EFF: Ring App Sends Your Personal Data to Third-Parties

Amazon-owned Ring has been more apt to brush aside privacy concerns than other smart home companies. It has defended controversial initiatives like its cooperation with police by claiming that it only wants to make communities safer. It’s going to be harder to deflect the latest troubling chapter in the Ring saga, though. The Electronic Frontier Foundation (EFF) says it has completed an exhaustive analysis of Ring’s Android app, and the company appears to be sharing a great deal of private user data with third-parties.

To use Ring’s admittedly excellent cameras, you need to install the app on a mobile device. The EFF had to poke and prod the app to learn its secrets, but it finally managed to observe the https data the app sends as you use it. The EFF says Ring’s app beams personally identifiable information to four different companies: Facebook, branch.io, Mixpanel, and AppsFlyer. Not only are some of these firms getting an unreasonable amount of data, but they’re also not all listed on Ring’s privacy disclosures.

Almost every app has trackers of some sort that evaluate how people use them, but the EFF says Ring’s use of trackers is out of step with other smart home companies. Through Facebook’s Graph API, the app sends data like when you open the app, your time zone, device model, and a unique identifier. Branch gets your IP address, device model, and a few unique identifiers. AppsFlyer seems mostly focused on tracking when and how you installed the Ring app, which isn’t excessively personal. However, it also gets the current state of sensors on your phone like the accelerometer and gyroscope.

The EFF cites the tracker from analytics firm MixPanel as the most troubling. This company gets your email, full name, device model, Bluetooth status, and even the number of Ring devices attached to your account and where they are. User experience metrics are an important part of mobile development, but there’s no reason a third-party needs this kind of data.

We’ve reached out to Ring for comment, but the company has not replied at this time. We will update with a statement when and if we have one.

Continue reading

Avast’s Free Antivirus Harvests All Your Clicks, Sells Them to Third-Parties

Despite claims that Avast data is fully anonymized, an investigation by PCMag and Motherboard shows how easy it is to unmask individual users.