Iceraven-browser: [Spike]Trackers Found In ICERAVEN APK.
Please explain.
angrycrab
All 2 comments
Please explain.
I'll let one of the devs give you a more technical in-depth response, but my understanding is that, essentially, a resource like the one your screenshot is of may be designed to look for keywords in code and/or certain "hooks" in software coding that are typically associated with telemetry rather than doing a detailed evaluation of whether telemetry information is actually being sent anywhere or not.
Firefox (for Android) has telemetry from all the sources highlighted, and in order to keep the rest of the code working in Iceraven (Which is fork of Firefox), the Iceraven devs have had to keep file names, some code, and/or "hooks" there in some cases so that the overall bowser code continues to work and things that depend on those at least appearing to be there still think they still are, but in Iceraven none of your telemetry data is actually being sent anywhere.
What you want is a program like Wireshark that shows the connections that are actually being made (or not made) to see a more realistic picture.
As far as I know, the Iceraven devs have worked hard at making it so that Iceraven doesn't actually send telemetry anywhere, even if it has bits of code or keywords associated with telemetry that are necessary to keep non-telemetry features working smoothly without recoding the entire browser top to bottom, which would be beyond the ability of a small group of maintainers.
The one thing Iceraven sends that resembles telemetry is that it participates in Google Safe Browsing, just as Firefox does. Everything else should be gone (in terms of actually sending data, even though some names and bits of code that no longer function may remain as described above) as far as I know
The devs have requested that if anyone has evidence that Iceraven is still sending telemetry data the way Firefox is, that they report it so they can try to stop it from doing so. They think they have it all stopped other than the safe browsing thing, though. Whether safe browsing is a form of telemetry is debateble. There is an issue where the end goal would be to get rid of or make even that optional, though- so it may be reduced to an optional feature at some point.
CharmCityCrab
on 19 Oct 2020
I'm unfamiliar with how Warden works, but we do ship code here that identifies itself as com.leanplum, com.google.ads, and com.adjust.sdk. If Warden just looks to see whether code by that name is there, it will see that it is.
Our code by those names is fake and doesn't actually perform the tracking functions normally performed by the packages with those names. We do it this way so that we can use a lot of Mozilla code unmodified, without going through to remove every place where it tries to report something it wants to track.
I'm going to close this, because these false positive results are not unexpected, given our approach to removing trackers.
interfect
on 20 Oct 2020
Related issues
Atemu
路
10Comments
linsui
路
4Comments
ale82to
路
9Comments
resynth1943
路
6Comments
bbigam
路
9Comments
Most helpful comment
I'll let one of the devs give you a more technical in-depth response, but my understanding is that, essentially, a resource like the one your screenshot is of may be designed to look for keywords in code and/or certain "hooks" in software coding that are typically associated with telemetry rather than doing a detailed evaluation of whether telemetry information is actually being sent anywhere or not.
Firefox (for Android) has telemetry from all the sources highlighted, and in order to keep the rest of the code working in Iceraven (Which is fork of Firefox), the Iceraven devs have had to keep file names, some code, and/or "hooks" there in some cases so that the overall bowser code continues to work and things that depend on those at least appearing to be there still think they still are, but in Iceraven none of your telemetry data is actually being sent anywhere.
What you want is a program like Wireshark that shows the connections that are actually being made (or not made) to see a more realistic picture.
As far as I know, the Iceraven devs have worked hard at making it so that Iceraven doesn't actually send telemetry anywhere, even if it has bits of code or keywords associated with telemetry that are necessary to keep non-telemetry features working smoothly without recoding the entire browser top to bottom, which would be beyond the ability of a small group of maintainers.
The one thing Iceraven sends that resembles telemetry is that it participates in Google Safe Browsing, just as Firefox does. Everything else should be gone (in terms of actually sending data, even though some names and bits of code that no longer function may remain as described above) as far as I know
The devs have requested that if anyone has evidence that Iceraven is still sending telemetry data the way Firefox is, that they report it so they can try to stop it from doing so. They think they have it all stopped other than the safe browsing thing, though. Whether safe browsing is a form of telemetry is debateble. There is an issue where the end goal would be to get rid of or make even that optional, though- so it may be reduced to an optional feature at some point.