6 ms·

Facebook Privacy: Site Confirms It Tracks You After You Leave

136 points by rams 15y ago

thematt 15y ago
Would Ghostery be successful at blocking this? http://www.ghostery.com/ http://www.ghostery.com/
- william42 15y ago
  I'm pretty sure this is exactly what Ghostery and the like block.
- JonnieCache 15y ago
  Yep. It blocks the Like buttons and other stupid widgets, which is how the cookies get sent. That also has the pleasant side-effect of drastically decreasing load times. I highly recommend it. Be aware that it does block disqus by default, I usually whitelist that one.
  - Periodic 15y ago
    I had a few problems with the blocking when actually going to the sites in question. I believe I had to unblock Google Plus, Google Analytics and Facebook when actually visiting those sites. However, I'm happy that most of the time it prevents the annoying features of a page from loading.
    - JonnieCache 15y ago
      I've never had that problem. That'd be a pretty big flaw in ghostery if that was the case.
      - cpeterso 15y ago
        I've had problems with Ghostery blocking cookies and web bugs that prevent some Flash videos on YouTube, Hulu, and the New York Times from playing.
  - brador 15y ago
    Would using noScript with firefox work?
    - sequoia 15y ago
      Yes. Ghostery is much more targeted however, it blocks scripts based on a blacklist (of trackers) rather than blocking ALL scripts. Ghostery is much more user/non-techie friendly; the only time you need to mess with it is: a) You want to allow some service (I allow disqus, for example): disable blocking for the service b) A site requires facebook/twitter to log in, or you trust the site: whitelist the site (allows all tracking scripts) I do wish it had a "allow by domain" so I could allow e.g. just facebook on just turntable.fm so I can log in, but not allow all of ttfn's other trackers. Works fine on abc.com ;) http://screencast.com/t/01D8EF6AH5ij http://screencast.com/t/01D8EF6AH5ij
deleted 15y ago
[deleted]
rosser 15y ago
This is why I visit Facebook in one browser, G* in another, and everything else in yet a third.
- folkster 15y ago
  There is not much use switching browser. They tracks you using cookies even if you dont login(like button and other plugins) You need to block/remove all the facebook related cookies.
  - untog 15y ago
    Cookies do not cross browsers. If he's using a second browser, Facebook cannot read the cookies set in the first browser. They could use some IP matching logic or something, but it would be prone to a lot of false positives.
    - jr299 15y ago
      I believe this isn't always the case. If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store. Firefox and multiple firefox profiles isolate cookie storage and I also use Fluid on OS X to build site-specific browsers. The paid version offers a feature to isolate cookie storage within each app.
      - untog 15y ago
        "I believe this isn't always the case. If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store." If that's true then it's utterly insane. This StackOverflow question from 2008 seems to confirm what you're saying, though: http://stackoverflow.com/questions/364219/how-can-i-have-multiple-instances-of-webkit-without-sharing-cookies http://stackoverflow.com/questions/364219/how-can-i-have-mul... I really hope it isn't still the case...
      - mkjones 15y ago
        > If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store. Where are you getting this? Safari and Chrome (both built on webkit) definitely do not share cookie stores on OS X.
deleted 15y ago
[deleted]
iamandrus 15y ago
Facebook has said that it's rooting for an "open web", but it can't even be honest about what data it's collecting, how much tracking is done, and how that data is used by the company. A scary aspect of Facebook is that most users are completely unaware and care-free. Their friends are on there, so why should they leave? A lot of my friends are leaving for Twitter because of the recent porn spam and the ticker nonsense, but that's a tiny chunk of the userbase (maybe a few hundred at the most).
psychotik 15y ago
Wait, how is this even technically possible? Sure, Facebook can see sites you visit which use Facebook Connect in some form, but can they actually "create a running log of the web pages that each of its 800 million or so members has visited during the previous 90 days" like the article claims?
- raganwald 15y ago
  They can certainly track visits to those sites displaying a Facebook “Like” button or other FB spoor.
- jamie_ca 15y ago
  When your browser requests the like button from FB's servers, the request includes a session cookie, and the referer header indicating which page the like button was loaded from. Super easy to log, though it does generate a boat-load of data.
droz 15y ago
I'd like to think that developers wouldn't implement this kind of functionality on ethical grounds -I bet there are some at facebook who refused- but I also bet there are some there who will do anything for buck no matter how questionable it is.
alain94040 15y ago
To be fair, Google is doing the exact same thing with adwords and adsense.
- esk 15y ago
  Doesn't Google Analytics also phone home? Google's tracking is far more widespread than Facebook's if that's the case.
  - sp332 15y ago
    Google Analytics seems somehow less harmful than AdSense. Almost every big website has some kind of analytics running. I assume that GA data isn't sold to advertisers, but I'm not sure.
    - stingraycharles 15y ago
      I think this might be of interest to you: http://www.google.com/support/analytics/bin/answer.py?answer=87515#0.1.1_1 http://www.google.com/support/analytics/bin/answer.py?answer... GA users can choose to "share" their data with Google, and this page describes the advantages users will get if they choose do to so.
kogir 15y ago
Just disable reading and writing of third party cookies. I've been using this option in Chrome for quite some time. Hint: Facebook is not alone in doing this.
- icebraining 15y ago
  Cookies aren't the only way to be tracked, unfortunately. I don't know if it still works, but some sites were using custom ETags to track users.
Periodic 15y ago
The part that scares me is that we, as web designers/developers/owners, are complicit in this. We are the ones who are putting social buttons on every page. We love this functionality, but they aren't giving it to us for free. We are trading them our user's information and browsing habits. I'm not worried about the ethics of Facebook. I don't think a site like Facebook should be prevented from doing this openly. I'm worried about whether I can ethically include all these social plugins knowing that they will, in my opinion, invade my users' privacy.
- icebraining 15y ago
  Use one of those proxy buttons which only load the actual Facebook button when the user clicks/hovers. Unfortunately I can't find it right now, but I think it was posted here on HN a while ago. EDIT: Here is a Slashdot discussion[1] about a German newspaper who did that, and here's[2] the link to their jQuery plugin who does just that: only load FB code when the user clicks on the button. It's in German, but translation services are good enough nowadays. EDIT2: And here's[3] the HN discussion. [1]: http://slashdot.org/story/11/09/03/0115241/Heises-Two-Clicks-For-More-Privacy-vs-Facebook http://slashdot.org/story/11/09/03/0115241/Heises-Two-Clicks... [2]: http://www.heise.de/extras/socialshareprivacy/ http://www.heise.de/extras/socialshareprivacy/ [3]: http://news.ycombinator.com/item?id=2957119 http://news.ycombinator.com/item?id=2957119
- wl 15y ago
  I'm not a web dev so I'm a bit puzzled by the social buttons everywhere. How often do people actually click them? To what extent can they drive traffic to your site? I've often wondered if they're a bit like QR codes in that a small portion of people are enamored with them but few people actually use them.
  - jka 15y ago
    They serve a few purposes - I'll try and illustrate from various points of view. * As a site operator, particularly if you're keen on 'organic' and free traffic, you need to keep on top of the latest in search engine and social marketing. Facebook and other social networks are becoming more important as traffic sources, as 'recommendations' from friends become more trusted. Bing and Facebook reached a deal to prioritize some results based on social recommendations ('likes'), and Google is rolling their own solution, so site owners have incentives to include the links. * As a user, you generally want to see the most trusted results you can, and occasionally may want to recommend sites to your friends. Facebook's verbs 'like' and 'share' work well here - Google's '+1' is a little more opaque to most web users I'd suspect, but they're trying to convey the same intention. * As Google/Facebook, you want as much data as possible about the behaviour of web traffic - search, engagement/interaction, conversion rates, even raw traffic figures. Even if people aren't interacting with these widgets, they are still often served up by AJAX from the source. This implies that Google/Facebook/etc see an incoming HTTP request, and sometimes associated cookies/referers. Add a little GeoIP and other user analysis, and you have very valuable data on aggregate. All these generally seem like 'wins' for the parties involved - and that's usually the sign of good business taking place. For me, the main concern is that all this data belongs not to the general public, but to the widget providers, and large information disparities in any situation can be abused.
rblion 15y ago
Big Brother Blue is always watching. It is becoming more and more obvious that we are nothing more than a pile of data to facebook, they don't look at us human beings who have a need for respect and privacy, but as potential data and revenue. I have always gotten the feeling that they think we are 'too dumb' to catch on, it's only a matter of time until the bubble bursts. They may still be a billion dollar company but the respect and loyalty will shift when something greater is envisioned and realized.
- cheap 15y ago
  +1 I couldn't have said it better myself.
moozeek 15y ago
As a side note, according to Ghostery the publishing site abcnews.go.com is using 13 external tracking services, including Facebook.
americandesi333 15y ago
Question- Would people be more willing to let a platform track browsing activity if there was 100% transparency? Asking this question for the startup that we are working on, where we want to get permission from users to follow their certain activities- which is directly applicable to the platform value.
- rhizome 15y ago
  It's hard to say without seeing it. Implementation is everything, but opt-in-wise, it sounds like you're describing browser bars. Maybe it's time to resurrect browser bars for the social age? :) Good luck!
  - americandesi333 15y ago
    When you say 'browser bars' I am thinking of an address bar in browsers today. Is that what you are referring to? I am thinking of something that does not interact with the user but captures some of their web usage based on their consent. Would love to share it with the community when its ready!
    - rhizome 15y ago
      Nope, I mean browser bars from the early-mid 2000s. Comet Cursor, HotBar, and other adware companies that were the Groupon of their day. Lots of deal site plugins used these kinds of plugins to do a kind of rudimentary tracking. You got some..."thing"..and they would have this snippet of js that submitted your clicked urls to their servers. Same as it ever was.
firefoxman1 15y ago
It sucks that Facebook can get away with this but services like KISSMetrics and ad networks get sued for tracking users...even though that's what the goal of analytics is, whereas Facebook's job is to provide a social network that protects its users' data.
- drumdance 15y ago
  Seems like a distinction without difference. If Facebook weren't doing this on their own they would very likely be working with someone like KISSMetrics.
GoodIntentions 15y ago
No Script + RequestPolicy + AdBlock ftw. This combo makes your browsing a little frustrating, but very educational. Try it, even for a day and be amazed at how many sites load content and scripts from 8, 10, or more unrelated domains. I gave up trying to keep an up-to-date host file for all the web beacon/scam urls. I just vet requests now as they occur. You wanna believe it has changed my surfing habits.
lurchpop 15y ago
solution is to install the adBlockPlus extension, open up any page, say, techcrunch.com, then open the extension dialog and block external domains like twitter, facebook, google, google-analytics, etc.
- nickand 15y ago
  Do you need the paid version to block external domains?
modeless 15y ago
The hypocrisy of news sites decrying Facebook's tracking while putting Like buttons on every page is palpable. (There are no less than five different Facebook widgets on this article's page, plus multiple Twitter and Google+ buttons.) The reality is that website owners are the ones sending Facebook this data.
orijing 15y ago
> Bejar acknowledged that Facebook could learn where specific members go on the Web when they are logged off by matching the unique PC and browser characteristics logged by both the session cookie and the browser cookie. > He emphasized that Facebook makes it a point not to do this. " We've said that we don't do it, and we couldn't do it without some form of consent and disclosure," Bejar says. A better title would be "Facebook /could/ track users via the Like widgets, but doesn't do it yet"
bobwaycott 15y ago
Doesn't it seem like time for a browser to get involved in protecting privacy? Maybe that's a stupid question. This just leaves me thinking I'd really like it if my browser only shared my cookies when I'm actually visiting the site requesting them, else it'd ignore the requests altogether. No doubt that's either dumb, not possible, or something someone already thought of.
- ahrjay 15y ago
  There is the do not track initiative[1] but it's kind of a pretty please solution. [1] http://dnt.mozilla.org/ http://dnt.mozilla.org/
dspillett 15y ago
This is why I keep facebook in a separate browser. The could technically still track me using flash cookies but as the site isn't on my "can play flash content" whitelist this is no issue either. It means I can't comment on a growing number of sites that use fb for their comments system, but that is no loss to me in my not-so-humble opinion.

136 points by rams 15y ago

thematt 15y ago

Would Ghostery be successful at blocking this? http://www.ghostery.com/ http://www.ghostery.com/

william42 15y ago
I'm pretty sure this is exactly what Ghostery and the like block.
JonnieCache 15y ago
Yep. It blocks the Like buttons and other stupid widgets, which is how the cookies get sent. That also has the pleasant side-effect of drastically decreasing load times. I highly recommend it. Be aware that it does block disqus by default, I usually whitelist that one.
- Periodic 15y ago
  I had a few problems with the blocking when actually going to the sites in question. I believe I had to unblock Google Plus, Google Analytics and Facebook when actually visiting those sites. However, I'm happy that most of the time it prevents the annoying features of a page from loading.
  - JonnieCache 15y ago
    I've never had that problem. That'd be a pretty big flaw in ghostery if that was the case.
    - cpeterso 15y ago
      I've had problems with Ghostery blocking cookies and web bugs that prevent some Flash videos on YouTube, Hulu, and the New York Times from playing.
- brador 15y ago
  Would using noScript with firefox work?
  - sequoia 15y ago
    Yes. Ghostery is much more targeted however, it blocks scripts based on a blacklist (of trackers) rather than blocking ALL scripts. Ghostery is much more user/non-techie friendly; the only time you need to mess with it is: a) You want to allow some service (I allow disqus, for example): disable blocking for the service b) A site requires facebook/twitter to log in, or you trust the site: whitelist the site (allows all tracking scripts) I do wish it had a "allow by domain" so I could allow e.g. just facebook on just turntable.fm so I can log in, but not allow all of ttfn's other trackers. Works fine on abc.com ;) http://screencast.com/t/01D8EF6AH5ij http://screencast.com/t/01D8EF6AH5ij

deleted 15y ago

[deleted]

rosser 15y ago

This is why I visit Facebook in one browser, G* in another, and everything else in yet a third.

folkster 15y ago
There is not much use switching browser. They tracks you using cookies even if you dont login(like button and other plugins) You need to block/remove all the facebook related cookies.
- untog 15y ago
  Cookies do not cross browsers. If he's using a second browser, Facebook cannot read the cookies set in the first browser. They could use some IP matching logic or something, but it would be prone to a lot of false positives.
  - jr299 15y ago
    I believe this isn't always the case. If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store. Firefox and multiple firefox profiles isolate cookie storage and I also use Fluid on OS X to build site-specific browsers. The paid version offers a feature to isolate cookie storage within each app.
    - untog 15y ago
      "I believe this isn't always the case. If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store." If that's true then it's utterly insane. This StackOverflow question from 2008 seems to confirm what you're saying, though: http://stackoverflow.com/questions/364219/how-can-i-have-multiple-instances-of-webkit-without-sharing-cookies http://stackoverflow.com/questions/364219/how-can-i-have-mul... I really hope it isn't still the case...
    - mkjones 15y ago
      > If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store. Where are you getting this? Safari and Chrome (both built on webkit) definitely do not share cookie stores on OS X.

deleted 15y ago

[deleted]

iamandrus 15y ago

Facebook has said that it's rooting for an "open web", but it can't even be honest about what data it's collecting, how much tracking is done, and how that data is used by the company. A scary aspect of Facebook is that most users are completely unaware and care-free. Their friends are on there, so why should they leave? A lot of my friends are leaving for Twitter because of the recent porn spam and the ticker nonsense, but that's a tiny chunk of the userbase (maybe a few hundred at the most).

psychotik 15y ago

Wait, how is this even technically possible? Sure, Facebook can see sites you visit which use Facebook Connect in some form, but can they actually "create a running log of the web pages that each of its 800 million or so members has visited during the previous 90 days" like the article claims?

raganwald 15y ago
They can certainly track visits to those sites displaying a Facebook “Like” button or other FB spoor.
jamie_ca 15y ago
When your browser requests the like button from FB's servers, the request includes a session cookie, and the referer header indicating which page the like button was loaded from. Super easy to log, though it does generate a boat-load of data.

droz 15y ago

I'd like to think that developers wouldn't implement this kind of functionality on ethical grounds -I bet there are some at facebook who refused- but I also bet there are some there who will do anything for buck no matter how questionable it is.

alain94040 15y ago

To be fair, Google is doing the exact same thing with adwords and adsense.

esk 15y ago
Doesn't Google Analytics also phone home? Google's tracking is far more widespread than Facebook's if that's the case.
- sp332 15y ago
  Google Analytics seems somehow less harmful than AdSense. Almost every big website has some kind of analytics running. I assume that GA data isn't sold to advertisers, but I'm not sure.
  - stingraycharles 15y ago
    I think this might be of interest to you: http://www.google.com/support/analytics/bin/answer.py?answer=87515#0.1.1_1 http://www.google.com/support/analytics/bin/answer.py?answer... GA users can choose to "share" their data with Google, and this page describes the advantages users will get if they choose do to so.

kogir 15y ago

Just disable reading and writing of third party cookies. I've been using this option in Chrome for quite some time. Hint: Facebook is not alone in doing this.

icebraining 15y ago
Cookies aren't the only way to be tracked, unfortunately. I don't know if it still works, but some sites were using custom ETags to track users.

Periodic 15y ago

The part that scares me is that we, as web designers/developers/owners, are complicit in this. We are the ones who are putting social buttons on every page. We love this functionality, but they aren't giving it to us for free. We are trading them our user's information and browsing habits. I'm not worried about the ethics of Facebook. I don't think a site like Facebook should be prevented from doing this openly. I'm worried about whether I can ethically include all these social plugins knowing that they will, in my opinion, invade my users' privacy.

icebraining 15y ago
Use one of those proxy buttons which only load the actual Facebook button when the user clicks/hovers. Unfortunately I can't find it right now, but I think it was posted here on HN a while ago. EDIT: Here is a Slashdot discussion[1] about a German newspaper who did that, and here's[2] the link to their jQuery plugin who does just that: only load FB code when the user clicks on the button. It's in German, but translation services are good enough nowadays. EDIT2: And here's[3] the HN discussion. [1]: http://slashdot.org/story/11/09/03/0115241/Heises-Two-Clicks-For-More-Privacy-vs-Facebook http://slashdot.org/story/11/09/03/0115241/Heises-Two-Clicks... [2]: http://www.heise.de/extras/socialshareprivacy/ http://www.heise.de/extras/socialshareprivacy/ [3]: http://news.ycombinator.com/item?id=2957119 http://news.ycombinator.com/item?id=2957119
wl 15y ago
I'm not a web dev so I'm a bit puzzled by the social buttons everywhere. How often do people actually click them? To what extent can they drive traffic to your site? I've often wondered if they're a bit like QR codes in that a small portion of people are enamored with them but few people actually use them.
- jka 15y ago
  They serve a few purposes - I'll try and illustrate from various points of view. * As a site operator, particularly if you're keen on 'organic' and free traffic, you need to keep on top of the latest in search engine and social marketing. Facebook and other social networks are becoming more important as traffic sources, as 'recommendations' from friends become more trusted. Bing and Facebook reached a deal to prioritize some results based on social recommendations ('likes'), and Google is rolling their own solution, so site owners have incentives to include the links. * As a user, you generally want to see the most trusted results you can, and occasionally may want to recommend sites to your friends. Facebook's verbs 'like' and 'share' work well here - Google's '+1' is a little more opaque to most web users I'd suspect, but they're trying to convey the same intention. * As Google/Facebook, you want as much data as possible about the behaviour of web traffic - search, engagement/interaction, conversion rates, even raw traffic figures. Even if people aren't interacting with these widgets, they are still often served up by AJAX from the source. This implies that Google/Facebook/etc see an incoming HTTP request, and sometimes associated cookies/referers. Add a little GeoIP and other user analysis, and you have very valuable data on aggregate. All these generally seem like 'wins' for the parties involved - and that's usually the sign of good business taking place. For me, the main concern is that all this data belongs not to the general public, but to the widget providers, and large information disparities in any situation can be abused.

rblion 15y ago

Big Brother Blue is always watching. It is becoming more and more obvious that we are nothing more than a pile of data to facebook, they don't look at us human beings who have a need for respect and privacy, but as potential data and revenue. I have always gotten the feeling that they think we are 'too dumb' to catch on, it's only a matter of time until the bubble bursts. They may still be a billion dollar company but the respect and loyalty will shift when something greater is envisioned and realized.

cheap 15y ago
+1 I couldn't have said it better myself.

moozeek 15y ago

As a side note, according to Ghostery the publishing site abcnews.go.com is using 13 external tracking services, including Facebook.

americandesi333 15y ago

Question- Would people be more willing to let a platform track browsing activity if there was 100% transparency? Asking this question for the startup that we are working on, where we want to get permission from users to follow their certain activities- which is directly applicable to the platform value.

rhizome 15y ago
It's hard to say without seeing it. Implementation is everything, but opt-in-wise, it sounds like you're describing browser bars. Maybe it's time to resurrect browser bars for the social age? :) Good luck!
- americandesi333 15y ago
  When you say 'browser bars' I am thinking of an address bar in browsers today. Is that what you are referring to? I am thinking of something that does not interact with the user but captures some of their web usage based on their consent. Would love to share it with the community when its ready!
  - rhizome 15y ago
    Nope, I mean browser bars from the early-mid 2000s. Comet Cursor, HotBar, and other adware companies that were the Groupon of their day. Lots of deal site plugins used these kinds of plugins to do a kind of rudimentary tracking. You got some..."thing"..and they would have this snippet of js that submitted your clicked urls to their servers. Same as it ever was.

firefoxman1 15y ago

It sucks that Facebook can get away with this but services like KISSMetrics and ad networks get sued for tracking users...even though that's what the goal of analytics is, whereas Facebook's job is to provide a social network that protects its users' data.

drumdance 15y ago
Seems like a distinction without difference. If Facebook weren't doing this on their own they would very likely be working with someone like KISSMetrics.

GoodIntentions 15y ago

No Script + RequestPolicy + AdBlock ftw. This combo makes your browsing a little frustrating, but very educational. Try it, even for a day and be amazed at how many sites load content and scripts from 8, 10, or more unrelated domains. I gave up trying to keep an up-to-date host file for all the web beacon/scam urls. I just vet requests now as they occur. You wanna believe it has changed my surfing habits.

lurchpop 15y ago

solution is to install the adBlockPlus extension, open up any page, say, techcrunch.com, then open the extension dialog and block external domains like twitter, facebook, google, google-analytics, etc.

nickand 15y ago
Do you need the paid version to block external domains?

modeless 15y ago

The hypocrisy of news sites decrying Facebook's tracking while putting Like buttons on every page is palpable. (There are no less than five different Facebook widgets on this article's page, plus multiple Twitter and Google+ buttons.) The reality is that website owners are the ones sending Facebook this data.

orijing 15y ago

> Bejar acknowledged that Facebook could learn where specific members go on the Web when they are logged off by matching the unique PC and browser characteristics logged by both the session cookie and the browser cookie. > He emphasized that Facebook makes it a point not to do this. " We've said that we don't do it, and we couldn't do it without some form of consent and disclosure," Bejar says. A better title would be "Facebook /could/ track users via the Like widgets, but doesn't do it yet"

bobwaycott 15y ago

Doesn't it seem like time for a browser to get involved in protecting privacy? Maybe that's a stupid question. This just leaves me thinking I'd really like it if my browser only shared my cookies when I'm actually visiting the site requesting them, else it'd ignore the requests altogether. No doubt that's either dumb, not possible, or something someone already thought of.

ahrjay 15y ago
There is the do not track initiative[1] but it's kind of a pretty please solution. [1] http://dnt.mozilla.org/ http://dnt.mozilla.org/

dspillett 15y ago

This is why I keep facebook in a separate browser. The could technically still track me using flash cookies but as the site isn't on my "can play flash content" whitelist this is no issue either. It means I can't comment on a growing number of sites that use fb for their comments system, but that is no loss to me in my not-so-humble opinion.