Heads up. Facebook keylogs your passwords.

You're viewing a single thread.

115 comments

Some people in this thread are claiming the article doesn't mention Facebook.
I actually read the article. You're welcome.
When you click on a link in the Facebook or Instagram apps, the website loads in a special browser built into the app, rather than your phone’s default browser. In 2022, privacy researcher Felix Krause found that Meta injects special “keylogging” JavaScript onto the website you’re visiting that allows the company to monitor everything you type and tap on, including passwords. Other apps including TikTok do the same thing.
Edit: The article Proton got their info from.
- https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
  Kraus makes very clear that while Meta apps are also injecting javascript, that he only has evidence of TikTok doing "keylogging" type activities. Both Gizmodo and ProtonMail are wrong in that regard.
  It's like nobody has real media literacy anymore, even media organizations.
  
  But I want to outrage at sensationalized headlines and tweets :( How can I do that if I actually read the articles?
  
  It's weird how ardently you defend Facebook. This post and one earlier where you insinuated Proton Mail is liable for libel is something a Meta employee would say to dissuade this kind of thinking. But the fact is the researcher, Kraus, confirmed that the logging script is present. Meta maliciously spies.
  
  I just went looking for what you were talking about cause I was curious to know more, and from what I can tell, saying "Kraus confirmed the logging script is present" is a bit misleading- it implies that the logging script that logs keystrokes is present. Its possible I missed something but from what I could find, it looks like what he confirmed is that meta tracks interaction with the elements of pages, like selecting a text box, tapping/clicking on buttons, etc., but I didn't see anything about keylogging. Thats still super creepy, and is obviously bad, but it doesn't seem like the person you're responding to is wrong to say that the findings of the security researcher have been misinterpreted here. And you're not wrong that they're absolutely maliciously spying (of course they are, maliciously spying, contributing to genocide in developing countries, and negatively manipulating peoples mental health for profit are meta's bread and butter! 😀) but I do think it pays to be accurate when we criticize things, and to not mislead people.
  But if we wanna criticize meta, may I interest you in: facilitating a horrifying genocide resulting in massive loss of life in Myanmar?
  https://erinkissane.com/meta-in-myanmar-full-series
  Edit: clarified a point, also added the link cause I needed to go find it
  
  While they log a lot of things like all clicks made on the site and what elements you focus on, there was no keylogger script found in metas apps as of now.
  Don't get me wrong, that's still a shitty thing to do, but it's nowhere on the same level as a keylogger that even reads your passwords. If Meta wants to this can easily end in a defamation case against proton.

115 comments