Discussion (251 points, 11 hours ago, 198 comments) https://news.ycombinator.com/item?id=44169115

> "We are in discussions with Google to address a potential miscommunication regarding the application of their policies," a Meta spokesperson told The Register. "Upon becoming aware of the concerns, we decided to pause the feature while we work with Google to resolve the issue."

Ah, good, so it was all an innocent miscommunication, certainly not Meta hoovering up whatever they thought they could get away with.

This is a PR statement because they got caught with their hand in the cookie jar. Same company that makes shadow profiles for people who have never used their services.

It seems to me like a non-localhost site making requests to localhost, or a link-local address should require a permission granted by the user.

I haven't had Facebook or Instagram apps installed on anything but a burner phone for half a decade and I'm happy about that decision.

Unfortunately I can't get rid of WhatsApp, but I hope it was immune to this.

Being surprised about this is like hanging out with Jeffrey Dahmer and being surprised when he kills you and turns you into a lamp for his living room table. Privacy violation is not just something that happens at Meta. It is literally their business model. It's what they do. It therefore follows that they will do it in every possible way that they can get away with under the law, and possibly in some ways that they can't. If this is something that you dislike, the only sensible move is to close your account and delete the app.

Still the same Facebook from 2004, despite the name change.

It's nice they're giving us annual reminders they're still scumbags.

Concerning that Android allows this — there are worse folks than meta that would exploit this

lmao at "a potential miscommunication regarding the application of their policies"

"Essentially, by opening localhost ports that allow their Android apps to receive tracking data, such as cookies and browser metadata, from scripts running in mobile browsers, Meta and Yandex are able to bypass common privacy safeguards like cookie clearing, Incognito Mode, and Android's app permission system."

completely bypassing all permission systems and using what is literally just a security vulnerability is definitely not a miscommunication of policies

If I found an application by some random developer, whose purpose was completely unrelated, doing this, I would categorize it as malware, or spyware at the very least.

By Facebook does it, and it's a "miscommunication." I have personally considered them a surveillance, and therefore spyware company, for years. I hope more people will realize it. Especially all people right here on HN who work for Facebook, and Google as well. Please realize what you're doing is wrong, and damaging, and that you should work somewhere else doing something less objectively harmful.