Exodus-Privacy / exodus

Platform to audit trackers used by Android application
https://reports.exodus-privacy.eu.org/
GNU Affero General Public License v3.0
617 stars 62 forks source link

Exodus does NOT show some trackers #578

Open ElsAr4e opened 11 months ago

ElsAr4e commented 11 months ago

If you search for a report you can see how many KNOWN Trackers exodus found (https://reports.exodus-privacy.eu.org/en/trackers/).

I tried Deepl: https://reports.exodus-privacy.eu.org/en/reports/370685/

It shows 0 Tracker.

But if I make a scan using TrackerControl (https://f-droid.org/en/packages/net.kollnig.missioncontrol.fdroid/) it will find "Sentry" (https://github.com/getsentry/sentry).

Same issue with (some) versions of PeriPage (https://play.google.com/store/apps/details?id=com.ileadtek.peripage) and App Manager (https://f-droid.org/en/packages/io.github.muntashirakon.AppManager/). A few trackers have been found (Peripage version 5.3.2).

Can you please update the list of trackers so that exodus will also show these trackers?

Jean-BaptisteC commented 10 months ago

Thanks for the feedback, Sentry trackers is not yet integrated to exodus, but already present on ETIP website

ElsAr4e commented 10 months ago

Is there any possibility that you for example Copy&Paste all known trackers from TrackerControl (https://github.com/TrackerControl/tracker-control-android) and App Manager (https://github.com/MuntashirAkon/AppManager)?

ElsAr4e commented 8 months ago

Another example (older version) PeriPage 5.3.2. (https://play.google.com/store/apps/details?id=com.ileadtek.peripage)

Exodus shows 0 Trackers.

App Manager shows:

And for example PDF-Element (https://reports.exodus-privacy.eu.org/en/reports/392011/)

And Genius Scan Enterprise (https://reports.exodus-privacy.eu.org/en/reports/393107/)

And if you scan TrackerControl itself "App Manager" shows:

Jean-BaptisteC commented 8 months ago

cc @pnu-s

ElsAr4e commented 8 months ago

@pnu-s Is it legally allowed to simply take the lists of TrackerControl and App Manager (https://github.com/Exodus-Privacy/exodus/issues/578#issuecomment-1685378888) and extend your preexisting list of exodus?

And check that exodus also shows these trackers?

Mr-Bajs commented 8 months ago

@pnu-s Is it legally allowed to simply take the lists of TrackerControl and App Manager (#578 (comment)) and extend your preexisting list of exodus?

And check that exodus also shows these trackers?

Tracker Control is licenced under GPL v3 so to my underrstanding there is no issue to copy the list.

ElsAr4e commented 8 months ago

@pnu-s Is it legally allowed to simply take the lists of TrackerControl and App Manager (#578 (comment)) and extend your preexisting list of exodus? And check that exodus also shows these trackers?

Tracker Control is licenced under GPL v3 so to my underrstanding there is no issue to copy the list.

Sounds good - but we can also (additionally) ask the developers of Tracker Control for permission?

ElsAr4e commented 7 months ago

I think App Manager is shows more trackers (than TrackerControl)? So App Manager would probably be the best reference - if legally allowed?

pnu-s commented 7 months ago

Sorry for my late answer. Actually all these trackers come from our own tracker database ETIP

If some trackers are in ETIP but not in εxodus, that means they have not been validated by our team (ETIP is open for anyone to add trackers). 2 possibilities here for a non validated tracker:

1) we did not have time to review it yet 2) we reviewed it and considered it not acceptable as is

I just made a quick review and added Sentry, ACRA and Yueying Crash SDK. They will be added to εxodus reports in the coming days.

ElsAr4e commented 7 months ago

Is it really necessary that exodus just shows validated trackers?

Could you actually show them in the results with a lable like "not confirmed yet"?

ElsAr4e commented 7 months ago

@pnu-s A similar issue / question: What would happen if someone simply renames the Tracker(s)? Will exodus still detect the trackers?

https://discuss.grapheneos.org/d/471-installing-apps-with-trackers/5

pnu-s commented 5 months ago

@ElsAr4e Most of the time, when a tracker is renamed, its code signature remains the same. If they change it, it would require all apps using the tracker to make an update. If the code signature remains the same, then we can still detect it.