Heads up. Facebook keylogs your passwords.

115 comments

Although completely believable and in-line knowing Meta/Facebook's history, is there any evidence to support this claim? I'm sure it's, unfortunately, just as easily deployed to specific targets so it may be hard to replicate, but this is pretty huge.
Anyone have any links/sources?
EDIT:
Found the source post: https://mastodon.social/@protonmail/111699323585240444
and the article: https://gizmodo.com/meet-link-history-facebook-s-new-way-to-track-the-we-1851134018
- TL;DR: ProtonMail might want to delete this before they get sued by Meta for defamation, because the original research does not say that about Meta, it says it about TikTok.
  --
  I found the same sources, but if you'll notice, the article that ProtonMail linked to actually isn't about that. It's about a different and new Facebook thing that has iffy privacy settings as well.
  It links to another Gizmodo article about it, buried deep in ONE paragraph.
  The problem? That article is about TikTok and the things detailed about the javascript injected that's keylogging is all related to TikTok.
  When you click on a link in the Facebook or Instagram apps, the website loads in a special browser built into the app, rather than your phone’s default browser. In 2022, privacy researcher Felix Krause found that Meta injects special “keylogging” JavaScript onto the website you’re visiting that allows the company to monitor everything you type and tap on, including passwords. Other apps including TikTok do the same thing.
  This paragraph from the article links to this article in question:
  https://gizmodo.com/tiktok-keylogging-privacy-meta-1849433690
  This article references Meta a few times but is mostly about TikTok. Then THAT article links to the original blog post:
  https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
  He has info on TikTok and Instagram, and while Instagram is injecting javascript into an internal browser instead of the default system browser, it is not noted as capturing text including passwords.
  Capturing text and passwords is only ascribed by the security research to TikTok and TikTok alone. Meta companies are using similar Js injection tactics, but they, according to the original research, do not include keylogging.
  
  That lines up with everything I've read about TikTok being the worst of the spyware social media apps. Unfortunately most online discussion about that subject gets filled with "Whatabout America spying?" posts trying to normalize the acceptance of everybody doing it. The discussions should be about how TikTok is the worst AND Facebook is close on their tails for the race of spying. All of the spyware social media apps are a bad thing.
  
  They might not sue to avoid bringing more attention to it.
- I dug up this mastodon post and they cited this:
  https://gizmodo.com/meet-link-history-facebook-s-new-way-to-track-the-we-1851134018
  
  I'm quite surprised Proton would use Gizmodo as a source. A quote from their articles first paragraph: "[as] Apple and Google beef up privacy".
  I guess they mean all the tech companies try to block each other so that they collect all the data themselves...
- I agree. Multiple apps bind to the keypress event to inject functionality. Binding to such event does not automatically imply nefarious intent.
- Yes, JavaScript injection tests come back with extra code when opened from within instagram.

Some people in this thread are claiming the article doesn't mention Facebook.
I actually read the article. You're welcome.
When you click on a link in the Facebook or Instagram apps, the website loads in a special browser built into the app, rather than your phone’s default browser. In 2022, privacy researcher Felix Krause found that Meta injects special “keylogging” JavaScript onto the website you’re visiting that allows the company to monitor everything you type and tap on, including passwords. Other apps including TikTok do the same thing.
Edit: The article Proton got their info from.
- https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
  Kraus makes very clear that while Meta apps are also injecting javascript, that he only has evidence of TikTok doing "keylogging" type activities. Both Gizmodo and ProtonMail are wrong in that regard.
  It's like nobody has real media literacy anymore, even media organizations.
  
  But I want to outrage at sensationalized headlines and tweets :( How can I do that if I actually read the articles?
  
  It's weird how ardently you defend Facebook. This post and one earlier where you insinuated Proton Mail is liable for libel is something a Meta employee would say to dissuade this kind of thinking. But the fact is the researcher, Kraus, confirmed that the logging script is present. Meta maliciously spies.

Don't let your bias against Meta overcome critical thinking skills.
As others have mentioned this is just incorrect. I'm no fan of Meta but you are a moron if you think this is happening.
- Given this is the top comment it should be pointed out that while Proton was incorrect about this being Meta there is research out about TikTok doing this very thing.
  The way you've worded your comment makes it seem like this either can't happen or isn't happening and that simply isn't the case.
- Maybe not keylogging but it's pretty fucking bad still, it tracks basically everything else about how you navigate when using the integrated browser.

Holy shit, that should be illegal. I say should because I know there's no way that it currently is.
- Microsoft do the same with Windows and as far as I know, they haven't got fined for it.
  
  Do you have a source for that or you just making it up?
  
  To this day I don't know what or why Google Chrome was using up all the processing power on my laptop while it was installed. As soon as I deleted Chrome, my 12gb laptop ran fine again.
  It probably wasn't keylogging but it was probably not updating itself 24/7 either.
- There's also no way that it's happening. You can't key log with JavaScript. There's something called cross domain policies or xDomainPolicy which prevent certain types of code being run on one website by a different website.
  
  Cross domain policies are enforced by the browser. If you’re using a third party app, guess what you’re using as a browser.
  Want an easy example of this? Userscrips on Firefox. Install GreaseMonkey, and you can run whatever the hell you want on any webpage. Keylogging, mouse movements, clicks and navigations. Not hard, and impossible to really stop from the site itself, because no matter what you tell the browser to do, you essentially have to just hope the browser follows through.
  
  But it's not another website, it would be the web browser within the Facebook app, which could absolutely do that.

Simple solution: stop using meta products
- Not so simple solution, because other people are using meta products and using them on you without telling you about it.
  Use firefox, and install the Facebook container extension so that meta cannot read your data on the internet.
  
  Although i still disagree with using facebook at all, and sorta unsure what you mean by "because other people are using meta products and using them on you without telling you about it" (websites using meta based SaaS products maybe), if the facebook container extension is anything like the aws container extension, I bet it's a pretty good recommendation. Firefox ALWAYS the best recommendation
  
  You'd hope the container would do the trick
- Tell that to 99% of Europe where every idiot is using whatsap and the few who don't are shunned. FML
  
  Incorrect. In certain European countries it's widely used, in others not so much. In the ones where it's more widespread, I still think 99% is very much exaggerating. Maybe you didn't mean it literally?
  
  It's not (a majority of) he users' fault as WhatsApp was its own company for a long time until they sold to Facebook. I was using WhatsApp long before it became a FB company. Everyone just continued to use it as FB was mostly hands off until they started imposing changes a few years later. But like every other messaging app, once someone is using it forever, it's hard to move away from it because all their friends and family are using it and have no desire to switch to something else.

My main goal on year 2018 was delete facebook. Unfortunately im still using whatsapp just because everyone uses it and i have no other place to talk with my friends and family.
- Signal, bro.
  
  To do what exactly? Talk to myself?
  
  Not popular enough. With Whatsapp you get to talk to pretty much everyone, from businesses to second hand sellers to your weird aunt that lives in the middle of the woods.
- I think (do correct if wrong!) the EU has approved an interoperability law for big tech companies? So it should be just a matter of time until you can switch messaging app and still be able to communicate with people on wa and big messaging apps
  Ofc if all your friends all use whatsapp zuck will still be able to read all your messages and get your phone number via your contacts... so it's only a partial solution. Still better than nothing tho.
  Edit https://bgr.com/tech/whatsapp-and-facebook-messenger-are-gatekeepers-in-the-eu-prepare-to-be-confused/
  
  That link you added is being very very negative about it and even after reading it I really don't understand why....
- SMS is still a thing. You need to put your foot down to make it happen.
  Edit: May the Monty Python foot squish all downvoters into elderberry jam!
  
  Nobody uses SMS in my country.
  
  SMS is unencrypted

Facebook keylogs anything, even outside of FB in all pages with FB APIs (any page with an FB share button), if you don't block it with an half a dozen extensions and scripts. For Example with
https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/03/lurking-beneath-surface-hidden-impacts-pixel-tracking

If you're still using the Facebook app in 2024 you deserve everything you get.
- dont blame the victim.
  
  Are they still a victim if they've been yelled at for close to a decade that these kinds of things are the standard for Facebook/Meta? I've tried telling friends and family so damn often but they just don't care.
  It's like giving someone you pass on the street your ID, walking away and thinking "man, I can't believe that guy has my ID". I'm with you if they really don't know, I'm sure many don't. But so many know fully well and just don't care.
  If you ask me both are to blame. Meta is only in a position where they get away with this stuff because people are practically encouraging it.
  
  Also, lots of sites embed the Meta Pixel. So to avoid it, you have to go into your cookie settings and block all of Meta's domains and hope you don't miss one. The internet was supposed to be a platform for all, by all...yet corporations have found a way to ruin the entire place.
  
  Are you a victim when you walk into the BDSM club, sign the waivers, call safe words a conspiracy, and cry rape afterwards?
  Edit: How about if you go back in after that?
  
  There is information available to make an informed choice, but they don't. Is there really no guilt?
- This is my shocked Pikachu face. Jokes on them, I haven't used Facebook since I deleted it with prejudice in 2007.
- 'foresight' is a gift provided to some folks who conceive things a little outside the norm, i suppose.

The source article from a security researcher Felix Krause:
https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser

I use all social media in browser to give them less access to my device. I clear cache / cookies after use every time. Hopefully that gives them far less personal data.
- If you're an android user you might be very interested in the "Hermit" browser
  https://play.google.com/store/apps/details?id=com.chimbori.hermitcrab
- When I was using Facebook I used one of the third party apps - they're basically a web browser that only browses Facebook, thereby isolating Facebook from any other internet traffic.

So they're just actually pushing malware now?
- Always has been.

The Facebook mobile webapp works just fine nowadays. Pretty sure it's even possible to enable notifications in most web browsers. I still don't get why people are willfully installing apps instead of just pinning web browser bookmarks.
- No educational programs for smart phones?
- I also only use the fb mobile web app, but for years they regularly break things, I assume it’s on purpose to get people to install their shady app

That's why I set up 2FA on whatever account I can grab my hand on. It sucks that I cannot do it on every single one I have (e.g. some popular names like Spotify, last.fm, Bandcamp or Feedly do not support it, for example), but for every account that I do have, 2FA has become critical lately.

This is especially nefarious paired with their other practices. Many phones stock ROMs also ship with preinstalled bloatware including TikTok and Facebook crap.
I had to use Android developer tools (ADB powershell commands) to remove multiple facebook and tiktok packages from a friends new phone because they can't be removed any other way. There was no "user visible" FB app but several packages were present and makes me think FB crap may run as "background" by default on several vendors stock ROMs. Irritating and deceiving to the consumer.
I also blacklist all their domains using PiHole so nothing on my home network can covertly back channel any data to their mothership. (Currently using Developer Dan's lists from GitHub - the Facebook list alone has almost 30,000 hosts on it)
These big tech surveillance bros can get clapped.
- Laughs in GrapheneOS
  
  Yeah that's what I daily drive. It is nice knowing there isn't a bunch of bundled spyware on your device.

Does Google also do this with their in-app browser in their search app?

115 comments