2

I know that privacy is dead etc, but I saw a presentation (Link: https://www.youtube.com/watch?v=OTt1AVRQyx0 )about developers of Android apps using the Facebook SDK for whatever reason in their development of applications. I was stunned and angered by the amount of data that FaceBook exfiltrates from user systems. This information is sent to FB even if the user has never had a FB account, never visited the site, never even heard of FaceBook. And so forth.

What I want to know is this: how can I avoid applications developed using the FB SDK? I am totally prepared to abandon the Google Store.

This would probably require an app store like F-Droid with a different security posture than say, the Google Play store. But there as well, I do not see options for isolating apps by SDK. Obviously, if those apps are OPEN open source, then I could go through the source code. I cannot be the first to have this concern, of course. Yet searches are largely swamped by questions of how to apply the SDK rather than avoid it.

So the FB SDK is just a particular case of a larger question -- is there a trusted forge for android apps? I'm not against using Copperhead or similar (de-Googled Android), but I would like to sever that issue from apps themselves.

Confession -- I'm hardly a privacy-focused person, having been a loudmouth online since the early nineties. But FaceBook's exfil of data is simply breathtaking, as it occurs effectively without consent*, and without notification*.

  • It may legally be consent to have me click through a EULA that says "We may share some data", but this seems inappropriate to the scale of what is being exfiltrated. Key point -- this is not as result of using Facebook's site or app, but of nth-party developers using Facebook "protomatter in the matrix".

Alright, I am sure I am asking this wrong, and formatting it wrong, etc. Corrections gratefully accepted. Believe me -- my goal is to help get an answer to this question on the record here.

This sounds promising -- intercepting calls made by the app to the FB API domain(s): Intercepting HTTPS Android app traffic

Improve this question

2 Answers 2

Reset to default
1

When you are installing one such app, it should show you an EULA explicitly saying that what they are going to share, with whom, etc. Specially if you are in Europe and the treatment of your PI is subject to GDPR.

The main problem as I recall it is that developers themselves were not even aware of what was being shared by using the Facebook SDK. So it wasn't being included in the EULA, nor would users be aware of what was going on.

Technically, the app developer is the one in fault here (the one you would have to sue if really wanted, etc.) while you are the loser and Facebook always winning.

Improve this answer
0

On the face of it, F-Droid does not permit FB SDK: https://forum.f-droid.org/t/should-facebook-sdk-be-permittet-in-apps-on-f-droid/3349:

Its an easy answer: the license is non-free because it puts restrictions on how you can use the software “for use in connection with the web services and APIs provided by Facebook.” “open source” is not good enough, F-Droid is about Free Software

But it seems that some older apps there do include this SDK.

Improve this answer

You must log in to answer this question.