7

Related, but different than, these two questions, I'd like to know if the usual ad blockers on Android do anything to prevent user tracking from ad modules. Those questions are several years old by now and things have changed substantially.

If I use Ad Block Plus (with no whitelist), AdAway, uBlock Origin within Firefox, or other popular ad blockers, do these do anything for the ad modules in the OS/APK from sending private data to the ad networks and/or app developer?

Presumably, a HOSTS based blocker would prevent at least some data exfiltration like this, but I'm not up to speed how the other blockers work.

If it matters, I'm currently using OctOS L, based on 5.1.

Tangentelly, on a desktop browser, there are tracking prevention tools like Disconnect, Ghostery, Privacy badger, and various cookie management mechanisms that I use in conjunction with an ad blocker.

Improve this question
3
  • @beeshyams OP mentioned AdAway. That's a root app which just manages the /system/etc/hosts file, and thus not "part of user tracking" (I use it myself). It doesn't check what hosts you connect to. So we need to differentiate here – as for AdblockPlus you might be right ;)
    – Izzy
    Commented Oct 2, 2018 at 23:53
  • ABP blocks "intrusive ads", but doesn't let you decide what's intrusive and what's not (rumors have it that's decided by who pays them). uBlock is strongly recommended in Firefox. I use it, it works quite well. And the dev has a good reputation. uBlock uses a mix of host lists and "cosmetical filtering", like ABP ("element hiding"). But I'd trust uBlock 1.000 times more than ABP.
    – Izzy
    Commented Oct 3, 2018 at 10:08
  • 1
    Oh, and I'd take my fingers off Ghostery. It's quite obvious they are able to track you, even the Firefox addon's settings are in the cloud and not local.
    – Izzy
    Commented Oct 3, 2018 at 10:14

2 Answers 2

Reset to default
4

tl:dr;

  • Tracking can be done by an app without showing ads. By merely blocking ads you are not preventing tracking

  • Hosts based ad blocking is better than browser ad blocking, since it does not reveal PII (Also see Izzy's comments) Browser based adblockers can track as shown, so it is a privacy risk

  • To prevent tracking , ad blocking needs to be in conjunction with other methods of plugging Privacy breach or PII breach. The only tool available is Xposed module XprivacyLua for Android 6.0 to 8.1. It is a successor of Xprivacy module that runs on earlier Android versions

I'd like to know if the usual ad blockers on Android do anything to prevent user tracking from ad modules

What is user tracking ? This needs to put in context first. It can be anything that fingerprints an user for instance (Also, see this article from Izzy's blog

Network Information

  • WiFi you are connected to (SSID)

  • Country network identifier, telecom operator you are connected to,

Device Information

Device information – Build Properties

  • Device build user, build type, build time, build tags, build serial, build radio, build manufacturer, build ID

  • Advertising Client ID

  • Google Services Framework (GSF) ID

  • In case of web browsing more information – see Browser leaks and Webkay

  • Analytics (Fabric/Crashlytics, Facebook app events, Firebase Analytics, Google Analytic, Mixpanel, Segment)

This list is illustrative and not exhaustive . For instance, SIM information, IMEI information, Sensors on the device etc may also be used. For more details on other privacy elements see XprivacyLua Github

Now, coming to specifics in your question . As you rightly surmised Hosts file based ad blockers just do that, block access to listed domains and are more effective than browser based adblockers as you can see from iBug’s answer and Izzy’s comments

So if your primary aim is to block ads is the way to go compared to browser based plugins, which may leak PII information (It does leak in the case of Ad Block Plus, haven't tested others)

But the question to be asked is Am I stopping being tracked? for which the answer is emphatic NO , unless you use tools in addition to prevent privacy breach and this is where XprivacyLua comes in

If I use Ad Block Plus (with no whitelist), AdAway, uBlock Origin within Firefox, or other popular ad blockers, do these do anything for the ad modules in the OS/APK from sending private data to the ad networks and/or app developer?

NO, in the case of Adblock plus

I am not discussing the relative merits partly because I haven’t used them all and partly because it is secondary to the thrust of my answer. However, I installed Ad Block Plus and restricted exposure of elements that facilitate fingerprinting, as an example

Screenshot below shows the actual values and the values exposed to the outside world to prevent breach. For instance the first shows the operator information as 40445 (no secret here) and what is revealed is 00101 and the last shows while I am using a Xiaomi device , make is not revealed ( I have chosen specific portions of log (needs Pro version) which anyway don't reveal too much). So Adblock plus is revealing all your build properties!

enter image description here

(Click to enlarge)

In addition it is also revealing your Android ID, advertising ID, GSF ID as you can see from the notification

enter image description here

(Click to enlarge)

So, you set out to block ads and while doing that revealed information that can be used to fingerprint you :-(

To sum up you need a wholistic approach to guard your privacy and the best available for that is XprivacyLua

Please note that while this module is very powerful, it has certain limitations like restricting access only if the app uses Java Code and not native code or restricting tracking on browsing if Webview is used and not a browser like Chrome. That said, it’s the best weapon in the arsenal to protect privacy. In addition to the hooks (restrictions) provided by the developer others have contributed custom hooks and being open source you can write / modify your own hook. To top it, the developer is ever available and responsive on the XDA threads

Improve this answer
1
  • 1
    Notes: If host-based blocking is in effect, no data flows to blocked hosts, also no PII. // "Yes, ABP" should be "No ABP" (question was if they prevent exposure). Agreed on "do not use ABP". I use AdAway on Android and uBlock Origin on the desktop (Firefox/Waterfox). The former just manages the hosts file, and the latter is recommended by a security expert I trust (Mike Kuketz). Readings on my site: What’s it all about those modules apps contain?, Android Identifiers.
    – Izzy
    Commented Oct 5, 2018 at 13:38
2

It depends.

Some ad blockers block the display of the app, and ad blocker addons for browsers are mostly of this type.

Some other ad blockers, as noted by Izzy, alters your hosts file and blocks the connection between your local apps and the ad servers. This kind of blockers effectively disconnects your device from the ad services and usually disables ad modules from tracking you.

The one I like is Lucky Patcher. It disables ad-related Activities with pm disable, and fully stops relevant code from executing. This is, I believe, the most effective and safest way, since some ad providers may try to track you even if it can't connect to its server.

Improve this answer
8
  • LP is discussed controversly, and it needs to patch the .apk files of apps. I prefer a combination of AdAway (which just modifies the /system/etc/hosts lists, redirecting bad-host-queries to localhost and thus effectively disconnecting related services) and XPrivacyLua (which disconnects/disables Analytics and prevents access to your PII); though the latter isn't supported on Android 5.1 (only 6+).
    – Izzy
    Commented Oct 3, 2018 at 10:13
  • 2
    @Izzy LP has always been able to patch the .odex (.oat) files in addition to patching the APK directly, and you call pm disable as "patch the files"!?!?!?!?
    – iBug
    Commented Oct 3, 2018 at 10:37
  • Ah, so it seems to have improved in this context. My last use of it was years ago. Reading your answer again I see you mentioned pm disable for related activities (and no, of course that's not "patching APK files"). I just wasn't sure whether that's all. From "back then" I remember LP having produced patched APKs (just found those half a year ago on a cleanup session on my PC). But that long ago, I don't remember what actions have produced them. LP is quite feature rich ;)
    – Izzy
    Commented Oct 3, 2018 at 11:38
  • 1
    Slightly off-topic, but I fear that places like XDA hate on Lucky Patcher needlessly, even if it can be used for legitimate patching when alternatives to it don't exist.
    – Grimoire
    Commented Oct 3, 2018 at 14:43
  • 2
    @iBug unless you remove license checking without having paid (or to obtain other paid features you haven't bought), I tend to say it's "digital self-defense" – especially the removal of trackers, where ads belong to (next to analytics). But, </OT> ;)
    – Izzy
    Commented Oct 3, 2018 at 21:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .