While cleaning up some old programs today, I ran across some odd .plist files which appear to be created by MixPanel. Why are they saving these to my computer, when in a typical web application architecture, trackable user events are sent directly to the end destination (in this case, MixPanel's API) for analysis?

Screenshot of .plist files saved by MixPanel

Edit: The three filenames end in “events”, “people”, and “properties”, respectively. There are attributes such as “distinctID”, “peopleUnidentifiedQueue”, and others within these files. They don’t seem innocuous.

  • Do you know how long they've been there? What browser(s) have you used? On recent releases of Safari, I think any web assets would be sandboxed in a Safari-only area. My guess is that this is from a native Mac app, again probably prior to protections being added to macOS for full disk access. – pseudon May 16 '19 at 14:05
  • @pseudon I appreciate the response. All three files were created Feburary 6, 2018. I only use Chrome. I do believe you are correct regarding it being a native Mac app. Stay tuned, I think I may have found the culprit... – CFitz May 17 '19 at 21:23

Case Closed

I've successfully identified the source of these files. It was indeed a native Mac app. (I am not aware of any method in which a web application can write to your filesystem beyond an explicit download prompt.)

The culprit app turned out to be Etcher.io AKA BalenaEtcher.

How I Found the Culprit

I discovered this by opening each of my Mac apps individually, hoping that one of them would attempt to update these files, given that they are associated with a user behavior tracking service. I fully opened each, played around a bit with each, and then fully quit each. I made sure to wait a few minutes before opening an application after closing another.

Eventually, I saw the .plist files be updated when I opened BalenaEtcher. The files were actually completely recreated upon opening the app, so the "Created" and "Modified" timestamps matched exactly when I opened it.

Additionally, I stumbled upon this GitHub issue for the actual Etcher.io project, which reaffirmed my belief they were using MixPanel. There are other discussions online regarding this background tracking, just search for "balenaetcher mixpanel".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.