6 ms·
I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does n
by bjt2n3904 8y ago
I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo.
1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234)
2) User creates a new Proton Mail address. (Fakey@protonmail.com)
3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com, fakey@protonmail.com, 800-555-1234). This user is on Instagram, Facebook, or has some mobile app that uses their analytics.
4) Facebook makes the association after scraping his friends contact list.
Essentially, his friends betrayed him, likely unintentionally.
- dymk 8y agoThis is 99% likely the case. Everyone thinks that we need technical voodoo to figure out who a user is. No, people are just far worse at separating their “new” identities from their old ones than they think. You don’t even need a shadow profile tracking previous info to do this. Just infer PYMK via a few friends he adds on the new account.
- ucaetano 8y agoYep, IIRC it was confirmed that FB crosses people's contact lists to match profiles to people.
- rmorey 8y agoIn the Reddit thread someone brought this up, and OP explicitly stated the protonmail address was brand new, and created solely for this purpose
- ChrisSD 8y agoMy one and only facebook profile was a complete fake and yet it managed to recommend I follow many of my real family and some of my social circle. My guess this was simply based on my location because the people it recommended were also family/friends of people who had used facebook from my house.
- AstralStorm 8y agoIP address, ever heard of that nearly impossible to anonymize thing? Facebook can also build a profile based on loads of their logo image using the IP... Including rough geolocation if it is shared.
- ChrisSD 8y agoHence my guess that it was likely based on location.
- zucksablackhat 8y agothe average user is quite naive regarding what thier systems give away. first off zuck is a blackhat straight up. browser space has its meathooks on your system, things such as canvasing and fingerprinting are not "deep" there is a constantly evolving threat regarding what is deep fingerprinting. The popup dialogs dont stick to doing what the buttons say they do, microsoft and the redefinition of the topright X is a raging example. ALL of the techniques mentioned here so far are in play, from "deleted" data retention, to actually hacking to pwn sytem permissions, this is a very big reason a windows user should not cruise the web logged in to an administrator account.
- rbinv 8y agoSo much bullshit. Just stop.
- compiler-guy 8y agoFacebook also matches people by who searches for whom. If one of his friends searched for him under the new name, then it can make the connection that way.
- eridius 8y agoFrom the comments it sounds like the real answer is cookies: https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a_fake_account_and_facebook_still/efj6tz4/?context=3 https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a...
- kevin_b_er 8y agoThis shows how just trying to protect your privacy alone doesn't work. Facebook relies on the unintentional betrayal of your friends and associates. You might not have put your phone number into facebook, but someone you know put your number in with your full name and the facebook app harvested it. Facebook now has your phone number in your shadow profile. Everyone less privacy savvy than you will inadvertently permit a corporation to harvest your personal information to profit from.
- jklick 8y agoHi, I'm the original poster on Reddit. It's a great theory -- and I can see how this could easily happen to someone - but it was not the case in this scenario. In fact, doing so would completely defeat what I was trying to achieve. The email address I used for Facebook was unique, not used for anything else, and not shared with anyone else. It was completely isolated.
- QuantumGood 8y agoSo...cookies? https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a_fake_account_and_facebook_still/efj6tz4/?context=3 https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a... (suggested below by eridius) And riverdan points you you didn't seem to clear browser cookies since you last used you old personal FB account?
- jklick 8y agoYeah, that's what the running theory is. Kind of angry with myself if that's the case. However, as I point out in my second update, the whole endeavor seems to be awfully tricky. One misstep and privacy leaks.
- josephjrobison 8y agoMaybe recreate it, but take out all the associations that people are suggesting here? Spin up a new Windows VPS and create all activity over there and see if FB still connects you?
- cascada 8y ago> One of his friends adds that email address to his contact. And what a user creates a fake account without adding his real or current/old friends to it?