9 ms·

Another personal observation. I have an Instagram account that I thought was fully incognito. I never connected it to any other social account, I used a separat

by mojuba 8y ago

Another personal observation. I have an Instagram account that I thought was fully incognito. I never connected it to any other social account, I used a separate email for authentication etc. Just days after the Instagram founders left Facebook I started receiving friend suggestion on my IG that were very very relevant. Those were people I knew in real life and mostly connected via Facebook but not only. I shouldn't be surprized as being connected to the Internet by itself is an end to your privacy but still, this was probably the spookiest invasion into my privacy so far. Bye-bye Instagram.

oedmarap 8y ago
When I was in another country on a business trip I bought a temporary local SIM, originally valid for two weeks but I've kept it active as I travel there often. I used that foreign number to create my Instagram account and I've gotten the benefit of only being shown suggested accounts from locals from that country (zero people I know). Same goes for ads as well. Currently I keep it on roaming and actually use it to verify other online services that may stubbornly require SMS. Might be worth a try for those of you looking to pseudo-opt-out of phone number tracking & recommendations on social media services that do this, if you can get your hands on one.
- bilbo0s 8y ago
  Just as a warning to anyone who might try this, it won't work. (At least not without a massive amount of opsec effort expended on your side.) I'll give you an example of why it might not work. Since your phone has roaming, you happen to have it with you at work, or at a party, or at the library, or anywhere really. If even a single acquaintance of yours is "nearby", the information is leaked. If acquaintances seem to always be "nearby", children, wives, husbands, siblings, your info is DEFINITELY leaked. If anyone is going to try to use this strategy for anything which might result in the loss of your livelihood, (eg - porn), please realize there are many, many, many more precautions you will have to take than are listed in oedfmarap's comment. If you just do what you see in that comment, you could find yourself without a job somewhere down the line.
  - homeaway2 8y ago
    While one would think that this is only important for things you're doing that you don't want the government to know about (see [1] page 52 for details on how not to mess this up -- basically don't have them turned on together, don't turn one off and turn the other on in the same place, or log in to the same sites or store the same numbers on both phones), it's also important for Facebook and other private tracking. If you have Facebook on your burner phone and your friends have Facebook on their phones with location enabled, it's over [2]. [1] https://www.defcon.org/images/defcon-22/dc-22-presentations/Zoz/DEFCON-22-Zoz-Dont-Fuck-It-Up-UPDATED.pdf https://www.defcon.org/images/defcon-22/dc-22-presentations/... [2] https://splinternews.com/facebook-is-using-your-phones-location-to-suggest-new-f-1793857843 https://splinternews.com/facebook-is-using-your-phones-locat...
finnjohnsen2 8y ago
I've seen this, and concluded that friend suggestions must use GPS to see who I am near on a regular basis.
- aurbano 8y ago
  This is absolutely true, when I moved to London a few years ago, I rented a room in a house with 3 other housemates I had never met. Within 1-2 days, Facebook recommended one of them as a friend - bear in mind I hadn't added any of them to Fb, so all it could have used was our location...
  - r1ch 8y ago
    I believe they used Wifi BSSID tracking for that, GPS would be too battery heavy. If you're connected to the same Wifi networks it can reasonably assume you're in the same vicinity.
  - sean2 8y ago
    It's possible Facebook uses location data for this, but I've got an alternate theories. This happens to me often too, with much briefer encounters: mainly dates and meetups. Since I've shared similar amounts of time at the same restaurant with hundreds or thousands people with whom I had no interaction, many of who's arrival and departure times would happen by chance to line up with mine, they must be using something else. I also share a duplex-house and an office building with people who've never been inexplicably recommended on Facebook. From these observations, I've come to think that location data has to play a very small role in Facebook's recommendation system. Here's my best (but untested) theory to explain this: Your house-mate searched for you on Facebook, which triggered Facebook to think you might be friends.
krn 8y ago
Haven't you used the same web browser for both, Facebook and Instagram? They might just be sharing cookies.
- mariusmg 8y ago
  Well, Instagram and FB being 2 separate domains , they shouldn't (in theory at least) be able to access each others cookies in browser. The tracking is most likley still server side based. Based on what the OP is writing, the unique identifier foe the user can even be the IP address...
  - krn 8y ago
    They shouldn't be able to access each other's cookies at the browser's level, but instagram.com might include third-party javascript code from facebook.com, which connects the two accounts in the system.
ezoe 8y ago
Are you sure you didn't access it from the same IP address? There are so many fingerprints you are willingly sending to the public.
- mojuba 8y ago
  I did of course, how could I not access both from the same IP. The bottom line is: a property owner is a property owner even if it comes to separate domain names.
  - marmaduke 8y ago
    A VPN would be one way
- amirmc 8y ago
  ‘Willingly’? I think unwittingly is more likely.
  - ezoe 8y ago
    It's your computer which store cookie and localStroage data to the local storage. It' your computer which execute JavaScript program to retrieve that data. It's your choice to use the same IP address. It's your will.
helloindia 8y ago
This happened to me after Facebook acquired Instagram. I had my mobile no in Instagram profile. Instagram cross-referenced my mobile with my Whatsapp contact list(I haven't given Instagram access to my iPhone contacts). I suddenly got suggestions to follow my colleagues on Insta. Colleagues with whom I interact only on Whatsapp. Since then my trust level in Instagram,Facebook & Whatsapp has gone into negative.
mooman219 8y ago
Definitely location tracking of some sort. IP, location data from the browser (if allowed), and scraping photo metadata can all lead to them associating people.
qrbLPHiKpiux 8y ago
This is a perfect example of the need for physical comparmentation. Separate devices never connected through the same internet service. As far as devices go, to think you have separated “anything” on only one device, you’re living in fantasyland.
- fghtr 8y ago
  Qubes OS disagrees with you here.
  - qrbLPHiKpiux 8y ago
    Agreed. From my POV, unless you’re really needing anonymity, I don’t include TOR as a practical solution for day to day needs.
- pixl97 8y ago
  If the app can look at your wireless, even that is not enough. It can just make a map of the SSID/BSSID around you.
  - dylan604 8y ago
    Statements like this make me want to learn phone OS development just so I can have a better understanding on what information an app can get from the OS. Honest question, why would an app ever need to know the SSID of a wireless network? The app should only care if there is a valid network connection, and then use it. I can see being able to know if it is wifi vs cellular so they can have the option to limit large downloads to wifi only. However, the SSID would not be necessary information for the app.
    - arkitectual 8y ago
      An example would be an app for associating a device without a screen on to a wireless network. Think IoT devices or Alexa. Saves the user from having to type in the SSID which is a pain.
- 8y ago
rubatuga 8y ago
I’ve seen this happen with YouTube, specifically this video: https://youtu.be/bKgf5PaBzyg https://youtu.be/bKgf5PaBzyg I had watched it many many years ago, and I suddenly remembered about it while at my friends apartment, (which is in the same building). Now I searched it up on my friends computer which was logged into his gmail account. We watched it and laughed. However, an hour later, I was on my iPhone at home when it appeared in my related videos. http://i.imgur.com/u31ZuWM.jpg http://i.imgur.com/u31ZuWM.jpg I refreshed and it was gone...

by mojuba 8y ago

oedmarap 8y ago

When I was in another country on a business trip I bought a temporary local SIM, originally valid for two weeks but I've kept it active as I travel there often. I used that foreign number to create my Instagram account and I've gotten the benefit of only being shown suggested accounts from locals from that country (zero people I know). Same goes for ads as well. Currently I keep it on roaming and actually use it to verify other online services that may stubbornly require SMS. Might be worth a try for those of you looking to pseudo-opt-out of phone number tracking & recommendations on social media services that do this, if you can get your hands on one.

bilbo0s 8y ago
Just as a warning to anyone who might try this, it won't work. (At least not without a massive amount of opsec effort expended on your side.) I'll give you an example of why it might not work. Since your phone has roaming, you happen to have it with you at work, or at a party, or at the library, or anywhere really. If even a single acquaintance of yours is "nearby", the information is leaked. If acquaintances seem to always be "nearby", children, wives, husbands, siblings, your info is DEFINITELY leaked. If anyone is going to try to use this strategy for anything which might result in the loss of your livelihood, (eg - porn), please realize there are many, many, many more precautions you will have to take than are listed in oedfmarap's comment. If you just do what you see in that comment, you could find yourself without a job somewhere down the line.
- homeaway2 8y ago
  While one would think that this is only important for things you're doing that you don't want the government to know about (see [1] page 52 for details on how not to mess this up -- basically don't have them turned on together, don't turn one off and turn the other on in the same place, or log in to the same sites or store the same numbers on both phones), it's also important for Facebook and other private tracking. If you have Facebook on your burner phone and your friends have Facebook on their phones with location enabled, it's over [2]. [1] https://www.defcon.org/images/defcon-22/dc-22-presentations/Zoz/DEFCON-22-Zoz-Dont-Fuck-It-Up-UPDATED.pdf https://www.defcon.org/images/defcon-22/dc-22-presentations/... [2] https://splinternews.com/facebook-is-using-your-phones-location-to-suggest-new-f-1793857843 https://splinternews.com/facebook-is-using-your-phones-locat...

finnjohnsen2 8y ago

I've seen this, and concluded that friend suggestions must use GPS to see who I am near on a regular basis.

aurbano 8y ago
This is absolutely true, when I moved to London a few years ago, I rented a room in a house with 3 other housemates I had never met. Within 1-2 days, Facebook recommended one of them as a friend - bear in mind I hadn't added any of them to Fb, so all it could have used was our location...
- r1ch 8y ago
  I believe they used Wifi BSSID tracking for that, GPS would be too battery heavy. If you're connected to the same Wifi networks it can reasonably assume you're in the same vicinity.
- sean2 8y ago
  It's possible Facebook uses location data for this, but I've got an alternate theories. This happens to me often too, with much briefer encounters: mainly dates and meetups. Since I've shared similar amounts of time at the same restaurant with hundreds or thousands people with whom I had no interaction, many of who's arrival and departure times would happen by chance to line up with mine, they must be using something else. I also share a duplex-house and an office building with people who've never been inexplicably recommended on Facebook. From these observations, I've come to think that location data has to play a very small role in Facebook's recommendation system. Here's my best (but untested) theory to explain this: Your house-mate searched for you on Facebook, which triggered Facebook to think you might be friends.

krn 8y ago

Haven't you used the same web browser for both, Facebook and Instagram? They might just be sharing cookies.

mariusmg 8y ago
Well, Instagram and FB being 2 separate domains , they shouldn't (in theory at least) be able to access each others cookies in browser. The tracking is most likley still server side based. Based on what the OP is writing, the unique identifier foe the user can even be the IP address...
- krn 8y ago
  They shouldn't be able to access each other's cookies at the browser's level, but instagram.com might include third-party javascript code from facebook.com, which connects the two accounts in the system.

ezoe 8y ago

Are you sure you didn't access it from the same IP address? There are so many fingerprints you are willingly sending to the public.

mojuba 8y ago
I did of course, how could I not access both from the same IP. The bottom line is: a property owner is a property owner even if it comes to separate domain names.
- marmaduke 8y ago
  A VPN would be one way
amirmc 8y ago
‘Willingly’? I think unwittingly is more likely.
- ezoe 8y ago
  It's your computer which store cookie and localStroage data to the local storage. It' your computer which execute JavaScript program to retrieve that data. It's your choice to use the same IP address. It's your will.

helloindia 8y ago

This happened to me after Facebook acquired Instagram. I had my mobile no in Instagram profile. Instagram cross-referenced my mobile with my Whatsapp contact list(I haven't given Instagram access to my iPhone contacts). I suddenly got suggestions to follow my colleagues on Insta. Colleagues with whom I interact only on Whatsapp. Since then my trust level in Instagram,Facebook & Whatsapp has gone into negative.

mooman219 8y ago

Definitely location tracking of some sort. IP, location data from the browser (if allowed), and scraping photo metadata can all lead to them associating people.

qrbLPHiKpiux 8y ago

This is a perfect example of the need for physical comparmentation. Separate devices never connected through the same internet service. As far as devices go, to think you have separated “anything” on only one device, you’re living in fantasyland.

fghtr 8y ago
Qubes OS disagrees with you here.
- qrbLPHiKpiux 8y ago
  Agreed. From my POV, unless you’re really needing anonymity, I don’t include TOR as a practical solution for day to day needs.
pixl97 8y ago
If the app can look at your wireless, even that is not enough. It can just make a map of the SSID/BSSID around you.
- dylan604 8y ago
  Statements like this make me want to learn phone OS development just so I can have a better understanding on what information an app can get from the OS. Honest question, why would an app ever need to know the SSID of a wireless network? The app should only care if there is a valid network connection, and then use it. I can see being able to know if it is wifi vs cellular so they can have the option to limit large downloads to wifi only. However, the SSID would not be necessary information for the app.
  - arkitectual 8y ago
    An example would be an app for associating a device without a screen on to a wireless network. Think IoT devices or Alexa. Saves the user from having to type in the SSID which is a pain.
8y ago

rubatuga 8y ago

I’ve seen this happen with YouTube, specifically this video: https://youtu.be/bKgf5PaBzyg https://youtu.be/bKgf5PaBzyg I had watched it many many years ago, and I suddenly remembered about it while at my friends apartment, (which is in the same building). Now I searched it up on my friends computer which was logged into his gmail account. We watched it and laughed. However, an hour later, I was on my iPhone at home when it appeared in my related videos. http://i.imgur.com/u31ZuWM.jpg http://i.imgur.com/u31ZuWM.jpg I refreshed and it was gone...