Out of interest, what’s the new device that you’re seeing registered?
For myself using Trakt on iOS, I receive a message saying that I have a new device which is “iPhone Safari - Mobile browser”.
What’ll probably be happening there is that the Younify SDK (which pops up with the prompt to login to Netflix) is using an iOS webview which uses Safari under the hood.
For most websites that serve login notifications, a new device doesn’t always literally mean a new physical device but just any browser that hasn’t been seen before.
When the login happens locally, Netflix’s login page will presumably be seeing that it’s technically running inside Safari (but a slightly different copy of Safari than the main one) and will issue the email about a new device.
The same is true for Android and Google Chrome where the Android Webview is technically an instance of Google Chrome although slightly different.
As far as the rest of the integration, I have a pretty good idea of how Younify probably works although to be clear, I’m not affiliated with Trakt or Younify. I’m just a Trakt user who happens to be a software engineer by day. That said, I’ll need a bit of time to poke around under the hood and do some tests so I can be as accurate as possible with any explanations/theories.
This feature is great so thanks so much for all the work developing it.
Having said that I must say the sync every 24h is a bit too much and is the downside of such a great feature. Even more so when at this point is not even doing that every 24h. I am having the same issue as above comments where I have watched something on Apple TV+ for example and did not sync after 24h.
I’m not a lawyer so take all of this with a grain of salt.
The privacy policy is for their actual product I haven’t used but may directly store passwords.
That isn’t the same thing as the SDK that is embedded in the Trakt app which as mentioned above, doesn’t transmit your username/password off device.
From some poking around (intercepting traffic to/from the Trakt app on my phone), I can confirm that my own Netflix password isn’t sent to Younify as claimed. Just a blob representing the session which yes, as well talk about below, is able to be used to access your account in order to retrieve watch history to be synced back to Trakt.
If I had to guess (without knowing their internals), I’d say that is almost certainly the case. Without an official API (which Netflix shutdown years ago), there isn’t any other way to power a service like this.
The exact implementation on Younify’s end is probably either a literal browser driven by automation on a server or a service emulating the calls made by a browser (without an actual browser involved). A common pattern is also to make the same requests as a mobile app (ie; the same queries as the Netflix mobile app) as they often have more structured data available.
Either way, if I had to guess, the token mentioned is likely a session cookie as the login happens via their standard browser page.
There was some discussion about scopes earlier but none of that will apply in this case. Scopes are part of a process called OAuth which won’t be at play here as these streaming services don’t have official APIs.
So with that, yes, technically speaking Younify could do anything with your account cookie but could is the keyword here.
They’re a company who Trakt will have some sort of agreement with, if not a legally enforceable contract.
Any reasonable company has policies in place not to mention there may be technical safeguards (ie; only certain employees can access user information) but I can’t speak to that with any knowledge here. Just standard stuff in software generally.
If a hypothetical rogue employee were to abuse credentials, it’d be no less of a crime and a breach of agreement on top of that I’m sure.
This part I do take issue with. The third parties in question are listed. They’re using Google Analytics and some other services to track technical information about their services. That isn’t the same thing as selling information.
I think you might be referring to this section?
We may also aggregate that usage data to sell to third parties. This information will only be shared in a way that doesn’t identify you. No personal information collected is ever disclosed or sold to third parties.
This is like saying as a shopkeep, I might inform a third party that 20 people visited my store and 5 of them bought milk. That isn’t the same thing as actually identifying those people or exposing personal information about them.
More broadly, there have been stories about companies such as Facebook selling user information in the past but that is almost always a misunderstanding.
One popular method is as above, selling aggregated information about behaviours but that isn’t the same as identifying information.
Another method (see: Twitter, Facebook etc) is to provide a platform for third party advertisers to run ads targeting users (non-specifically) by age/gender/interests and so on.
In this sense, a company is selling access to a userbase, that isn’t the same thing as selling information about the userbase.
To be clear, I don’t condone either of the above nor am I suggesting it has anything to do with Trakt or Younify, it’s just a tangent about a popular misconception
Anyway, I think you already have your answer from your previous posts about how it works.
The question here is really one of convenience versus trustworthiness. You get increased convenience but in exchange, you’re trusting a third party, who are trusted by Trakt (and presumably there’s some sort of formal agreement on top)
Personally, I’m probably just going to do manual scrobbling just for the increased specificity because I don’t think Netflix surfaces timestamps, only dates.
The pattern of screenscraping is pretty prevalent in industries where APIs aren’t common (like banks ). It’s not ideal at all but unless companies create official APIs, there’s not really much of an alternative for accessing what is effectively your own data (although that’s a debate for another time)
I’ll caveat again. Just a normal Trakt user who is a software engineer as a day job, I’m not affiliated with Trakt or Younify so I don’t have any special insights.
The general idea behind this feature is very promising and I certainly do hope that via improvements over time it’ll become something great.
But in its current shape, it’s rather annoying. The up to 24h delay isn’t helping. And to rate the seen content you must use the app or site anyway.
I assume that the covered streaming services will also heavily focus on the services available in the US, so the rest of us would end up with the big players getting synced and the others we’d have to log manually.
Let’s hope that it’ll end up being more than a patchwork rug.
Hello! Thanks so much for this - I’ve always wanted to be able to track independently what I’ve watched on streaming services to go along with what I’ve watched via Kodi.
I have Netflix and Prime loaded via the app and it shows they both synced, however they haven’t synced any data yet and it’s been a week. I am using Netflix Canada if that makes a difference, and I also set them both to sync existing data.
Yup. I chose to “ignore all previous history” too. But Hulu screwed up big time. Added my history on Dec.6th (400+ plays on this day). Now it has screwed up my yearly stats. Any chance to reverse this and keep it on only for things moving forward?
Also, to clarify, if I had manually logged it in, have the synced services duplicated watch history?
Sorry to tell you, but this comment is based on a fundamental misunderstanding of web tech. The “new device” notification you see is a bit of a misnomer. Netflix makes an “attempt” to identify the distinct hardware accessing your account, and as such calls each approved login it can aggregate, a “trusted device”. But the simple truth is I can log in with the exact same browser on the exact same device and trigger the “new device” notification. The criteria used to associate authentication sessions is imperfect. It can get tripped up by a number of different privacy focused techniques used by your devices to deliberately obscure your online footprint. Many of which apple in particular, has been employing more and more to enable “secure by default” behavior on their operating systems.
Hell, you could simulate this simply with an incognito browser window. It’ll show up as a “new device” too.
I’m not saying you should implicitly trust Younify or Trakt to protect your cached authentication session. But your premise that they are storing an auth context on their servers because a “new device” notification gets logged after enabling this feature, is empirically false.
). It’s not ideal at all but unless companies create official APIs, there’s not really much of an alternative for accessing what is effectively your own data (although that’s a debate for another time)
