have the sdk. And you don't even need to log in via facebook or like/share. The sdk being present and working is enough.


Netguard proved to me that, despite never having a FB account, I surely had dozens upon dozens of shadow accounts. Pretty much any new hardware that had vanilla Play Store apps were ratting me out the entire time.


Imagine if one day we find that a comet is headed directly to us. That would test and push humanity at its extremes.


How certain would the experts have to be to get such coordinated action?

With close approaches, it seems (as a layman) that there are always pretty large ranges of just how close they will be. I dont think you'd know "a comet is headed directly at us" until way too late. Instead you'd get some warning that there is a 10% chance or something. Over time that would go up to a near certainty. Maybe I'm pessimistic, but I would predict something more similar to climate change with deniers and paralysis.


This remark reminds me of the book, "Seveneves" by Neal Stephenson. He plays with a similar 'what if?' doomsday scenario. Around 80% of the book revolves around testing and pushing humanity at it's extremes.


They even have a better version, the Multi Container plugin. You can separate multiple contexts (fb, goog, banking, memes..), and each lives in a separate container. Takes a little time to get used to, and if used with privacy badger, ublock origin, FF built-in anti-tracking, might give good results in reducing your exposure to online tracking.

Yet some mobile apps still use heavy analytics which is sent to some domains, again, you need something like netguard, vpns, to filter your mobile traffic. Privacy becomes a pain https://media.ccc.de/v/35c3chaoswest-32-toll-of-personal-pri...


My 0.2$, a previous comment of mine https://news.ycombinator.com/item?id=22180163

"Some chat apps (like Viber and others) have Facebook SDK integrated in them, without any direct Facebook functionality people would use. Discovered after using NetgGuard, and seeing who is calling home, and not only home. (Why viber is making requests to graph.facebook.com anyway?)

Duolingo is a nice app for learning new languages, yet it might be using the same sdk, since it likes to call facebook.com domain.

Netflix is a good streaming service, but it has some option somewhere, which allows them to share data with others, and enabled by default. And yes, it's present in fb activity.

The list can go on...

There are developers who integrate dozens of SDKs, without any specific purpose for users, and not knowing what is happening. We need something like PrivacyBadger/ublockorigin for phones/laptops/routers/homes/cars. It's getting more than creepy.

And why would Facebook allow third-parties/businesses upload into FB info they have on their customers...

PS: analysis of how a simple menstrual tracking app is leaking data about the owner https://media.ccc.de/v/36c3-10693-no_body_s_business_but_min... "


You can't really blame developers for this. Most aren't integrating SDKs for no reason at all -- they're integrating them because users are asking for a feature the SDK provides.

For one app I worked on, we made a decision not to include Facebook or Google login and only support email/password login, specifically to avoid leaking information.

A subset of users was not pleased at all -- and they sure let us know about it. Maybe around a third of our support requests were asking for third-party sign-in. People often made privacy arguments in support of it: they'd say "why do I have to give you my email address to create an account?" (though usually much less politely). And they kind of had a point. You may trust yourself more than you trust Facebook, but most people are going to trust Facebook more than they trust [random developer].

Anyway, it takes a lot of effort to deal with these support requests, it sucks getting yelled at (even in text). Some of these users probably went on to give the app a 1-star rating, and just a small percentage of those will really drag down your overall score. Dealing with this was not fun. It would have been much easier to just add FB or Google login.


> You can't really blame developers for this.

Sure I can. And I do. Developers are making these choices, after all. I understand the economic drive behind them, but that doesn't get the devs off the hook.


My point is that some users want Facebook or Google login and get mad if you don't have it. Other users don't want them and get mad if you do. Because you have to decide whether to include the SDK when you build the app, it's impossible to make both groups happy at the same time.


It's not impossible, it just requires more development effort. Just because the SDK is present doesn't mean it always has to be used.


To be honest, Fb login is one of the least reasons I worry.

I have seen apps sending requests to facebook graph without using the login, or they don't have facebook login at all..

I haven't rated any apps based on this, though.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search:

HN For You