6 ms·

I agree with your sentiment. But, as someone who understands that not all people and companies use the same moral set as myself, this is why I've never set up

I agree with your sentiment. But, as someone who understands that not all people and companies use the same moral set as myself, this is why I've never set up 2fa using a phone. Why should I give some company my phone number? Increasingly it's become a single point of metadata to uniquely describe myself (just as my email addresses have).

otachack 8y ago
You don't have to but it's the most user-friendly, although flawed, method of enabling 2FA. They could have easily used a software token but that requires non-tech savvy users to download a 3rd party authentication app, as well as understand the basic usage. Why do that when users can simply get a text sent on a method they most likely have?
jsjohnst 8y ago
> just as my email addresses have That doesn’t need to be the case though with just a little bit of effort and minimal cost. Use your own domain for email and set your account to be a catchall. Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier.
- barkingcat 8y ago
  Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. This is facilitated by information that is not under your control. If facebook was able to design and build this system, you can bet that other companies are doing this too.
  - jsjohnst 8y ago
    Check the TOS and/or implementations for many of the tracking providers and you’ll see they use hashed emails. Show me a way to extract the common domain name from the below: 9425ca8eb02d022309ec175a7067b1567a5f741ec7010cc1b5034287f9db6e2f 4d1c86b9f418c713e784760fea809e34418c2f13e993d907783572ecc2c9bb6e
    - tener 8y ago
      If the hashing algorithm is known (and my guess is it is at least possible to reverse engineer it, if it isn't documrnted) then cracking a hash with a GPU may be quite feasible.
      - jsjohnst 8y ago
        The hashing algorithm is well known, it’s unsalted md5/sha1/sha256. That doesn’t make it necessarily possible (sure, some cases yes, but not even most), let alone feasible, to rainbow table them.
    - kadoban 8y ago
      The simple way would be to use part of the hash for the domain and part for the user. If you alternated bits it wouldn't be obvious. I doubt it'd be worth spending the effort to target people with personal domains though, and it would have some negative effects, so your point is well taken.
    - Bhilai 8y ago
      Its pretty simple to crack unsalted hashes using rainbow tables, unless each hash is salted with a random distinct salt and if that is the case then these hash seem pretty useless. So how do tracking providers use these hash ? What other info is sent along with the hash ?
      - jsjohnst 8y ago
        > So how do tracking providers use these hash? They use it to match traffic across devices and IP addresses. > pretty simple to crack unsalted hashes Go ahead and rainbow table those hashes then. If you do it and are the first one to email me (email address in profile), I’ll pay you $100.
  - ardy42 8y ago
    > Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. If you use the method described in the grandparent, you use a unique email address for every site (e.g site1@yourdomain.tld, site2@yourdomain.tld, etc). The domain will be the common part, which would be very hard for a company to use because most domains are shared between many separate users.
    - barkingcat 8y ago
      This is no longer "just a little bit of effort and minimal cost" - most likely no one will use unique emails for every site as well as use private browsing mode permanently in order to avoid cross cookie / cross site contamination via 3rd party (non facebook) tracking. Which is cited as a "feature" - allowing clients to bring their own ad tracking database and integrating that into the FB one in order to make ad targeting more specific.
      - tjoff 8y ago
        Lots of people do this, in the past it has exposed data leaks. My if my site-specific email giqjtodvdksu@... has been getting spam lately then it is likely that either they sold it or they got hacked.
        will_brown 8y ago
        >Lots of people do this... You mean a very small percentage of FB users do this? The point being as parent comment said it’s not “a little effort and minimal cost”. Figure a $10-15 overhead cost for the domain and maybe $5/month/e-mail account? Effectively to minimize tracking on Facebook one would have to spend a minimum of $70/year? It doesn’t seem like a great solution...go with a “free product” like Facebook in exchange allowing them to collect and monetize your data, only to pay to combat their business model? May as well offer a competing service that doesn’t track you, collect/monetize your data and pay say...half the cost of a domain and email.
- gruez 8y ago
  >Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier. unless sites smarten up and realize facebook@johndoe.com is the same person as pizzaplace@johndoe.com, especially when johndoe.com isn't a "common" email domain like hotmail.com
  - jsjohnst 8y ago
    Most marketing companies don’t share raw email addresses (rather md5/sha1/sha256 hashes of the emails). In that scenario, linking the common domain name is very difficult to near impossible to do currently.
  - lancesells 8y ago
    As someone that has created a facebook account with an unused email without using my name or any information they still recommend my friends, family and interests. Instagram did the same thing with my interests. There's a lot more going on than linking email addresses.
    - cmroanirgo 8y ago
      If you used an app (rather than just a website), then all your contacts were uploaded. (Instagram has always been an app, hasn't it?)
- kozikow 8y ago
  You can do it with Gmail to some extent already. E.g. instead of using myemail@gmail.com I would use myemail+facebook@gmail.com. Gmail ignores anything after the plus. As someone mentioned, marketing companies usually share just the hash of email. The trick is not too popular and I didn't experience a company handling it yet.
  - krageon 8y ago
    A vast majority of companies either don't accept the plus because they are too lazy to implement proper email validation, or they strip the pluses from gmail addresses because they're strictly useless to them.
    - Mathnerd314 8y ago
      Then you can use dots. An 11-character email has 2^10=1024 different addresses.
  - asaph 8y ago
    The "trick" is both popular and commonly made to be moot by programmers. Source: I know programmers at multiple companies that have written production code to strip the +suffix from the username portion of gmail addresses.
    - chainsaw10 8y ago
      If someone does that with one of my (custom domain) addresses, it won’t work, here’s what I implemented: https://zackorndorff.com/2015/03/10/disposable-email-addresses-with-postfix/ https://zackorndorff.com/2015/03/10/disposable-email-address... (To save you a click, they look like aa_COMPANY+SHORTHASH@mydomain.com, with shorthash being based on COMPANY and a secret) Downside is the address ends up absurdly long, and I’ve had to manually create some aliases for companies that won’t accept the plus. I don’t recommend this setup, it’s kind of a pain to maintain, but I wish one of the mainstream providers would implement something similar.
    - Breza 8y ago
- codedokode 8y ago
  This is not what an average user of Facebook can do. What an average user can do is demand adopting laws like GDPR to regulate PII.
- cmroanirgo 8y ago
  I've been typically using name+website@domain.tld to distinguish email origins (and leakage). Ironically, I've already set up otherdomain.tld@privacy.domain.tld to hide registrar information, but hadn't thought of using it for day-to-day signups until now. I think I'll extend the latter (and reduce the required Spam score) before it gets sent to my inbox.

otachack 8y ago

You don't have to but it's the most user-friendly, although flawed, method of enabling 2FA. They could have easily used a software token but that requires non-tech savvy users to download a 3rd party authentication app, as well as understand the basic usage. Why do that when users can simply get a text sent on a method they most likely have?

jsjohnst 8y ago

> just as my email addresses have That doesn’t need to be the case though with just a little bit of effort and minimal cost. Use your own domain for email and set your account to be a catchall. Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier.

barkingcat 8y ago
Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. This is facilitated by information that is not under your control. If facebook was able to design and build this system, you can bet that other companies are doing this too.
- jsjohnst 8y ago
  Check the TOS and/or implementations for many of the tracking providers and you’ll see they use hashed emails. Show me a way to extract the common domain name from the below: 9425ca8eb02d022309ec175a7067b1567a5f741ec7010cc1b5034287f9db6e2f 4d1c86b9f418c713e784760fea809e34418c2f13e993d907783572ecc2c9bb6e
  - tener 8y ago
    If the hashing algorithm is known (and my guess is it is at least possible to reverse engineer it, if it isn't documrnted) then cracking a hash with a GPU may be quite feasible.
    - jsjohnst 8y ago
      The hashing algorithm is well known, it’s unsalted md5/sha1/sha256. That doesn’t make it necessarily possible (sure, some cases yes, but not even most), let alone feasible, to rainbow table them.
  - kadoban 8y ago
    The simple way would be to use part of the hash for the domain and part for the user. If you alternated bits it wouldn't be obvious. I doubt it'd be worth spending the effort to target people with personal domains though, and it would have some negative effects, so your point is well taken.
  - Bhilai 8y ago
    Its pretty simple to crack unsalted hashes using rainbow tables, unless each hash is salted with a random distinct salt and if that is the case then these hash seem pretty useless. So how do tracking providers use these hash ? What other info is sent along with the hash ?
    - jsjohnst 8y ago
      > So how do tracking providers use these hash? They use it to match traffic across devices and IP addresses. > pretty simple to crack unsalted hashes Go ahead and rainbow table those hashes then. If you do it and are the first one to email me (email address in profile), I’ll pay you $100.
- ardy42 8y ago
  > Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. If you use the method described in the grandparent, you use a unique email address for every site (e.g site1@yourdomain.tld, site2@yourdomain.tld, etc). The domain will be the common part, which would be very hard for a company to use because most domains are shared between many separate users.
  - barkingcat 8y ago
    This is no longer "just a little bit of effort and minimal cost" - most likely no one will use unique emails for every site as well as use private browsing mode permanently in order to avoid cross cookie / cross site contamination via 3rd party (non facebook) tracking. Which is cited as a "feature" - allowing clients to bring their own ad tracking database and integrating that into the FB one in order to make ad targeting more specific.
    - tjoff 8y ago
      Lots of people do this, in the past it has exposed data leaks. My if my site-specific email giqjtodvdksu@... has been getting spam lately then it is likely that either they sold it or they got hacked.
      - will_brown 8y ago
        >Lots of people do this... You mean a very small percentage of FB users do this? The point being as parent comment said it’s not “a little effort and minimal cost”. Figure a $10-15 overhead cost for the domain and maybe $5/month/e-mail account? Effectively to minimize tracking on Facebook one would have to spend a minimum of $70/year? It doesn’t seem like a great solution...go with a “free product” like Facebook in exchange allowing them to collect and monetize your data, only to pay to combat their business model? May as well offer a competing service that doesn’t track you, collect/monetize your data and pay say...half the cost of a domain and email.
gruez 8y ago
>Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier. unless sites smarten up and realize facebook@johndoe.com is the same person as pizzaplace@johndoe.com, especially when johndoe.com isn't a "common" email domain like hotmail.com
- jsjohnst 8y ago
  Most marketing companies don’t share raw email addresses (rather md5/sha1/sha256 hashes of the emails). In that scenario, linking the common domain name is very difficult to near impossible to do currently.
- lancesells 8y ago
  As someone that has created a facebook account with an unused email without using my name or any information they still recommend my friends, family and interests. Instagram did the same thing with my interests. There's a lot more going on than linking email addresses.
  - cmroanirgo 8y ago
    If you used an app (rather than just a website), then all your contacts were uploaded. (Instagram has always been an app, hasn't it?)
kozikow 8y ago
You can do it with Gmail to some extent already. E.g. instead of using myemail@gmail.com I would use myemail+facebook@gmail.com. Gmail ignores anything after the plus. As someone mentioned, marketing companies usually share just the hash of email. The trick is not too popular and I didn't experience a company handling it yet.
- krageon 8y ago
  A vast majority of companies either don't accept the plus because they are too lazy to implement proper email validation, or they strip the pluses from gmail addresses because they're strictly useless to them.
  - Mathnerd314 8y ago
    Then you can use dots. An 11-character email has 2^10=1024 different addresses.
- asaph 8y ago
  The "trick" is both popular and commonly made to be moot by programmers. Source: I know programmers at multiple companies that have written production code to strip the +suffix from the username portion of gmail addresses.
  - chainsaw10 8y ago
    If someone does that with one of my (custom domain) addresses, it won’t work, here’s what I implemented: https://zackorndorff.com/2015/03/10/disposable-email-addresses-with-postfix/ https://zackorndorff.com/2015/03/10/disposable-email-address... (To save you a click, they look like aa_COMPANY+SHORTHASH@mydomain.com, with shorthash being based on COMPANY and a secret) Downside is the address ends up absurdly long, and I’ve had to manually create some aliases for companies that won’t accept the plus. I don’t recommend this setup, it’s kind of a pain to maintain, but I wish one of the mainstream providers would implement something similar.
  - Breza 8y ago
codedokode 8y ago
This is not what an average user of Facebook can do. What an average user can do is demand adopting laws like GDPR to regulate PII.
cmroanirgo 8y ago
I've been typically using name+website@domain.tld to distinguish email origins (and leakage). Ironically, I've already set up otherdomain.tld@privacy.domain.tld to hide registrar information, but hadn't thought of using it for day-to-day signups until now. I think I'll extend the latter (and reduce the required Spam score) before it gets sent to my inbox.