Instagram is testing new iOS push notifications that include a profile photo. Each time the notification is shown on your screen, it triggers a GET request to fetch that image, letting Meta track ever

https://mastodon.social/@mysk/115204746326765802

More details on the linked Mastodon post

150 points · 23 comments · view on lemmy.world

23 Comments

Kyrgizion@lemmy.world · 42 pts · 349d (1 reply)

So it's another way of using a "tracking pixel" like has been done before?

phoenixz@lemmy.ca · 5 pts · 349d

Yeah, just that now it's a tracking photo

DrDystopia@lemy.lol · 21 pts · 349d (7 replies)

Haha that's devilishsly clever and delightfully evil.

Deceptichum@quokk.au · 9 pts · 349d (1 reply)
[ removed ]
homesweethomeMrL@lemmy.world · 4 pts · 349d

Yes.

chamomile@furry.engineer · 7 pts · 349d (1 reply)

@DrDystopia @Blaze It's a common pattern in email. Disappointing that we still have this problem, tbh.

https://en.m.wikipedia.org/wiki/Spy/_pixel

DrDystopia@lemy.lol · 6 pts · 349d

Sure, that's why reasonable email clients don't run HTML code when opening an email.

FundMECFS@anarchist.nexus · 1 pts · 349d

Username checks out

FizzyOrange@programming.dev · 1 pts · 349d (1 reply)

I would be fairly surprised if they actually did this for tracking purposes. This sounds like nonsense to me. They already have plenty of information about you and they literally sent the notification.

phoenixz@lemmy.ca · 2 pts · 349d

Eh, of course they will.

If they can track it, they will track it, that is pretty much a guarantee, as data equals money. Mo data, no money.

Suspiciousbrowsing@kbin.melroy.org · 20 pts · 349d (5 replies)

What's the difference between them already knowing each push notification vs a push notification with a GET request?

6nk06@sh.itjust.works · 12 pts · 349d

Or Instagram belonging to Facebook? They already know.

4am@lemmy.zip · 8 pts · 349d (1 reply)

Push notifications go through Apple servers.

HTTP GET request comes from the device loading the image; AFAIK though wouldn’t be a big deal if Apple’s servers loaded and cached it.

So Meta can watch for the GET requests and determine:

  • time of delivery to device
  • approximate location of the device
  • device’s IP, used to correlate other activity done on that device gathered elsewhere by the IG/FB tracking network

And derive:

  • what kind of connection you are using
  • from where
  • when
  • what time of day and location do you most often read IG
  • optimal time to try and distract you
  • who your preferred service carriers are and if/when you change them
  • how often you deviate from this pattern
  • through correlation, determine what deviation might be significant based on other data collected from your device or nearby devices at the same time
  • oh wow so and so didn’t look at IG much because they searched for baby clothes are they pregnant? Is a friend? Can we show more ads based on that angle to get sales?
  • and other, much more devious, much grosser intrusions
  • they get more sales from oblivious users
  • they grow their panopticon
Suspiciousbrowsing@kbin.melroy.org · 2 pts · 349d

For your top 3 dot points, I still don't quite understand why they wouldn't already have that information if you're using the app and they're sending push notifications anyway.

ReversalHatchery@beehaw.org · 2 pts · 349d (1 reply)

I think the point is they get to know the exact time you first see the notification. It's a massive flaw in the OS, and I believe I have read about this years ago already, so that "privacy OS" is not intending to fix this leak

scytale@piefed.zip · 1 pts · 349d

I wonder if disabling the preview in the notification will stop it.

DrWorm@piefed.social · 9 pts · 349d (2 replies)

Stop using the native app. Use the web app.

If you want to stop being addicted to Facebook or instagram, this is an effective way to do it. The web apps suck so much, it takes away all the “fun”

BurntWits@sh.itjust.works · 3 pts · 349d

I was addicted to scrolling instagram and would go for hours on end, it was pretty bad. I still wanted to have access just to keep up on a couple accounts I care about but I didn’t want to be doom scrolling, so I removed the app from my home screen and replaced it with my lemmy client so anytime I would instinctively open it without thinking I’d open lemmy instead, which I find less addicting. I still doom scroll a little but not nearly as bad.

I’ll eventually be deleting all social media but there’s a couple people I only have on instagram or facebook messenger who I don’t want to lose contact with. But for anyone struggling with just auto opening an app and doom scrolling without thinking, maybe remove the icon from your home screen and replace it with something less addicting.

antlion@lemmy.dbzer0.com · 2 pts · 349d

For a while I used the web app because it was actually better - fewer ads and consistent UI. Not anymore.

homesweethomeMrL@lemmy.world · 6 pts · 349d

ATN

Always Turn off Notifications

fox2263@lemmy.world · 5 pts · 349d

I’m sure Apple will be like bugs bunny no meme

KSPAtlas@sopuli.xyz · 2 pts · 349d

Wasn't there a trick to abuse discord image caching and cloudflare caching to allow finding the approximate location of a user using a notification?

Kissaki@programming.dev · 2 pts · 348d

Is this about/a problem with iOS or Android or both? The linked post only talks about iOS.

I'm surprised they can include remote requests [by consequence of remote URLs] in notifications.

Kalothar@lemmy.ca · 1 pts · 348d

Harvey Dent.

Can we trust him?