Wire-android: Privacy concern about the last remained trackers

[machiav3lli]

So, after spending some time "searxing", testing but not-building, that's actually the best what I could get, as the exodus privacy promotes 3 infamous trackers(firebase analytics, HockeyApp and Mixpanel) for the play store version's apk.
And yeah firebase analytics isn't most known for being privacy friendly, so my question/suggestion would be, is there any plan to release a version of Wire without this(and the other) trackers?! and if so, is the plan to have a f-droid release is still on the prioirty list?
that's me trying not to be redundant and ask about replacing FCM with SSE(or other alternative).

thanks.

[marcoconti83]

Hi @machiav3lli ,
thanks for the feedback. We removed Hockey and Mixpanel from our app - there might still be some mention to them in some variable name, but the libraries are not included anymore.

Can you clarify in which public version you still see them?

Regarding Firebase, we still use Firebase for native pushes, but we don't use the analytics component.

[machiav3lli]

thanks for your answer @marcoconti83 ,
the apk which had Hockey and Mixpanel was from ApkMirror, so maybe an old version from your play store's.
Regarding Firebase, may I know what kind of native pushes you mean, cause as I know, the cloud messaging doesn't need it even.
And again thanks for the great job you're doing, trying to satisfy our sense of insecurity on this matter.

[marcoconti83]

Hi @machiav3lli ,
if downloading from the Google Play Store is not an option for you, you can always download from our website.

Regarding Firebase, the app uses Firebase Cloud Messaging to deliver notifications to the phone. It's worth noting that the pushes that go through Firebase do not contain any sensitive information such as messages or contacts.

The notification just informs the application that there is new data available, then the app will then react by fetching the actual data from the Wire server.

[machiav3lli]

Hi again @marcoconti83 ,
The version I had with only firebase analytics is downloaded from the website (hoping to see the app sometime in the near future on Fdroid),
I have couple of apps which use the the google cloud messaging without having firebase implemented as a "tracker"(source: Exodus),
So is it safe to say that if I don't allow the app to register over FCM, the notifications would be handled by the websockets implementation?
Thanks again.

[marcoconti83]

Unfortunately the websocket is not enough to cover all use cases for us. It will work only as long as your app is allowed to run reliably in the background. If the app is killed either by you or the OS, it will stop receiving pushes until you manually start it again, which will prevent you from seeing new messages, calls, ...

[machiav3lli]

ok, it's unfortunate that it's so hard leaving FCM, but I think there could be some "safe" open source alternatives like Uniqush or Onesignal(not free) which you can count on and maybe fork and develope what fits the app better.
Thanks.

[RITFW]

Isn't it possible to use Firebase Cloud Messaging without the tracking features? I think that's what Conversations is doing: https://github.com/siacs/Conversations/commit/c2067e3b56364317bc384b55e320b72326fb1de6. Then it is possible to have Exodus showing no trackers at all: https://reports.exodus-privacy.eu.org/en/reports/search/eu.siacs.conversations/.

And thanks for removing Hockey and Mixpanel, I really appreciate it. Isn't it possible to have another version without Firebase Cloud Messaging and offer it on your website? As most user who download it from your website probably don't use any Google services at all and hopefully an F-Droid release can happen some time down the road as well ;)

[marcoconti83]

Hi @RITFW ,

To the best of our knowledge, we are not using Firebase tracking at all. We will have to look at why it's still reported, I suspect it's a matter of something related manifest/list of dependencies/.... If anyone from the community has some pointers on the detection rules and why they trigger a false positive, please let us know.

About releasing a separate version without FCM, that's not in our plans at the moment. I'm not sure how that version would work. Without native pushes, we would need to keep the websocket open in the background to receive updates, this would use even more battery and the app will stop receiving new messages the moment the app is killed.

[RITFW]

Hi @marcoconti83 ,
thanks a lot for the quick reply. Would be great if it could be solved some day.

As for the version without FCM, I can understand that maintaining two app versions involves more time, but my rough guess is that most of the people who download the app from your website don't have any Google services installed and already using only websockets. And from my experience with many apps it works really well without consuming any unreasonably amount of battery (Signal, Conversations, Wire all use about 1-2 % of battery according to Android's own stats - just as a rough indication). Of course notifications stop working as soon as the app is killed, but so far they all run well in the background on Android 8.1.

[marcoconti83]

Thanks @RITFW ,
I'd be open to see how to integrate an alternative version in our build/release pipeline, if someone from the community could make a PR to have a feature flag to disable FCM (see other feature flags in default.json). However I'm not familiar enough with that code to understand how complicated this task is.

[harishvishwakarma]

@marcoconti83 Somebody should apply this commit to this repo too. https://github.com/siacs/Conversations/commit/c2067e3b56364317bc384b55e320b72326fb1de6

From the discussion I can see that there isn't a reliable alternative to FCM and going without FCM comes with some compromises. However, I believe there are users who would not mind checking the app regularly for new messages.

[marcoconti83]

Hi @harishvishwakarma and @machiav3lli ,
thanks for the suggestion. To your knowledge, is there a way to run the "analytics detection" from Exodus with a custom APK? I would like to check the result of the suggested change without having to release a public version to the Play Store only to test it.

[machiav3lli]

I don't know how to do it on Exodus side, but there is this option to test APKs:
ClassyShark3xodus (Apps nach Trackern durchsuchen) - https://f-droid.org/app/com.oF2pks.classyshark3xodus

[marcoconti83]

Thanks to everyone, I tried the fix and tested it with the suggested detection app, and it seems to work. The fix is ready here and we will merge it after running it through some internal testing: https://github.com/wireapp/wire-android/pull/2055

[marcoconti83]

Hi all,
Sorry for late update, this has been released to production a few weeks ago.

[dm17]

Hi @marcoconti83 ,
thanks a lot for the quick reply. Would be great if it could be solved some day.

As for the version without FCM, I can understand that maintaining two app versions involves more time, but my rough guess is that most of the people who download the app from your website don't have any Google services installed and already using only websockets. And from my experience with many apps it works really well without consuming any unreasonably amount of battery (Signal, Conversations, Wire all use about 1-2 % of battery according to Android's own stats - just as a rough indication). Of course notifications stop working as soon as the app is killed, but so far they all run well in the background on Android 8.1.

Right, or organizations using self-hosted wireserver who don't want any reliance on other infrastructure while using it... And the fact that Firebase (or other things I'm currently unaware of) could be dependencies are important. Even more so considering Wire is competing with Signal on privacy, trackability, etc. I think a release via F-DROID would be a good way to ensure some of this.

Thanks! :)