<![CDATA[Holy shit this is detailed.]]>Holy shit this is detailed. Can you believe the hubris to silently collect all this information on users?

https://browsergate.eu/how-it-works/

]]>https://forum.fedi.dk/topic/81e3a2d5-7ba7-4800-8d99-89d671dcb6da/holy-shit-this-is-detailed.RSS for NodeMon, 13 Apr 2026 16:23:13 GMTThu, 02 Apr 2026 20:06:39 GMT60<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:59:43 GMT]]>@YurkshireLad no. Nearly any mobile app can do this and more.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/paco/statuses/116337356554151632https://forum.fedi.dk/post/https://infosec.exchange/users/paco/statuses/116337356554151632Thu, 02 Apr 2026 21:59:43 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:59:11 GMT]]>@energisch_ I’m not a lawyer or European. But that blog makes a very strong argument that you’re right: it sure seems illegal by EU law.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/paco/statuses/116337354445437435https://forum.fedi.dk/post/https://infosec.exchange/users/paco/statuses/116337354445437435Thu, 02 Apr 2026 21:59:11 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:47:29 GMT]]>@paco But this cannot be legal in Europe/EU!

]]>https://forum.fedi.dk/post/https://troet.cafe/users/energisch_/statuses/116337308425435078https://forum.fedi.dk/post/https://troet.cafe/users/energisch_/statuses/116337308425435078Thu, 02 Apr 2026 21:47:29 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:43:17 GMT]]>@paco I bet they’re not the only ones that scan your extensions.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/YurkshireLad/statuses/116337291897075957https://forum.fedi.dk/post/https://mastodon.social/users/YurkshireLad/statuses/116337291897075957Thu, 02 Apr 2026 21:43:17 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:29:42 GMT]]>@paco

for anyone who'd like a sense of their more common fingerprint, see here:

https://amiunique.org/

I wish this site had 4B entries and not 4M ...

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/joriki/statuses/116337238513751664https://forum.fedi.dk/post/https://infosec.exchange/users/joriki/statuses/116337238513751664Thu, 02 Apr 2026 21:29:42 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:17:23 GMT]]>@kitkat_blue Years ago I was working for a retailer in the UK who had only recently built their first mobile app on iOS. Like most apps of that era, it was little more than a webview and it didn't need much permisisons.

Like most developers, they had incorporated some analytics package that was reporting on users' interaction with the app. I'm fairly sure it was a binary library that they linked into their app. I don't think they got source code. I might be wrong.

I could see the telemetry going up in the analytics API calls. Which buttons, which pages, etc.

Then one day they launched an app feature "find a store near me." Now the app needed location permissions. If the user granted location permissions, the analytics library got access to location. Anything the app can do, the analytics library can do. And, sure enough, those analytics telemetry messages started to carry GPS coordinates from the user to this third party. My customer didn't make any change to their code. They didn't turn that on. They just asked for, and got, location permission from the end user for a legit purpose in the app.

I pointed it out, because this was a change in behavior that was not contemplated by their privacy policy. Heck, it's a change in behavior they didn't even know had happened! It wasn't in their code! So they quietly pushed out a small update to the policy that made it OK.

That was probably like 15-16 years ago.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/paco/statuses/116337190078356106https://forum.fedi.dk/post/https://infosec.exchange/users/paco/statuses/116337190078356106Thu, 02 Apr 2026 21:17:23 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 21:03:31 GMT]]>@paco

I'm more concerned with the fact that extensions *can* be detected this way. Web pages should not be able to detect the presence of extensions. If they can, that's a security vulnerability.

]]>https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/116337135558580471https://forum.fedi.dk/post/https://mastodon.sdf.org/users/argv_minus_one/statuses/116337135558580471Thu, 02 Apr 2026 21:03:31 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 20:55:25 GMT]]>@paco

Kinda makes you wonder what all the other slimy digi-corpos are doing.... this is just one that's been caught after all.

]]>https://forum.fedi.dk/post/https://mastodon.social/ap/users/115736792646413589/statuses/116337103693441147https://forum.fedi.dk/post/https://mastodon.social/ap/users/115736792646413589/statuses/116337103693441147Thu, 02 Apr 2026 20:55:25 GMT<![CDATA[Reply to Holy shit this is detailed. on Thu, 02 Apr 2026 20:26:57 GMT]]>@paco i worked at major anti-virus company. not only i can believe it, i think it’s default mode of all companies that came into contact with any sellable user data

]]>https://forum.fedi.dk/post/https://mastodon.social/users/cerny_kocky/statuses/116336991788423914https://forum.fedi.dk/post/https://mastodon.social/users/cerny_kocky/statuses/116336991788423914Thu, 02 Apr 2026 20:26:57 GMT