Finding trackers in unexpected places (Message, OpenKeychain, Firefox Preview)

Hi all,

I downloaded ClassyShark3xodus
https://f-droid.org/en/packages/com.oF2pks.classyshark3xodus/
and asked it to check the standard apps from /e/ plus the ones I downloaded.

Apps from /e/ that are OK:

Android Settings: : 0 trackers
Apps : 0 trackers
Browser : 0 trackers
Calculator : 0 trackers
Calendar : 0 trackers
Clock : 0 trackers
Contacts : 0 trackers
File manager : 0 trackers
Gallery : 0 trackers
LibreOffice Viewer : 0 trackers
Light : 0 trackers
Magic Earth : 0 trackers
Mail : 0 trackers
Music : 0 trackers
Notes : 0 trackers
Open Camera : 0 trackers
PDFmini: : 0 trackers
Phone : 0 trackers
Recorder : 0 trackers
Weather : 0 trackers

Other apps that are also OK:

AnySoftKeyboard : 0 trackers
Aurora : 0 trackers
DuckDuckGo Browser : 0 trackers
Tutanota: 0 trackers

Vs.

Apps from /e/ with some issues:

  • Message : 1 tracker : Bugsnag
  • OpenKeychain : 1 tracker : Matomo / Piwik
  • MicroG : 2 trackers : Google Analytics; and Google Firebase Analytics
    but please see this thread
    Trackers in microG?

Other apps that are NOT ok:

  • Feedly: 7 trackers
    Facebook Analytics
    Facebook Login
    FacebookPlaces
    FacebookShare
    Google Analytics
    Google Tag Manager
    ACRA

I will start using: Flym : 0 trackers
https://f-droid.org/en/packages/net.frju.flym/

  • Firefox Preview: 3 trackers
    Adjust
    LeanPlum
    Google Firebase Analytics

I will uninstall it and write to an engineer I know at Mozilla.

  • Truecaller: 12 trackers
    CleverTap
    Google Crashlytics
    Facebook Ads
    Facebook Analytics
    Facebook Login
    Facebook Share
    Google Doubleclick
    Google Ads
    Google Firebase Analytics
    Inmobi
    Moat
    Twitter MoPub

“Should I answer”
http://www.shouldianswer.net/
uses only 1 or 2 trackers:
the obsolete version, only Google CrashLytics;
https://reports.exodus-privacy.eu.org/en/reports/search/org.mistergroup.muzutozvednout/
the newer version, Google CrashLytics and Google Firebase Analytics
https://reports.exodus-privacy.eu.org/en/reports/search/org.mistergroup.shouldianswer/

3 Likes

Please can you raise this as a bug in Gitlab

OpenKeychain : 1 tracker : Matomo / Piwik

The only alternative i’ve found apart from APG which seems to be not supported anymore is Cyphermail.
https://www.ciphermail.com/android.html

Firefox Preview: 3 trackers
Adjust
LeanPlum
Google Firebase Analytics
I will uninstall it and write to an engineer I know at Mozilla.

For that one, as i’ve answered here, Firefox preview is still under heavy development, and so, might explain why they strangely use third party trackers instead of those they use by default in their current release of Firefox. I’ll suggest using the defaults firefox versions currently, or any FOSS rebrands like Fennec or IceCat.
Waterfox could potentially be a great idea, but I didn’t did a scan personally.

“Should I answer”
http://www.shouldianswer.net/
uses only 1 or 2 trackers:
the obsolete version, only Google CrashLytics;
https://reports.exodus-privacy.eu.org/en/reports/search/org.mistergroup.muzutozvednout/
the newer version, Google CrashLytics and Google Firebase Analytics
https://reports.exodus-privacy.eu.org/en/reports/search/org.mistergroup.shouldianswer/

Sadly, Should I Answer is still the best version of a Spam blocker database app we have currently.
One weird thing I would like to point to @Manoj especially, is that the default re branded Messages of the /e/ OS, is an older version of QKSMS, which support only the legacy/obsolete version of Should I Answer (This version still works tho, and I suppose that the database is the same as the recent app). The latest builds of QKSMS now support the latest version of Should I Answer.

I don’t really understand why you’ve included also non default application @dotcoma ? Was it to showcase some alternatives you were suggesting to use instead of these popular apps?

Again raise it as a Github issue. That way there is a good chance it will be taken up by the development team and updated.

Would that mean creating a “snippet” ?

The “create snippet” button is not clickable…

Create New Issue - Open up an exiting issue and the button should activate

Can’t find “create new issue”.

Feeling really dumb now :slight_smile:

That’s fine.
I suppose this is the right place to write a new issue.
You should see a New issue button, especially if you have a gitlab account.
https://gitlab.e.foundation/e/os/android_prebuilts_prebuiltapks/issues
I don’t know if you can post an issue without an account, but if you don’t want to create a gitlab account, I can reference your post, and create this issue for you @dotcoma.

Done, thank you very much.

1 Like

I suggest you also try Feeder – a big fork of Flym which since recently provides an option to disable JavaScript.

Also nice, thanks!

But I can’t find the option ti disable Javascript; where is it? Thx.

Оpen any article, switch it to the web view mode, click menu (in upper-right corner of the screen), and there you’ll see the JavaScript trigger. This setting is applied globally, so there is no need to repeat every time.

Thanks!

So their built-in browser works fine without JavaScript because I’m using it only to view simple sites with articles, and not complex web apps, is that correct?

Do you know what their web view mode is built upon, and if it’s sound from a tracking point of view? How can I test it using Panopticlick or other tests?

Most sites around the internet work well without JavaScript as long as you just reed them without using active elements.

I suppose Feeder’s web view mode relies on the android’s built-in web view browser. But what’s important is that without scripts it’s much harder to profile you. Also, this makes you look very similar to other Feeder users (at least), so it is supposed to be one of the best ways to view news on your smartphone privately.

1 Like