facebook-android-sdk

In Android apps, that's how it works. The SDK (recommended for login) is set up by default to collect information and installs handlers for app lifecycle events as soon as the app is installed. The default is to do this without requesting user consent. A rough summary of the data: (Ad ID, device, locale, phone network, maybe install referrer). To attribute advert -> install, Facebook ads pass on an encrypted blob containing campaign information to the Play Store, this blob is readable by the app, and is transmitted back to Facebook where it's decrypted. The setting: https://github.com/facebook/facebook-android-sdk/blob/fcd4ef... Defaulted to true: https://github.com/facebook/facebook-android-sdk/blob/5fe6e2... https://developers.facebook.com/docs/app-events/getting-star...

I had missed some information on my network monitoring app (RethinkDNS[1]) and updated my last comment before seeing your reply! You're right about the connections to a Facebook server, though I'm only seeing the connections when the app is cold-started on Android. I haven't had the chance to test on iOS. The Facebook Android[2] and iOS[3] SDKs are source-available. From a privacy perspective, when someone compares Google Maps to HERE WeGo, the question is whether using Google or HERE (plus the Facebook SDK) would be more of a privacy violation. I don't have a good answer to this question. But from a market share perspective, HERE WeGo is a minor player compared to Google and using it instead of Google Maps would help curb Google's market dominance in mapping. Of course, if a free and open source OSM-based app is viable for your area, I w

The Facebook application on Android probably verifies the integrity of the app originating the request by checking its code signature. Developers have to register their Android code signing certificate with Facebook. The process is described here: https://developers.facebook.com/docs/android/getting-started... The Facebook app for Android is closed source; however, the Facebook Android SDK seems to verify requests from the Facebook app in a similar way: https://github.com/facebook/facebook-android-sdk/blob/master... I imagine that it works like that the other way around as well: Check whether the code signature of the Intent's sender matches the app developer certificate.

It seems like the Facebook app on Android verifies the code signature of the requesting app. Seems like a very nice solution! https://github.com/facebook/facebook-android-sdk/blob/master...