I want to preface this by saying that yes, I know that Instagram is bad. I am planning to get rid of it in the future but as of now I have to keep it for communication with people who are only on that platform.
So I have grapheneOS, use protonvpn (free version), use mull as my browser, and do not have google play services enabled on my phone. I do have some apps downloaded through aurora store such as Instagram, whatsapp, mychart, and mint mobile, but the rest came from f-droid.
I have noticed multiple times that after having private conversations on matrix, I get Instagram content in my feed that is scarily accurate to the conversation I had on the other platform immediately after. I know that things discussed in Instagram direct messages and group chat will give suggested content based on those conversations, but I get stuff that that is very specific to what I have ONLY discussed on matrix and didn’t look up via my browser.
So my question is how is Instagram doing this and what can I do to mitigate the spying it’s doing on my other apps. Thanks.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 3.13K Posts
- 78.3K Comments
- Modlog
Just read most of the comments here and I feel nauseous about this.
My job encourages instagram use.
I think the only way around having our devices spy on our spoken face to face conversations is to have a mobile device with a removable battery. Who remembers the HTC EVO and all the phones like those? Anyone know of a good phone that offers the removable battery?
I only know about Fairphone and Teracube. Having owned a Teracube I recommend not getting a Teracube
Please tell me about your experience with Teracube.
Hardware specs were too constrained for regular daily use. The software updates are always way behind schedule, and the company is too small to support their warranty (I really do think they’re doing their best to do what’s right, but they’re just super slow on turnaround for support)
It happens to me as well, in my instances it’s most likely the social network they tied me to. Some friends of mine are heavy Instagram users and whenever I hang out with them I get almost real time relevant ads on my isolated Instagram.
Probably because your friends search about it when they are not having things separated and based on the social graph that IG thinks you’re interested in it too?
Plus if you were in the same location they probably lean harder on the things that overlap. They have so much data about you that this is easy for them to do.
None of my matrix friends are on Instagram and vice versa
That can be your friends’ friend/family doing the search. The social graph is never being 1 degree only.
If you want to be extra safe I guess the best way would be to use the web version of Instagram with ublock origin installed. If you can find a way to use Firefox containers on Android as well it could really restrict what they can access.
Could this be related to Off-Facebook Activity?
If the only thing you use it for is chat, I think you can chat with instagram users on FB messenger instead, which you can then heavily restrict in terms of the OS permissions you give to it.
Wait, really? Can I log in with my Instagram account onto it? If so that’s great news because the main reason I’m keeping it right now is the chat, but sometimes get sucked into the content vortex.
I’m not sure, I think it may use an FB account. But you could make one specifically for this one use-case and then nuke your IG account.
Facebook is pretty strict with their account creation stuff compared to Instagram. On Instagram it’s easy to make a bunch of alts and keep them. I tried to make an account on Facebook to access marketplace a long time ago and it got banned and they wanted my real name and ID to access the account.
Use the user profiles feature of grapheneos to make a “social” profile and only use that to access Instagram / facebook.
Meta sells your convo data on WhatsApp for ads, if you use it you will get targeted ads regardless.
Other options are signal (Molly on fdroid), simplex, etc.
Unfortunately I do have WhatsApp and I absolutely cannot get rid of that unless I cut off all my older family members who don’t know how to use anything else (which I don’t wanna do). I’m gonna put Instagram on a separate profile like you recommended, but can’t for WhatsApp because that’ll mean I can’t pick up calls and the likes. I do have molly and quite like it, but only have a couple of friends on it that I’ve managed to convince to switch. I hope to get more on there from Instagram in the future, but will have to wait for when I am better friends with those people and less of a weird acquaintance.
The only place I get any ads nowadays is on Instagram, but I’m assuming that after I am rid of that they’ll still have a shadow profile on me in the background.
Also, another question: what is the network permission on graphene OS? I haven’t been able to find a clear answer about it on the net.
Thanks.
dont wanna be “that” guy but do u have any sources regarding the whatsapp convo data sale? first time I’ve heard about it
My car has an aux cable to connect to my phone. The cable died again so I’ve been rediscovering the radio and I’ve been been hearing commercials for whatsapp. They advertise E2EE as a feature. What you are saying is a contradiction to that. Is it possible to have E2EE AND have them sell your convo to third parties?
they encrypt the content, but not the metadata. so Meta might not know what you’re talking about, but will know who do you talk with, how often, where from, for how long, and so on. that’ll often be more valuable for advertisers than the contents of the messages themselves.
More importantly, Meta also has the encryption keys of any WhatsApp conversation.
It’s like a fucking META password manager that unlocks your vault… (…as in your WhatsApp conversations) and locks it when they are done spying, whenever they feel like. Repeatedly.
You have no control, as in a secure private conversation unless you have the keys on your device.
They can call it E2EE as much as they want, but it’s a lie. It’s encrypted in transit and at rest, at least on the user’s device, but unlike true E2EE, they can decrypt and view any conversation they want to.
https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users
Does this also apply to calls?
This is particularly insidious, as they claim to use the same encryption as Signal, developed by Open Whisper Systems. But Meta allows themselves access. 2 billion users. SMH.
So E2EE but they have a copy of the keys to use at their discretion. Cool, we have digital landlords now.
E2EE* plaintext with extra steps
Is IG on a completely different profile in GrapheneOS, or is the app installed on the primary profile where you use your other apps? GrapheneOS’s profiles completely isolate from one another.
IG is on the primary profile.
You’ll want to consider isolating IG from your primary profile, to start. The above user’s suggestion hits the nail on the head.
Once the profile ks created, and you’ve installed IG, you’ll want to deselect the option in your Manage Profiles settings on GrapheneOS to ‘Allow running in the backgroud.’ This way, you can ensure the app is entirely stopped until you want it open.
Another consideration may be to turn off your Bluetooth when it’s not in use, as well: BT emits an ‘address’ of sorts that, if another IG user has enabled BT access on their IG app, may be able to detect your phone and track a conversation knowing you are in the other user’s vicinity.
This will be able to do cross site (apps) information collection within other sites (apps) in this profile. The way this works is one of many, and complicated so: https://blog.mozilla.org/en/products/firefox/cross-site-tracking-lets-unpack-that/
The idea of profiles is to stop this behaviour and other behaviours through isolation. Along with other practices makes up a privacy-in-depth (layered) approach. It doesn’t solve everything.
For example if you are in the same house sharing an internet connection, it is possible to say “at least one outstation in this house (IP) are interested in ‘x’ and therefore I should target everyone in that house because people who live together are interested in similar things”. Even if you isolate, you could still teach a data hoarding company like meta you like something simply by them by necessity needing your IP to communicate.
Some people try to say ‘I’ve got a VPS with a VPN to communicate all traffic through’ but that doesn’t add any privacy, your exposed VPS with its IP is an IP only for you and still all collected information about you would be able to be thumbprinted to that IP across many services (eg instagram whatsapp and Facebook). A public VPN provider in this case adds a layer of obfuscation since you can change your IP rapidly and it’s an IP that’s shared with other unrelated users. Which is exactly why many services like reddit are banning access from them under the guise of “oh training data leaks from VPN, and we want to sell it” bs.
Anyway it’s a tough world out there to be private. I’m at an age where after 10 years without Facebook and I never had instagram, everyone knows I’m contactable via sms. It’s not secure, it’s barely private, but I don’t really “chat” except at the pub. So that’s where they ask me to visit. Lol.
This is always the excuse. Same one people use for FB.
Drop it. If you want to keep talking to them, get their number. I’d they don’t give it to you, they’re not your friend and not someone you need to talk to.
Stop feeding the platform that feeds your addiction.
Dude, you don’t know anything of my situation. Why are you being so judgmental when I just asked a question. I’m not asking for lectures like this, which is why I made extra sure to clarify that I already know that Instagram is bad and I have to use it for a set amount of time.
Best to just block people who use the “if you don’t use MY messaging platform of choice, you’re not my friend” argument. They are completely deranged and not living in the same world as the rest of us.
Because it’s everyone’s answer. Always.
“I hate it, but I use it to talk to people.”
People are important. It’s necessary for mental health to balance privacy and being able to have a life.
The reality is actually far scarier…
Meta manipulated you to have those conversations.
/s to a degree.
Its really hard to tell from a technical perspective, especially without having closely monitored all of your digital activity (and those that you have been in close contact with) in the days/weeks leading up receiving the ads. Some things that Meta could have done (in varying degrees of realism) include:
Its really hard to comprehensively and conclusively avoid all “spying” that Meta/Instagram could do to you. The best thing that you could do is something that many people aren’t capable or willing to do - not install any Meta software, don’t use any Meta services, block any Meta IP addresses and/or domain names, and advocate that those around you do the same.
Realistically, the best advice that youre going to get has already been said. Use the web browser instead of the app as much as possible, ideally in a different browser and/or user profile. If you must have the app installed, keep it in a separate profile and kill the app and/or profile whenever it is not in use. Review all of your security and privacy settings in all Meta apps. Review any apps/services you allowed Meta to connect to/from (and the security/privacy settings of those apps). Reduce the amount of information that you enter/share on Meta platforms. Review the other users that you are connected with on Meta’s platforms.
I like the way your mind works.
I don’t think Instagram can read your Matrix conversations, but may be able to predict your interests with fancy algorithms or buying information from data brokers, even if it’s related to things you did on another device.
If you want to be more sure it’s not spying on your phone, uninstall the app and use it through your web browser.
I might just have to do this, although having a VPN and accessing it on desktop might flag my account and/or lock it. Would having Instagram on my old phone and taking it off my current one help?
Phones also have web browsers, and Instagram is usable that way (several years ago, it was not). It is possible that privacy protections will look like automated behaviors to their systems.
Using an app on a device that’s used for little else and has minimal data stored and apps installed on it also limits the potential for data leaks, though probably not as effectively as the browser, particularly when your browser is Mull.
Use a modified app of Instagram.
At that point you might as well move to something else
It would be nice to have some bots scrape some hashtags and cross post to fedi
there are some Mastodon instances (like bird.makeup) that mirror posts from Twitter accounts, someone just has to request to mirror each specific account first. technically someone could set up a Pixelfed instance that would do the same with Instagram users, but 1. storage is much more of an issue when it comes to a media-first service, and 2. I bet Meta’s legal team is much more trigger happy than Twitter’s.
@electricprism @possiblylinux127 There are probably 🤔
God no
It’s opt-in ya know
Imei ISP DNS Keeb
I feel a lot of these responses miss the mark. If I read it correctly, you suggest matrix is the data leak and the results of which show in Instagram.
Matrix has many clients, one of which could be leaking data, but not necessary from your end of the conversation.
There are also keyboards which analyze input, and high privileged apps that can read notifications.
From what I understand, Meta apps can scan a device for a list of apps installed (probably somesort of fingerprinting concern) but can’t actually read app interactions or content.
I’d say hi in a chat with some clear, unique keywords on a new or old/wiped device and see if the leak continues. It may not be you at all, but it would identify the problematic device