Slashdot Mirror
Facebook Cookies Track Users Even After Logging Out
First time accepted submitter Core Condor writes "According to Australian technologist Nik Cubrilovic: 'Logging out of Facebook is not enough.' He added, Even after you are logged out, Facebook is able to track your browser's page every time you visit a website. He wrote in his blog: 'With my browser logged out of Facebook, whenever I visit any page with a Facebook like button, or share button, or any other widget, the information, including my account ID, is still being sent to Facebook.' After explaining the cookies behavior he also suggested a way to fix the tracking problem: 'The only solution to Facebook not knowing who you are is to delete all Facebook cookies.'"
dont use facebook
a week ago I went to a website and it asked me (by my name) if I wanted to follow them on Facebook. I was not logged into Facebook at the time.
Insanity: doing the same thing over and over again and expecting different results. Albert Einstein
You can configure firefox privacy options to drop most cookies when you log out. I trust a few sites to persist cookies in my browser, everyone else my browser accepts cookies from and quietly drops them on the floor when I exit. I don't know that it helps all that much but it's not that much effort to make it harder to snoop around at what I'm browsing.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Facebook is a website I refuse to have any relationship with. I do not have an account, nor will I EVER have an account. Their management is easily the most evil and anti-customer in the industry, constantly taking actions against their user's best interest.
This should surprise no one. I block their cookies in my browser and never intentionally go there.
I keep trying to tell the lemmings I know who pour their intimate personal information into Facebook that it is foolish to do so. The website's name should be "InfectMyPCWithAVirus.COM", or "StealMyIdentity.COM".
Zuckerberg better sell the damn thing before the inevitable class action lawsuit consumes the millions he's made off exploiting his customers. Of course, I hope he doesn't, he is one asshole I would very much love to see bankrupted and forced to get an honest job somewhere. I bet he ends up at Sony, developing rootkits...
Corporatism != Free Market
So... facebook.com sets a cookie...
Site B has Facebook Like button - which presumably is sourced from facebook.com
And you're surprised that they don't check your cookies when sending the icon???
Where's the story?
don't forget fbcdn.net and fb.com, maybe others
I don't want anyone to know I read slashdot
Why does Ghostery's home page have a "Friend me on Facebook" link?
-- I have a private email server in my basement.
From TFA:
I don't have direct experience in this area so I'm wondering, why exactly is logout supposed to mean deleting cookies instead of just noting in them that the user is logged out?
Attention zealots and haters: 00100 00100
How is this news anyway? FB have been doing it since the facebook social plugins took over, more than a year.
How hard is to set up a Firefox session exclusive for the use of this social media stuff? really? its faster and convenient that stacking layers and layers of blockers in the way of your everyday browsing. Or use different browsers for each task. Suckerberg sure it's amused by the time and effort some people put into staying away from facebook tracking WHILE having a facebook account.
Protip: The more you try to hide what you do, the more someone would try to see what you're hiding. You think trackers don't have a special table in the database for "tin_foil_subset"? right.
I've looked at my web traffic lately and see an awful lot of traffic to Facebook when I go to other sites. And it is not that I'm just "logged out" of Facebook, I don't have a Facebook account and never have (and never will). There is no valid reason for this traffic between me and Faceook. The next step may be to put a bad link for Facebook in my Hosts file.
I'm an American. I love this country and the freedoms that we used to have.
Notice how goatse doesn't have a FB "like" button? I think goatse needs a "like" button. C'mon, everybody, why don't we setup a shitload of goatse mirrors with "like" buttons? There's more than one way to poison a DB.....
C|N>K
Don't use Facebook with prejudice.
Avoid it like you would the black plague.
Purge it from your mind... face-wut?
It can only make you stupid.
>How hard is to set up a Firefox session exclusive for the use of this social media stuff?
I don't know, but that is a great idea: to have a list of sites that you always want to be used in private mode. This calls for not completely separating private mode from normal mode (w/Firefox, it closes all other normal Windows until you stop private mode).
I imagine this functionality like how IE works. A small icon will tell you if the tab is in "private mode" (or sandboxed), and you can create rules to match the sites you want in this mode.
I'd really use something like that. I've read about many that trying to avoid being tracked calls for more attention, so better not do it. That point of view is totally flawed. Privacy has nothing to do with hiding, but with others not allowed to spy on you unwarranted. Just like a robot.txt doesn't want indexing. Just like how you use clothes everywhere but your house (or the bath). Just like you don't always use the speakerphone while traveling. If you want privacy, and they find ways around, the analogy is to someone that is using IR cameras to "see behind clothes". It should be punished severely to spy on people.
unfinished: (adj.)
Because it's about privacy, not against social media? You decide what level of privacy you want, and the can use safely Facebook (or whatever)? Facebook privacy concerns are not connected with the usefulness of the site.
unfinished: (adj.)
Why use any social networking site if your gonna isolate yourself? Don't get me wrong I do use facebook and am fully aware how the tracking system works (I personally enabled it on 20 sites I use this morning). It just seems like a lot of "the sky is falling" mentality. Not trying to troll or flame here, but it seems like if you don't want others to know what your doing, then you should unplug the computer and just use it as a standalone system. Could be just my old man point of view though. lol
Regards,
MBC1977,
The end. No tracking, "evercookies" etc. Even blocks google tracking via google-analytics.
Tracking cookies track. This is not news, this is anticipated and expected behavior. This has been the status quo for over a decade.
Cookies have a security feature in that they are accessible only to the websites that placed them, but advertising sites have been using tracking cookies for as long as cookies have existed, and getting around that security by placing a "bug" on third-party sites. They used to (and probably still do) implement this as a 1x1 "spacer" image the same color as the background, or simply by having an ad on the page you are viewing. When your browser requests the image/flash/javascript/whatever, the site it comes from is suddenly allowed to access their cookie.
The solution has also not changed; either don't allow cookies, or delete them constantly. Anti-scripting addons are also helpful, as are black (or whitelists) of websites to disallow (or allow) access to your system. Modifying hosts files has been a semi-successful method, as well, in that requests sent to specific named addresses can be redirected to localhost (and therefore "blocked").
I personally use NoScript and AdBlockPlus for precisely this reason (and to speed up my page loads), and I can't fathom why this information could be conceived to be news to any user with any amount of technical knowledge and a modicum of interest in their own privacy.
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
On the contrary, I view FB as a venue to advertise myself, my thoughts, and my interests to the world around me. I want to create influence, and if I don't want something to be known to FB I (wait for you mind to be blown...) simply don't post it. Amazing!
Oh, and that myth about lemmings committing mass suicide by jumping off of cliffs? That's complete nonsense fabricated for a nature film created by (wait for you mind to be blown a second time...) DISNEY! That's right, you've been successfully misled by MouseCorp/ABC.
You just got chumped, chump.
This and many other privacy issues can and should be fixed by use of proper Firefox add-ons. Sure we can decry the practice and wish that in an ideal world corporations would not do such things, but that's a waste of time. Use things like Adblock Plus, Ghostery, Beef Taco, NoScript, and Better Privacy.
I don't even see those Facebook buttons. Since in practice nobody will manually mess with their cookies each time they log out of a site, and may even want to visit other sites while still logged in, this is the only realistic solution.
Alphanos
My sure fire plan is not to fucking worry about it. FB only posts what I tell it to post. So they know I went to a certain website? Honestly, it doesn't matter. I've never noticed it make a single change in my life other than giving me ads about stuff I'm interested in as opposed to ads I couldn't give a damn less about. Oooo, big bad facebook.
Plugin for most browsers. Blocks tracking cookies, including the multiple ones that facebook uses. An added benefit is that (for me anyway) it speeds up rendering of a lot of slow gawker and gawker-like websites. Probably because they have so many trackers (record is 25). http://www.ghostery.com/
...Facebook.
There is a lot of data that's exceptionally valuable for marketing, which companies can only get if they do tracking way beyond visits to their own web pages. That added value is perceived by advertising execs as literally enormous, so it should be assumed anyone who can implement this thinks they have a strong incentive. It's like, how common would bank robbery be if the penalty was 10 days in jail and the potential reward was a million dollars?
To see how, lets take an example. A company may pay a few cents per for a list of valid e-mail addresses. Now, link one of those addresses to the information that the possessor of that address definitely orders things on-line, and it's a little more valuable. Add that the things ordered on-line include prescription drugs, and it's worth more. Now how much is it worth linked to the information that the person is not yet ordering any antidepressants, but has just spent several hours searching several terms relating to depression? A list of e-mail addresses that fit those criteria is generally estimated to be worth about $ 250 US per entry by the pharmaceutical firms. With the right combinations of information sources, essentially a matter of asking the right questions, this sort of data is at least perceived to be the holy grail of targeted advertising. Personally, I assume that any for-profit that isn't looking for this sort of data is only avoiding it because they doubt the American Advertising Council's estimates of how much business it can drive, and not because they have a moral objection. Yeah, maybe some of them are genuinely being ethical, but I recognize that the sheer scope of the temptation is bound to make many of them cross the line, and it's time to be a little paranoid about privacy.
Who is John Cabal?
Wiping your cookies, adblock, flashblock, etc - it's all worthless.
Even if you remove all cookies, the iframe that is the 'like' button will set a new cookie. Facebook tracks these new 'anonymous' cookies centrally, and then when you DO login to your actual account, they can read this cookie and marry up your previous behavioral habits and sites you visited. The advice here leads people to believe you can fight this simply by erasing cookies. The only way to really make that effective is:
1) Log out of Facebook
2) Remove all Facebook cookies
3) Browse around to other sites
4) Clear all Facebook cookies AGAIN
5) Log in to Facebook
Without step #4 the rest of it is not doing you any good.
The same is true of new signups, where your browsing history (before you even had an account!) is correlated to the new account to help build a profile of your activity.
All of my friends have my phone number and e-mail. They've got data plans and smartphones. It's just that simple.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
A german magazine has developed an answer to that about a month ago:
http://www.heise.de/extras/socialshareprivacy/
Absolutely worth a read, and if you use a "like" button on your page and you're a geek, you should definitely use this.
Assorted stuff I do sometimes: Lemuria.org