Attached: 2 images
🤯 Instagram is testing new iOS push notifications that include a profile photo. Each time the notification is shown on your screen, it triggers a GET request to fetch that image, letting Meta track every on-screen impression.
The app still misuses push notifications to send detailed device analytics about the device (uptime, battery, volume, locale, timezone, memory, CPU, etc.)
#privacy #infosec #privacymatters #Apple #iOS #meta
More 👇🧵
HTTP GET request comes from the device loading the image; AFAIK though wouldn’t be a big deal if Apple’s servers loaded and cached it.
So Meta can watch for the GET requests and determine:
time of delivery to device
approximate location of the device
device’s IP, used to correlate other activity done on that device gathered elsewhere by the IG/FB tracking network
And derive:
what kind of connection you are using
from where
when
what time of day and location do you most often read IG
optimal time to try and distract you
who your preferred service carriers are and if/when you change them
how often you deviate from this pattern
through correlation, determine what deviation might be significant based on other data collected from your device or nearby devices at the same time
oh wow so and so didn’t look at IG much because they searched for baby clothes are they pregnant? Is a friend? Can we show more ads based on that angle to get sales?
and other, much more devious, much grosser intrusions
For your top 3 dot points, I still don’t quite understand why they wouldn’t already have that information if you’re using the app and they’re sending push notifications anyway.
I think the point is they get to know the exact time you first see the notification. It’s a massive flaw in the OS, and I believe I have read about this years ago already, so that “privacy OS” is not intending to fix this leak
What’s the difference between them already knowing each push notification vs a push notification with a GET request?
Push notifications go through Apple servers.
HTTP GET request comes from the device loading the image; AFAIK though wouldn’t be a big deal if Apple’s servers loaded and cached it.
So Meta can watch for the GET requests and determine:
And derive:
For your top 3 dot points, I still don’t quite understand why they wouldn’t already have that information if you’re using the app and they’re sending push notifications anyway.
I think the point is they get to know the exact time you first see the notification. It’s a massive flaw in the OS, and I believe I have read about this years ago already, so that “privacy OS” is not intending to fix this leak
I wonder if disabling the preview in the notification will stop it.
Or Instagram belonging to Facebook? They already know.