The Electronic Frontier Foundation unveiled an analysis this week that shows that the app Ring Doorbell for Android – the app to manage Amazon's Doorbell smart Ring doorbells – could allow third parties to track users and their activities. The analysis revealed the existence of four "marketing and analytics companies" that received information without it being explicitly sent by the app user.
The analysis shows that within the Ring Doorbell App there are four different data-tracking mechanisms of realities such as Branch, MixPanel, AppsFlyer and Facebook. The system also sends data to Google's Crashalytics, but EFF's analysis notes that "the exact reason for sharing information with these services has yet to be determined"
The Electronic Frontier Foundation was conducted with the version 3.21.1 of the app for Android. Each of the four data-tracking systems mentioned above receives information from the Ring Doorbell app which can range from harmless details to elements that can potentially identify the device, and secondly the user.
For convenience of consultation, we list the discoveries of the EFF:
Shared with Branch
Device Fingerprint ID
Hardware ID
Identity ID
Local IP address of the device
Device model
Screen resolution
DPI of the screen
Tongue
Operating system
WiFi statusShared with Facebook
Advertiser ID
Advertiser Tracking
Anon ID
Application Tracking
Physical location
Device model
Screen resolution
DPI of the screen
TongueShared with Mixpanel
Log-in time
User ID
User name
User email address
Bluetooth status
Operating system
App settings (number of connected Ring devices and their configuration)Shared with AppsFlyer
Device model
Screen resolution
DPI of the screen
country
Date
Now
Battery level of the device
Processor type of the device
Sensor information (magnetometer, gyroscope, accelerometer)
AppsFlyer status
The Foundation also points out that the list of third party services allowed by Ring they expressly mention Mixpanel, Google Analytics, HotJar and Optimizely, while Facebook, Branch, AppsFlyer, and Crashalytics are absent.
The danger of sending even small pieces of information that tracking and analytical companies are able to compose these pieces together to form a more complete picture of the user's device. Framework that obviously will have characteristics of uniqueness, almost a sort of "fingerprint" that follows the user and his interactions with other apps and with the device itself. In this way it is possible to literally trace the user's activity and his "digital life". Obviously everything happens to us without the user being aware of it since it is not informed of the possibility of sharing and in most cases it has no way of mitigating what happens.
It is only the latest in a series of episodes that led Ring devices to show their side regarding the security of information they manage. We have already talked about it in two cases: Security hole in the Amazon Ring smart doorbells: they can expose the WiFi password and thousands of smart Ring doorbell passwords circulate on the net.