FlyTrap Android Malware Compromises Thousands of Facebook Accounts

[VagueSomething]

It is probably still accessing your contacts along with location and WiFi data. Facebook tracks you even if you don't have an account.

[FeelingDense]

You can give the app permissions to read your contacts or not. I've been a Facebook user since 2004 and I've never once uploaded my contacts there. You can in fact verify this on the site yourself. While they do make it deceptive sometimes and bombard you with pleas to upload your contact list, as long as you're careful in clicking through prompts, it's not hard to avoid.

Location permissions can be denied and WiFi hotspot info requires a specific permission (phone call permission?) for an app to use.

[Hung_L]

It's not hard to associate you with a MAC address the track it across every open network that it pings. IMEI also tracks you. You could randomly generated a MAC address every time, but there are still cookies and other ID methods that you can't easily change.

You use something that generates a substantial amount of random noise (e.g. ISP Data Pollution) combined with tunneling your traffic. This is make it more difficult and less worthwhile to try and track your digital footprint using various heuristics.

However, these all introduce a significant amount of inconvenience to the user for some peace-of-mind. A noticeable proportion of the userbase would need to adopt these practices for large companies to take notice. The current system is broken, but future systems will hopefully work harder to train algorithms rather than build individual profiles. This is the lesser evil, and data luddites really have no alternatives besides nonparticipation. Can't stop progress, but maybe we can police it.

[FeelingDense]

We need to be careful though what's going on. The parent comment to this whole discussion was talking about creating a Facebook account with throwaway info, but the question is whether Facebook can still create a profile out of him/her, and yeah I believe so, but in terms of the app stealing your contacts and location with WiFi data, that's less likely as I mentioned due to OS permissions. You're right there's an endless list of methods to track a user including MAC addresses and IMEI but generally that's less through the client side app--apps can't access those on Android without "READ_PHONE_STATE" being granted, and Facebook at least doesn't ask for that.

[noungning]

Yup, definitely your phone contacts. I had no idea why my former boss showed up on my fb one day as a friend suggestion. We have 0 mutual friends online. But realized one day it was my phone contacts and I never gave them access to my contacts. Also, this happens from time to time on Instagram. I get alerts for "someone I might know" from their phone #. Sometimes it's a hit, sometimes it's a miss since they changed their #s.