Needless to say, this works on any Browser and any app that runs JavaScript and can display webviews inside of it, including some Nostr apps.
Issues like this are why Amethyst doesn't display Twitter preview cards and play YouTube videos: they all need JavaScript.
How do Facebook and Instagram apps track what you do in the browser, even in incognito mode?
Meta apps start a local server on the phone and keep it running in the background. The Meta analytics script, running on most websites, pings any "localhost" server with the anonymized tracker ID for that session. The app then associates the browser ID with your Meta account, and voilร , all your browsing history is now linked to your Facebook account.
Android is designed to block such things, but Meta found a workaround using basic Sockets and transmitting the tracker ID in the initial handshake of a WebRTC (voice call) request. It's genius and evil as fuck.
https://www.zeropartydata.es/p/localhost-tracking-explained-it-could
View quoted note →