I know that privacy is dead etc, but I saw a presentation (Link: https://www.youtube.com/watch?v=OTt1AVRQyx0 )about developers of Android apps using the Facebook SDK for whatever reason in their development of applications. I was stunned and angered by the amount of data that FaceBook exfiltrates from user systems. This information is sent to FB even if the user has never had a FB account, never visited the site, never even heard of FaceBook. And so forth.
What I want to know is this: how can I avoid applications developed using the FB SDK? I am totally prepared to abandon the Google Store.
This would probably require an app store like F-Droid with a different security posture than say, the Google Play store. But there as well, I do not see options for isolating apps by SDK. Obviously, if those apps are OPEN open source, then I could go through the source code. I cannot be the first to have this concern, of course. Yet searches are largely swamped by questions of how to apply the SDK rather than avoid it.
So the FB SDK is just a particular case of a larger question -- is there a trusted forge for android apps? I'm not against using Copperhead or similar (de-Googled Android), but I would like to sever that issue from apps themselves.
Confession -- I'm hardly a privacy-focused person, having been a loudmouth online since the early nineties. But FaceBook's exfil of data is simply breathtaking, as it occurs effectively without consent*, and without notification*.
- It may legally be consent to have me click through a EULA that says "We may share some data", but this seems inappropriate to the scale of what is being exfiltrated. Key point -- this is not as result of using Facebook's site or app, but of nth-party developers using Facebook "protomatter in the matrix".
Alright, I am sure I am asking this wrong, and formatting it wrong, etc. Corrections gratefully accepted. Believe me -- my goal is to help get an answer to this question on the record here.
This sounds promising -- intercepting calls made by the app to the FB API domain(s): Intercepting HTTPS Android app traffic