5 ms·

Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so y

Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. This is facilitated by information that is not under your control. If facebook was able to design and build this system, you can bet that other companies are doing this too.

jsjohnst 8y ago
Check the TOS and/or implementations for many of the tracking providers and you’ll see they use hashed emails. Show me a way to extract the common domain name from the below: 9425ca8eb02d022309ec175a7067b1567a5f741ec7010cc1b5034287f9db6e2f 4d1c86b9f418c713e784760fea809e34418c2f13e993d907783572ecc2c9bb6e
- tener 8y ago
  If the hashing algorithm is known (and my guess is it is at least possible to reverse engineer it, if it isn't documrnted) then cracking a hash with a GPU may be quite feasible.
  - jsjohnst 8y ago
    The hashing algorithm is well known, it’s unsalted md5/sha1/sha256. That doesn’t make it necessarily possible (sure, some cases yes, but not even most), let alone feasible, to rainbow table them.
- kadoban 8y ago
  The simple way would be to use part of the hash for the domain and part for the user. If you alternated bits it wouldn't be obvious. I doubt it'd be worth spending the effort to target people with personal domains though, and it would have some negative effects, so your point is well taken.
- Bhilai 8y ago
  Its pretty simple to crack unsalted hashes using rainbow tables, unless each hash is salted with a random distinct salt and if that is the case then these hash seem pretty useless. So how do tracking providers use these hash ? What other info is sent along with the hash ?
  - jsjohnst 8y ago
    > So how do tracking providers use these hash? They use it to match traffic across devices and IP addresses. > pretty simple to crack unsalted hashes Go ahead and rainbow table those hashes then. If you do it and are the first one to email me (email address in profile), I’ll pay you $100.
ardy42 8y ago
> Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. If you use the method described in the grandparent, you use a unique email address for every site (e.g site1@yourdomain.tld, site2@yourdomain.tld, etc). The domain will be the common part, which would be very hard for a company to use because most domains are shared between many separate users.
- barkingcat 8y ago
  This is no longer "just a little bit of effort and minimal cost" - most likely no one will use unique emails for every site as well as use private browsing mode permanently in order to avoid cross cookie / cross site contamination via 3rd party (non facebook) tracking. Which is cited as a "feature" - allowing clients to bring their own ad tracking database and integrating that into the FB one in order to make ad targeting more specific.
  - tjoff 8y ago
    Lots of people do this, in the past it has exposed data leaks. My if my site-specific email giqjtodvdksu@... has been getting spam lately then it is likely that either they sold it or they got hacked.
    - will_brown 8y ago
      >Lots of people do this... You mean a very small percentage of FB users do this? The point being as parent comment said it’s not “a little effort and minimal cost”. Figure a $10-15 overhead cost for the domain and maybe $5/month/e-mail account? Effectively to minimize tracking on Facebook one would have to spend a minimum of $70/year? It doesn’t seem like a great solution...go with a “free product” like Facebook in exchange allowing them to collect and monetize your data, only to pay to combat their business model? May as well offer a competing service that doesn’t track you, collect/monetize your data and pay say...half the cost of a domain and email.

jsjohnst 8y ago

Check the TOS and/or implementations for many of the tracking providers and you’ll see they use hashed emails. Show me a way to extract the common domain name from the below: 9425ca8eb02d022309ec175a7067b1567a5f741ec7010cc1b5034287f9db6e2f 4d1c86b9f418c713e784760fea809e34418c2f13e993d907783572ecc2c9bb6e

tener 8y ago
If the hashing algorithm is known (and my guess is it is at least possible to reverse engineer it, if it isn't documrnted) then cracking a hash with a GPU may be quite feasible.
- jsjohnst 8y ago
  The hashing algorithm is well known, it’s unsalted md5/sha1/sha256. That doesn’t make it necessarily possible (sure, some cases yes, but not even most), let alone feasible, to rainbow table them.
kadoban 8y ago
The simple way would be to use part of the hash for the domain and part for the user. If you alternated bits it wouldn't be obvious. I doubt it'd be worth spending the effort to target people with personal domains though, and it would have some negative effects, so your point is well taken.
Bhilai 8y ago
Its pretty simple to crack unsalted hashes using rainbow tables, unless each hash is salted with a random distinct salt and if that is the case then these hash seem pretty useless. So how do tracking providers use these hash ? What other info is sent along with the hash ?
- jsjohnst 8y ago
  > So how do tracking providers use these hash? They use it to match traffic across devices and IP addresses. > pretty simple to crack unsalted hashes Go ahead and rainbow table those hashes then. If you do it and are the first one to email me (email address in profile), I’ll pay you $100.

ardy42 8y ago

> Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. If you use the method described in the grandparent, you use a unique email address for every site (e.g site1@yourdomain.tld, site2@yourdomain.tld, etc). The domain will be the common part, which would be very hard for a company to use because most domains are shared between many separate users.

barkingcat 8y ago
This is no longer "just a little bit of effort and minimal cost" - most likely no one will use unique emails for every site as well as use private browsing mode permanently in order to avoid cross cookie / cross site contamination via 3rd party (non facebook) tracking. Which is cited as a "feature" - allowing clients to bring their own ad tracking database and integrating that into the FB one in order to make ad targeting more specific.
- tjoff 8y ago
  Lots of people do this, in the past it has exposed data leaks. My if my site-specific email giqjtodvdksu@... has been getting spam lately then it is likely that either they sold it or they got hacked.
  - will_brown 8y ago
    >Lots of people do this... You mean a very small percentage of FB users do this? The point being as parent comment said it’s not “a little effort and minimal cost”. Figure a $10-15 overhead cost for the domain and maybe $5/month/e-mail account? Effectively to minimize tracking on Facebook one would have to spend a minimum of $70/year? It doesn’t seem like a great solution...go with a “free product” like Facebook in exchange allowing them to collect and monetize your data, only to pay to combat their business model? May as well offer a competing service that doesn’t track you, collect/monetize your data and pay say...half the cost of a domain and email.