Attached: 2 images
🤯 Instagram is testing new iOS push notifications that include a profile photo. Each time the notification is shown on your screen, it triggers a GET request to fetch that image, letting Meta track every on-screen impression.
The app still misuses push notifications to send detailed device analytics about the device (uptime, battery, volume, locale, timezone, memory, CPU, etc.)
#privacy #infosec #privacymatters #Apple #iOS #meta
More 👇🧵
HTTP GET request comes from the device loading the image; AFAIK though wouldn’t be a big deal if Apple’s servers loaded and cached it.
So Meta can watch for the GET requests and determine:
time of delivery to device
approximate location of the device
device’s IP, used to correlate other activity done on that device gathered elsewhere by the IG/FB tracking network
And derive:
what kind of connection you are using
from where
when
what time of day and location do you most often read IG
optimal time to try and distract you
who your preferred service carriers are and if/when you change them
how often you deviate from this pattern
through correlation, determine what deviation might be significant based on other data collected from your device or nearby devices at the same time
oh wow so and so didn’t look at IG much because they searched for baby clothes are they pregnant? Is a friend? Can we show more ads based on that angle to get sales?
and other, much more devious, much grosser intrusions
For your top 3 dot points, I still don’t quite understand why they wouldn’t already have that information if you’re using the app and they’re sending push notifications anyway.
Push notifications go through Apple servers.
HTTP GET request comes from the device loading the image; AFAIK though wouldn’t be a big deal if Apple’s servers loaded and cached it.
So Meta can watch for the GET requests and determine:
And derive:
For your top 3 dot points, I still don’t quite understand why they wouldn’t already have that information if you’re using the app and they’re sending push notifications anyway.