Slashdot Mirror


Facebook's Graph Search: Kiss Your Privacy Goodbye

Nerval's Lobster writes "Software developer Jeff Cogswell is back with an extensive under-the-hood breakdown of Facebook's Graph Search, trying to see if peoples' privacy concerns about the social network's search engine are entirely justified. His conclusion? 'Some of the news articles I've read talk about how Graph Search will start small and slowly grow as it accumulates more information. This is wrong—Graph Search has been accumulating information since the day Facebook opened and the first connections were made in the internal graph structure,' he writes. 'People were nervous about Google storing their history, but it pales in comparison to the information Facebook already has on you, me, and roughly a billion other people.' There's much more at the link, including a handy breakdown of graph theory."

35 of 245 comments (clear)

  1. Yeah, right by Anonymous Coward · · Score: 5, Insightful

    You kissed your privacy goodbye when you signed up for a social network.

    1. Re:Yeah, right by game+kid · · Score: 5, Informative

      As soon as you saw (not clicked!) the Like button, for that matter.

      --
      You can hold down the "B" button for continuous firing.
    2. Re:Yeah, right by ackthpt · · Score: 4, Funny

      As soon as I wrote that I was CEO of Shell Oil, owner of the US Treasury and as a imigrant from Jupiter, I lost all privacy. It is they who are cursed, not I.

      --

      A feeling of having made the same mistake before: Deja Foobar
    3. Re:Yeah, right by TwineLogic · · Score: 3, Funny

      This is why the only Like buttons I see are hosted on the web site I am viewing:

      $ cat /etc/hosts
      [...]
      127.0.0.30 outbrain.com
      127.0.0.30 facebook.com

    4. Re:Yeah, right by Anonymous Coward · · Score: 5, Funny

      I'm not even on facebook!

      And I'm scr****ed.

      scrAMBLed?!?

    5. Re:Yeah, right by Seumas · · Score: 5, Informative

      Exactly.

      My use of facebook is as follows:

      Register account, to keep someone else from using my name (it happens, I've had internet stalkers for over a decade that have done things like register domains, show up at my door, etc).

      Disable everything that it's possible to disable. Set to notify me by email of private messages, just in case. Disable ability to tag me in photos, post on my wall, etc, etc.

      Put up a user photo on account that says "I DO NOT USE FB. SEND ME AN EMAIL AT >email addy".

      Never touch Facebook again.

    6. Re:Yeah, right by kheldan · · Score: 3, Interesting

      Every day that I read a news story about how more and more of people's privacy on Facebook is being violated as they monetize that data more and more, the happier I am that I bailed out when I did.

      --
      Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
    7. Re:Yeah, right by Anonymous Coward · · Score: 5, Insightful

      Never heard of data aggregation?

      Are you friends with any on facebook, for example? They can extrapolate things about you from even that.

    8. Re:Yeah, right by treeves · · Score: 3, Funny

      I'm not even on facebook!

      And I'm scr****ed.

      scrAMBLed?!?

      scrOTUMed.

      --
      ...the future crusty old bastards are already drinking the Kool-Aid.
    9. Re:Yeah, right by kelemvor4 · · Score: 4, Insightful

      The funny thing is it doesn't document anything you don't let it. One can argue that the privacy settings should be adjusted by default to protect you... but you're getting a free account on a social network, what do you expect, a parade in your honor & some $?

      Nope, I'd expect to pay for the "free" account with my private information. This is why I don't use Facebook, and is also gp's point. Just because they're bartering for your information rather than charging you dollars does not mean it's free.

    10. Re:Yeah, right by X0563511 · · Score: 3

      Don't forget facebook.net and fb.net! (probably fb.com too).

      Not to mention anything that goes through EC2 or akamai.

      (not so perfect a solution these days, is my point)

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    11. Re:Yeah, right by Bill,+Shooter+of+Bul · · Score: 4, Informative

      Yeah, as much info I have in there is fake, I can't convince my friends who grew up with facebook in college to fake everything. They know things, I show up in pictures, I get invited to events, ect. The fake stuff makes it more difficult, but not impossible. Its like a single DES encryption. Just really there to deter those with out the motivation to crack.

      --
      Well.. maybe. Or Maybe not. But Definitely not sort of.
    12. Re:Yeah, right by hawguy · · Score: 3, Interesting

      Exactly.

      My use of facebook is as follows:

      Register account, to keep someone else from using my name (it happens, I've had internet stalkers for over a decade that have done things like register domains, show up at my door, etc).

      Disable everything that it's possible to disable. Set to notify me by email of private messages, just in case. Disable ability to tag me in photos, post on my wall, etc, etc.

      Put up a user photo on account that says "I DO NOT USE FB. SEND ME AN EMAIL AT >email addy".

      Never touch Facebook again.

      How does this keep your mythical decade long stalkers from setting up a Facebook profile with your name? My name is not all that common, but there are dozens of people on Facebook with my name -- including 1 in the same town as me.

      If you never touch Facebook again, how will you know about your stalkers profile? And what would he do with this fake profile anyway?

    13. Re:Yeah, right by icebike · · Score: 4, Insightful

      Exactly.

      Fake all you want to, they still have you nailed.

      People who doubt this should RTFA.

      --
      Sig Battery depleted. Reverting to safe mode.
    14. Re:Yeah, right by DarkOx · · Score: 4, Informative

      Not its not an awesome method.

      You're right it does not support wildcards so putting www.facebook.com in there does nothing top stop, the java script on every other site out there from posting to trackyourass.facebook.com

      I makes things point to a resource that won't answer so unless you take additional steps like running a httpd that will generate a 404, so it can make things dirt slow.

      Lots of pages are designed (badly) and need images to exist or the layout breaks, or is messed up otherwise.

      So no your hosts file is not an awesome method. A proxy like privoxy for example though there are other good ones starts to come closer to something that might be a decent solution. It could at least serve dummy images, use regular expressions to strip posts, and gets inside iframes to .*facebook.(com|net); .*fbcdn.com and others. etc.

      Really people STOP using your hosts file. Its like the worst possible answer.

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    15. Re:Yeah, right by Anonymous Coward · · Score: 5, Interesting

      Absolutely! I am not active on Facebook. I talked to a brother in Chicago and a friend in Louisiana. I have never logged into Facebook from an ip address that would geo locate me to my home state. Mobile ip, proxies or tor (or combinations of the three). And always from a Linux live cd, so no cookies from anywhere else.

      Social media is blocked at my home and work, I can't accidentally login. Nothing in my login history says I live where I do. It says the opposite. Yes, I have an overly paranoid account.

      One day I turned off my ad blocking software and found quite a few personalized ads for my location, and it confused me quite a bit. How? When i did that a year before, Facebook thought I lived across the country and frequently traveled.

      My best explanation is that I gave the friend in LA my phone number (in person) and when she added it to her contact book, a Facebook sync confirmed my number as matching me. She possibly added my real birthdate and more.I put that data into any form and it now matches that account. So although I have never given Facebook any more useful data than my (very common) name, they now have enough info to match me on anything in real databases.

      As someone who has tried their hardest to fudge databases with false info, there is no use. They will get the data some other way and then fill in the rest. As it has been mentioned before, even if you don't have an account you will have a ghost profile in the database if your name is in someone else's contact book. A fake name does nothing if 20 of your friends or relatives list you as your real name in their contact books and they sync.

    16. Re:Yeah, right by ArsonSmith · · Score: 5, Funny

      Not me because I don't want to be put on a list of "hiding something because they don't use facebook like everyone else." Instead I have a script that finds the most common likes that average people click and it automatically likes them by me as well. My profile fits pretty much right in the middle.

      --
      Paying taxes to buy civilization is like paying a hooker to buy love.
    17. Re:Yeah, right by Dins · · Score: 3, Insightful

      Sure they do.

      And if the FBI comes looking for it 190 days later (with or without a warrant) are they just going to say, "Sorry, we can't help you"?

      I'd love it to be true, but somehow I doubt it...

    18. Re:Yeah, right by PrimeNumber · · Score: 5, Insightful

      Yes, but do you believe that Facebook will actually do that?

      This from a guy (Zuckerburg) that said his users were idiots for trusting him. Repeatedly he has lied, deceived and cheated his business associates, users, and media.

    19. Re:Yeah, right by mabhatter654 · · Score: 3, Insightful

      But they don't purge spot for "friendX 1172" connected to your other friends. Basically they just take "your" name out and then fill it back in from other people's data.

      It's like how Google already has you by search terms, and web page cookies, and location/zip code before YOU ever actually sign into the service. So you can get "your" ads after a few minutes of surfing anonymously at the library.

  2. Garbage in, garbage out by tipo159 · · Score: 5, Funny

    I have been peppering my FB check-ins with places that I have been to, noting events that never took place, mixed in with real check-ins. I have set my "Lives in" city to somewhere different every day this year. Unless you know me, good luck figuring out what on my FB page is real and what isn't.

    1. Re:Garbage in, garbage out by Old97 · · Score: 3, Funny

      Timmy, is that you?

      --
      Very often, people confuse simple with simplistic. The nuance is lost on most. - Clement Mok
    2. Re:Garbage in, garbage out by Stele · · Score: 5, Funny

      Sounds like you have a lot of free time on your hands. Like most Facebook users.

    3. Re:Garbage in, garbage out by icebike · · Score: 5, Informative

      I have been peppering my FB check-ins with places that I have been to, noting events that never took place, mixed in with real check-ins. I have set my "Lives in" city to somewhere different every day this year. Unless you know me, good luck figuring out what on my FB page is real and what isn't.

      The thing about Graph search, is your friends know you, and they, (presumably), are not engaged in such useless attempts at deception. So regardless of what YOU say or do, Facebook will not be fooled. They will know exactly who you are and where you are, just by mining your friends, your IP address, etc. (I mean, seriously, you can't have imagined this would really work, did you)?

      Even if you never signed up for facebook, you are likely already in their database.

      --
      Sig Battery depleted. Reverting to safe mode.
  3. Do not enter your real name on a social network. by Zombie+Ryushu · · Score: 5, Informative

    Do not enter your real name on a social network, use a Psuedonym, call yourself something else like you would on IRC, AIM, YIM, etc. Only friend people who you know on their Psuedonym. People. Quit. Putting. Your. Real. Name. On. Accounts.

  4. Re:Do not enter your real name on a social network by Jmc23 · · Score: 5, Insightful

    Yes people let us live in fear. Fear the bogeyman. Hide your truth. Isn't it obvious this is the path to a brighter future.

    --
    Don't complain about syntax, grammar, or spelling. There is no.hell like input on android.
  5. Re:I actually doubt FB can tell who I am. by icebike · · Score: 4, Informative

    Too bad. They know exactly who you really are, and your current, (and probably all past) addresses. Your spouse and family log in from the same public facing IP addresses, you all visit the same restaurants together with your portable devices. Your friends have your pictures, and facial recognition will peg you.

    You are fooling no one but yourself.

    --
    Sig Battery depleted. Reverting to safe mode.
  6. time to declare war? by dave69 · · Score: 5, Insightful

    If a foreign government agency had spent years gathering data, and was mining it for undisclosed (possibly nefarious) purposes, It would be known as a dangerous spy network, would be subjected to infiltration/corruption and possible attack. I completely fail to understand why people tell FB anything about themselves ever, and don't request immediate deletion of all the data held about them. When governments try and spy on someone, they get all upset about it, when FB does it, and freely allows the data to be sold to the highest bidder/anyone who cares to look, people think its really cool and useful. what does it take for people to say enough is enough? Is it too late now, since the data is already gathered? why do I fail to see the upside of FB and its data gathering ilk?

  7. Re:So what by DarkOx · · Score: 3, Informative

    I don't think its their own posts most folks are worried about, or object to Facebook using,referencing,indexing etc.

    All but the dumbest among us (seems there are lots of really dumb folks though) know not to put anything on Facebook we'd be upset about someone reprinting on a billboard next to the interstate with attribution.

    The issue is really all the other photos people post and tag, the fact they can tag you when you don't even have an account. The fact that they are using facial recognition and what really are some pretty smart algorithms to know when someone mentions John Smith, just exactly which one they are talking about. Coupled with the location information attached to much of these things as meta data Facebook likely has a better idea of where you are at this very moment than many of our intelligence agency do and probably could figure it out faster too. That is what people have problems with.

    Now this search feature is going to make the last part more and more available to well anyone who happens to be interested and is willing to endure viewing an ad for "attractive singles in their area".

    --
    Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
  8. Because..... by gelfling · · Score: 4, Insightful

    People who post pictures of themself drunk, passed out pants round their ankles in the street are concerned with privacy.

  9. Re:I actually doubt FB can tell who I am. by roscocoltran · · Score: 4, Informative

    Check how unique your browser is:
    http://panopticlick.eff.org/
    This will show you that logged in FB or not, your browser signs your unique presence for you. No really, you don't even need to have an account on FB to be known by FB. Now add the data collected by other sites and I'm quite sure that FB could automatically fill in your first name field and last name field for you during the account creation.

  10. You do not have a Facebook Page by AndrewStephens · · Score: 3

    I wrote this a while ago but I will continue to post it as long as stupid people exist: You Do Not Have A Facebook Page!. Facebook has a page on you.

    I signed up to Facebook and occasionally update Facebook's page on me, I find the service quite useful for keeping in touch with people, but I am under no illusions as to why Facebook provides this service. Anyone who uses Facebook with anything they expect to keep private has seriously misunderstood their relationship with the company.

    --
    sheep.horse - does not contain information on sheep or horses.
  11. The real problem by Sir_Eptishous · · Score: 5, Insightful

    The real problem, As I see it, is that in the not too distant future:
    everyone in the US will essentially be forced to have a Social Network account to be able to function in modern society.

    More and more I see all manner of business and government entities handing responsibility over to FB for all sorts of things. It's actually quite disgusting, but not surprising given the (d)evolution of our database driven society. A centralized system of user accounts that almost everything done digitally can use?

    When I first saw the subtle changes taking place with FB, things like not being able to contact my local PBS television station unless I used FB , or not being able to enter a contest to see one of my favorite bands unless I used FB I knew it would be only a matter of time until everyone will be forced to have an account.

    Currently I don't have one, and never have. However I am part of a group that has an account, and my name and image are located there, so I'm "in the system" as it were.

    Once everyone is forced to have an account, then the next step will be for society in general to force those with accounts to update those accounts. There will come a time when via our smartphones those accounts will be updated automatically.
    It's almost at that point now:

    Who you've talked to.
    What you said.
    Where you went.
    What you bought.
    What you listened to.
    What you read.
    What you think.

    Disgusting, reprehensible, wrong

    --
    We play the game with the bravery of being out of range
  12. Re:What does FaceBook have? by cozziewozzie · · Score: 3, Informative

    I believe that by "standard browser" he means any browser which does any of the following:

    - Javascript
    - Cookies
    - Flash

    If your browser does any of those, you are being tracked every time you open it. You don't even need a facebook account and you don't need to use google. If you wish to stop being tracked, you will have the install at least the following extensions for your browser:

    - NoScript (for malicious javascript)
    - Ghostery (for cross-site tracking)
    - CS lite (for flexible cookie management)
    - BetterPrivacy (for Flash-based cookies)
    - AdBlockPlus (for more tracking)
    - https anywhere (for man-in-the-middle snooping)
    - FireGloves (for browser fingerprinting)

    and configure all of them to only use a whitelist, and explicitly disable Facebook, Google, Twitter and anything similar. Then you'll need to restart your browser at regular intervals to deter session cookies. You'll also need to reconnect to your ISP regularly to thwart IP-based tracking.

    Yes, there used to be a time when using the web was easy. Now Facebook and Google have turned it into THIS.

  13. Re:So? by sphealey · · Score: 4, Interesting

    = = = More to the point, privacy is an illusion we create to hide us from ourselves. If you really want "privacy" then go hide in a cave all by yourself. If you want to keep secrets, don't tell anyone else. The moment you tell someone something you've lost control of that information. The internet just makes it easier to lose control of information. = = =

    Try using your small business account to order up a Choicepoint profile of one Richard Cheney and see how far that theory takes you. If privacy is such an unimportant illusion why does every high-ranking corporate and government official have access to their records not only blocked but set up for immediate counterattack on access?

    sPh