7 ms·

""" Zuckerberg reluctantly acknowledged that Facebook gathers information on people who aren't signed up for Facebook for what he said were "security purposes."

""" Zuckerberg reluctantly acknowledged that Facebook gathers information on people who aren't signed up for Facebook for what he said were "security purposes." """ That's a pretty disingenuous way to phrase Zuckerberg's response to a question of whether Facebook uses cookie tracking for logged-out users. Which of course it does, and it's of course used for security purposes; one has to be able to unify sessions from people with multiple accounts to do the most basic of bad-actor tracking against the most basic of attack scenarios.

gsich 9y ago
No. There is no need to be able to do this.
- Arnt 9y ago
  Please elaborate.
  - ynniv 9y ago
    A competent adversary won't carry cookies between sessions, so there is no security afforded by it. These cookies are solely to track the general population.
    - fixermark 9y ago
      I agree, but I also note you may be underestimating the number of competent adversaries in the world and the cost / benefit analysis of doing something like this to eliminate a large-percentage case of bad behavior.
      - gsich 9y ago
        The cost is immense (tracking of non-users) the benefit is low (being able to detect multi accounts).
      - ynniv 9y ago
        Incognito mode makes cookie avoidance easy, even for average users.
        gsich 9y ago
        Or using another browser. And yes your average user is able to do that.
        908087 9y ago
        Average users are able to do a lot of simple things to afford themselves basic protection from some of these practices. The problem is that the vast majority of them don't know what those things are and don't know that they should be doing them. Even among the few who do take steps, the majority misunderstand what they're even achieving, in a "I use incognito mode so the NSA can't track me" kind of way. The even bigger problem, is that they shouldn't have to do anything to begin with, because these practices shouldn't be allowed in the first place. Governmental and societal complacency has allowed massive corporations to turn the internet into a largely adversarial entity for users. Use of the internet has become just easy enough to allow unsophisticated users to become a danger to themselves due to lack of understanding of what the simplified high level actions they take are actually doing underneath it all. Much of the time, these people are running apps which they don't understand to be connecting to the internet at all. The average grandparent isn't going to understand that the "free" solitaire game they installed is slurping down their contact list and call/SMS history.
        gsich 9y ago
        Well they installed the apps, so they are presented with the permissions. And sometimes even before first access to SMS/Call with another option dialog to tell them that.
  - gsich 9y ago
    This is not a security feature you should rely on solely. Anyone who wants to stuff with multiple accounts, can circumvent this easily. So this is not a security issue. It is for tracking people, first and foremost.
sambull 9y ago
Or as facebook is doing just people tracking.
bkovacev 9y ago
How can one protect himself against this?
- fixermark 9y ago
  To a first approximation: you can install browser extensions (or modify your /etc/hosts file or a router up-the-chain from your device) to re-route requests to Facebook URLs / IP addresses to a black hole. To a larger approximation: if a third-party chooses to share their information on your browsing habits with Facebook, that's not something you can control. But it's probably a much rarer, much smaller attack surface.
common_ 9y ago
This isn't just basic cookie tracking. They have an actual profile on you, without your consent, with the people who have you in their address book and even potentially your purchasing habits, from the data they purchase from data brokers like Datalogix. They maintain this profile on you separately from other users, and they make immediate use of it if you create an account. That's why it's called a shadow profile.
- fixermark 9y ago
  How does such a practice differ morally from consumer credit reporting agencies?
  - cryptoz 9y ago
    You sign up for those when you get a credit card. You don't sign up for Facebook, they just start tracking you. You don't even have to go online for it to happen. They'll do it from your friend's profiles. It's quite different.
    - fixermark 9y ago
      Ah, quite correct. I meant to say "Consumer reporting agencies" and let "credit" slip in there as a side-effect of my personal experience. :) https://files.consumerfinance.gov/f/201604_cfpb_list-of-consumer-reporting-companies.pdf https://files.consumerfinance.gov/f/201604_cfpb_list-of-cons... ... but I think you answered the relevant question, which is that you consider opt-in to having your behavior tracked (even when that behavior interacts with third parties, e.g. visiting someone's website or buying a product from someone's company) morally key. I think the CFPB document I linked above indicates that this is not a universally-accepted principle.
    - dingaling 9y ago
      > You sign up for those when you get a credit card That is incorrect. Credit agencies create shadow profiles too, they call them 'thin files'. I have had to code around those situations. Like Facebook they suck-up every scrap of data they can get from their sources. They absolutely do not throw away any of it just because you don't have a credit card ( else they'd omit half of Europe ).
blakesterz 9y ago
Though it seems like it would be ok to say "ONE of the reasons we do this is security" because it really does seem like they can get some decent security stuff out of doing some of the things they do. It's probably not the primary purpose though, more like a happy accident? Though I'd guess for people who don't follow any of this close (like the vast majority of people) hearing "this will make you safe" probably works quite well, and that's why he's told to say these things.
tzahola 9y ago
What? No. They're not talking about logged out users. They're talking specifically about people who don't even have a Facebook account: https://www.bloomberg.com/news/articles/2018-04-11/zuckerberg-says-facebook-collects-internet-data-on-non-users https://www.bloomberg.com/news/articles/2018-04-11/zuckerber...
wavesounds 9y ago
Zuckerberg is the one being disingenuous. By acknowledging cookie tracking or scraper tracking, he answers the question that indeed FB tracks offline usage, but only mentions the innocuous cases and fails to acknowledge the Shadow Profiles[1] they clearly have 1. https://www.dailydot.com/news/facebook-shadow-profiles-privacy-faq/ https://www.dailydot.com/news/facebook-shadow-profiles-priva...
- fixermark 9y ago
  He actually mentions both in the original quote (if Bloomberg was sourcing to the section of the hearing I assume they're sourcing from).
  - ameister14 9y ago
    He acknowledged that they made shadow profiles and collected information not necessary for security from people who did not possess facebook accounts?
ameister14 9y ago
That's not what the question was. The man asking the question wasn't technically sophisticated enough to ask about using cookies, and if he were, he would not have asked that question anyway. The question was, does Facebook collect data on non-users? What that means is, if I have not signed up for facebook, are you tracking my behavior anyway through the like button and other methods?
- fixermark 9y ago
  That, I suppose, would have been a useful question for the Senator to ask. It wasn't the question asked.
  - ameister14 9y ago
    Yes, the Congressman's question actually was "Facebook has detailed profiles on people who have never signed up for Facebook. Yes or no?"
- phinnaeus 9y ago
  Do you mean the like button simply being present on pages or actual clicking of the like button? My understanding is clicking on the like button is pointless unless you're actually signed in to facebook.
  - fixermark 9y ago
    The like button actually being present means that your client makes a request to FB to fetch the relevant image resources and JS to display the button. When that occurs, FB has some limited ability to get information on your browsing habits based on what that like-button JS is allowed to see of your current session (which given browser fingerprinting techniques, can be enough to unify your behavior with high probability across multiple disparate "blips" of signal).
  - kerng 9y ago
    The loading of the Like button will give Facebook information about your user agent - it's like a tracking pixel. It's been shown that user agent information together with IP pretty much uniquely identify a user. You dont have to click anything
bogomipz 9y ago
>"That's a pretty disingenuous way to phrase Zuckerberg's response to a question of whether Facebook uses cookie tracking for logged-out users." Except it wasn't a response to a "to a question of whether Facebook uses cookie tracking for logged-out users." It was a response to the question of: "Facebook has detailed profiles on people who have never signed up for facebook, yes or no?" See the video here: https://mashable.com/2018/04/11/zuckerberg-testimony-shadow-profiles/#N5mYHqeAwOqK https://mashable.com/2018/04/11/zuckerberg-testimony-shadow-...

gsich 9y ago

No. There is no need to be able to do this.

Arnt 9y ago
Please elaborate.
- ynniv 9y ago
  A competent adversary won't carry cookies between sessions, so there is no security afforded by it. These cookies are solely to track the general population.
  - fixermark 9y ago
    I agree, but I also note you may be underestimating the number of competent adversaries in the world and the cost / benefit analysis of doing something like this to eliminate a large-percentage case of bad behavior.
    - gsich 9y ago
      The cost is immense (tracking of non-users) the benefit is low (being able to detect multi accounts).
    - ynniv 9y ago
      Incognito mode makes cookie avoidance easy, even for average users.
      - gsich 9y ago
        Or using another browser. And yes your average user is able to do that.
        908087 9y ago
        Average users are able to do a lot of simple things to afford themselves basic protection from some of these practices. The problem is that the vast majority of them don't know what those things are and don't know that they should be doing them. Even among the few who do take steps, the majority misunderstand what they're even achieving, in a "I use incognito mode so the NSA can't track me" kind of way. The even bigger problem, is that they shouldn't have to do anything to begin with, because these practices shouldn't be allowed in the first place. Governmental and societal complacency has allowed massive corporations to turn the internet into a largely adversarial entity for users. Use of the internet has become just easy enough to allow unsophisticated users to become a danger to themselves due to lack of understanding of what the simplified high level actions they take are actually doing underneath it all. Much of the time, these people are running apps which they don't understand to be connecting to the internet at all. The average grandparent isn't going to understand that the "free" solitaire game they installed is slurping down their contact list and call/SMS history.
        gsich 9y ago
        Well they installed the apps, so they are presented with the permissions. And sometimes even before first access to SMS/Call with another option dialog to tell them that.
- gsich 9y ago
  This is not a security feature you should rely on solely. Anyone who wants to stuff with multiple accounts, can circumvent this easily. So this is not a security issue. It is for tracking people, first and foremost.

sambull 9y ago

Or as facebook is doing just people tracking.

bkovacev 9y ago

How can one protect himself against this?

fixermark 9y ago
To a first approximation: you can install browser extensions (or modify your /etc/hosts file or a router up-the-chain from your device) to re-route requests to Facebook URLs / IP addresses to a black hole. To a larger approximation: if a third-party chooses to share their information on your browsing habits with Facebook, that's not something you can control. But it's probably a much rarer, much smaller attack surface.

common_ 9y ago

This isn't just basic cookie tracking. They have an actual profile on you, without your consent, with the people who have you in their address book and even potentially your purchasing habits, from the data they purchase from data brokers like Datalogix. They maintain this profile on you separately from other users, and they make immediate use of it if you create an account. That's why it's called a shadow profile.

fixermark 9y ago
How does such a practice differ morally from consumer credit reporting agencies?
- cryptoz 9y ago
  You sign up for those when you get a credit card. You don't sign up for Facebook, they just start tracking you. You don't even have to go online for it to happen. They'll do it from your friend's profiles. It's quite different.
  - fixermark 9y ago
    Ah, quite correct. I meant to say "Consumer reporting agencies" and let "credit" slip in there as a side-effect of my personal experience. :) https://files.consumerfinance.gov/f/201604_cfpb_list-of-consumer-reporting-companies.pdf https://files.consumerfinance.gov/f/201604_cfpb_list-of-cons... ... but I think you answered the relevant question, which is that you consider opt-in to having your behavior tracked (even when that behavior interacts with third parties, e.g. visiting someone's website or buying a product from someone's company) morally key. I think the CFPB document I linked above indicates that this is not a universally-accepted principle.
  - dingaling 9y ago
    > You sign up for those when you get a credit card That is incorrect. Credit agencies create shadow profiles too, they call them 'thin files'. I have had to code around those situations. Like Facebook they suck-up every scrap of data they can get from their sources. They absolutely do not throw away any of it just because you don't have a credit card ( else they'd omit half of Europe ).

blakesterz 9y ago

Though it seems like it would be ok to say "ONE of the reasons we do this is security" because it really does seem like they can get some decent security stuff out of doing some of the things they do. It's probably not the primary purpose though, more like a happy accident? Though I'd guess for people who don't follow any of this close (like the vast majority of people) hearing "this will make you safe" probably works quite well, and that's why he's told to say these things.

tzahola 9y ago

What? No. They're not talking about logged out users. They're talking specifically about people who don't even have a Facebook account: https://www.bloomberg.com/news/articles/2018-04-11/zuckerberg-says-facebook-collects-internet-data-on-non-users https://www.bloomberg.com/news/articles/2018-04-11/zuckerber...

wavesounds 9y ago

Zuckerberg is the one being disingenuous. By acknowledging cookie tracking or scraper tracking, he answers the question that indeed FB tracks offline usage, but only mentions the innocuous cases and fails to acknowledge the Shadow Profiles[1] they clearly have 1. https://www.dailydot.com/news/facebook-shadow-profiles-privacy-faq/ https://www.dailydot.com/news/facebook-shadow-profiles-priva...

fixermark 9y ago
He actually mentions both in the original quote (if Bloomberg was sourcing to the section of the hearing I assume they're sourcing from).
- ameister14 9y ago
  He acknowledged that they made shadow profiles and collected information not necessary for security from people who did not possess facebook accounts?

ameister14 9y ago

That's not what the question was. The man asking the question wasn't technically sophisticated enough to ask about using cookies, and if he were, he would not have asked that question anyway. The question was, does Facebook collect data on non-users? What that means is, if I have not signed up for facebook, are you tracking my behavior anyway through the like button and other methods?

fixermark 9y ago
That, I suppose, would have been a useful question for the Senator to ask. It wasn't the question asked.
- ameister14 9y ago
  Yes, the Congressman's question actually was "Facebook has detailed profiles on people who have never signed up for Facebook. Yes or no?"
phinnaeus 9y ago
Do you mean the like button simply being present on pages or actual clicking of the like button? My understanding is clicking on the like button is pointless unless you're actually signed in to facebook.
- fixermark 9y ago
  The like button actually being present means that your client makes a request to FB to fetch the relevant image resources and JS to display the button. When that occurs, FB has some limited ability to get information on your browsing habits based on what that like-button JS is allowed to see of your current session (which given browser fingerprinting techniques, can be enough to unify your behavior with high probability across multiple disparate "blips" of signal).
- kerng 9y ago
  The loading of the Like button will give Facebook information about your user agent - it's like a tracking pixel. It's been shown that user agent information together with IP pretty much uniquely identify a user. You dont have to click anything

bogomipz 9y ago

>"That's a pretty disingenuous way to phrase Zuckerberg's response to a question of whether Facebook uses cookie tracking for logged-out users." Except it wasn't a response to a "to a question of whether Facebook uses cookie tracking for logged-out users." It was a response to the question of: "Facebook has detailed profiles on people who have never signed up for facebook, yes or no?" See the video here: https://mashable.com/2018/04/11/zuckerberg-testimony-shadow-profiles/#N5mYHqeAwOqK https://mashable.com/2018/04/11/zuckerberg-testimony-shadow-...