API key string identifiers
Many tracking services require that the app include an API key. It seems that at least some of these use a static string in the API to send the key to the API. Some of these will be declared in build.gradle. Since tracking data can be uploaded directly to a server without using a library, and domain names can be easily obfuscated, looking for API key identifiers could provide another channel to catch tracking.
- #25End of Aug sprint
Activity
more detail here: https://github.com/Exodus-Privacy/etip/issues/62
assigned to @eighthave
-
So it seems there are multiple types:
-
<meta-data>entries in the AndroidManifest.xml, as implemented in https://github.com/Exodus-Privacy/etip/pull/68 - embedded in SDK methods, e.g.
Amplitude.getInstance().initialize(this, "YOUR_API_KEY_HERE");orEstimoteCloudCredentials cloudCredentials = new EstimoteCloudCredentials("APP ID", "APP TOKEN"); - included in other files, like
ga_trackingIdin app/src/res/xml/global_tracker.xml
-
marked this issue as related to #25 (closed)
marked this issue as related to #26
changed milestone to %End of Aug sprint
mentioned in commit extracted-features@8d138c79
removed milestone %End of Aug sprint
added document conclusions label
assigned to @rivkakarasik
-
@rivkakarasik all that's left to do here is enter confirmed API Keys into ETIP
Edited by Hans-Christoph Steiner mentioned in issue fdroid/fdroidserver#852
changed milestone to %The Search for Ethical Apps
-
Google Tag Manager seems to use a
Serviceand aReceiver:https://developers.google.com/tag-platform/tag-manager/android/v4
mentioned in commit eighthave/issuebot@d88f6a9f
mentioned in commit eighthave/issuebot@5ff1b476
mentioned in commit eighthave/issuebot@e9906134
mentioned in commit eighthave/issuebot@b36b2dea
-
Has some info on this topic: https://f-droid.org/2022/09/30/free-software-and-inspection-are-key-to-software-we-can-trust
unassigned @rivkakarasik
unassigned @eighthave
mentioned in commit eighthave/issuebot@f9ae72e2