Grindr and OKCupid Sell Your Data, but Twitter’s MoPub Is the Real Problem

On Android, if you install Xposed, there's XPrivacy [0], which essentially had this premise. Unfortunately, it only supports versions 4.0.3-5.1.1 (and is no longer maintained).

I haven't been following the rooting community for a while, so someone can probably correct me if there's a better alternative now, but I believe the replacement is XPrivacyLua [1].

[0] https://github.com/M66B/XPrivacy

[1] https://www.xda-developers.com/xprivacylua-xposed-module-pri...

It's trivial to detect virtualized environments , not only that, the samples can afford to be patient and meticulous,and test themselves against existing analysis methods before deployment. That's why real hardware is the best place to study malware.

Your disadvantage here is that fingerprinting is a game of accuracy, where the adversary gains accuracy at basically a logarithmic(or geometric?) scale for every additional data point they have about your device, sometimes they only need one data point,such as a shared file system,let me explain: most apps need storage access right? Like you want them to read existing files or write files to be accesses by other apps. App1 writes a file with a random name or random content, app2 through appN in their affiliate network check that location/file for the random value to track your device. The apps in this network all collect various data points about you, let's say one app gets your real name and address (payment and shipping),now all the apps know those two things about you. Now they all know your zipcode and can infer things about you based on that,your last name,etc...and even do background check like lookups to know your past addresses aquaintances, cars you've driven,court cases and so much more. Now let's say one of these apps needs to send you text before it can function(most popular apps these days) , now all of them know your phone,can get a ton of info about you,who else has you as contacts and they can infer even more about if at least one of the people they track has your number as contact and they basically opened up their lives to all apps.

You can add all the layers of abstraction you want. Apps need to talk to each other and external sites/services need to reach you at a predictabl address (including physical address and such). And even if what you said was effective, it's incredibly hard to achieve without the user being very cooperative towards their own privacy preservation, and evem then ,like I said above, if anyone you have as contact reaches you using a predictable address, a lot can be constructed about solely based on their choices.

My solution is legal. Make it a crime and start throwing people in prison. If someone violates your consent to stalk you or creates public opportunities of business or employment where consenting to stalking is a requirement, make it a felony. And make privacy a core right for peoples of any society that calls itself free.

Unlike with malware authors, we can easily find the execs behind stalkerware and we can make them take responsibility (assuming people want liberty and democracy more than political theatrics).

LMT does not hide your IDFA. You can reset it fine, but it's always there.

Also, hell hath no fury like a brand-safety conscious advertiser whose ad appears next to dick pics on Grindr.

The call out to make are the fields device.d(p)idmd5, device.d(p)idsha1 (both now deprecated), and device.ifa, as well as the user/data/segment fields. That's where user ID's (and potentially other data) are passed around. Some exchanges pass a bunch of data, others pass less data but allow you to do a cookie or device-ID exchange/sync so that one side of the transaction can map the other's ID's to theirs, so that the bidder can look up their user profile information. (which they've either bought or accumulated somehow).

Looks like MoPub doesn't pass ID/buyerId any more (it's strikethrough'd), but they do still pass data/segment fields. Not sure what those contain though, perhaps others can chime in.

For what it's worth, getting approved as an ad network is potentially non-trivial. I don't know all the steps involved, but you do need to demonstrate that you can at least meet minimum network response latencies, among other things. Additionally, most exchanges do have some sort of bidrate/winrate monitoring that will eventually throttle you if you're not participating "in good faith" or with reasonable bids/expectations of winning (it's costing them processing power and bandwidth to send you a request even if you don't win). Most also have ToS (for whatever good that does; enforcement may or may not be strong) restricting your ability to collect and store data received from bids (you're typically only allowed to store data from the bid IF you've won the auction). I've heard anecdotes of companies trying to tap into bid flow as "passive observers" this way and ending up getting cut off.