7 ms·

Stack Overflow lets Facebook track users across their sites

384 points by Thorondor 7y ago

eveningcoffee 7y ago
I believe that one day boycott will help them reconsider these practices.
- xellisx 7y ago
  "One day boycott" reads as if the boycott lasts one day and that's it, you are back to normal, using the site, getting tracked. So I don't think I would be too scared if I were a business.
  - c0vfefe 7y ago
    Pretty sure they meant "one day a boycott."
  - eveningcoffee 7y ago
    Yes, it does not work if it is not coordinated but if significant number of users stops the service at the same time then it will leave sizable tent in the revenue.
    - joaomacp 7y ago
      > sizable tent in the revenue. I'm sorry. http://imageenvision.com/450/24542-clip-art-graphic-of-a-flat-green-dollar-bill-cartoon-character-camping-with-a-tent-and-fire-by-toons4biz.jpg http://imageenvision.com/450/24542-clip-art-graphic-of-a-fla...
- cwbrandsma 7y ago
  are you talking about boycotting Stackoverflow or Facebook? I could reasonably boycott Facebook, sure. But the day Stackoverflow gets boycotted is the day no code gets written. /s
  - Nextgrid 7y ago
    I know this is sarcasm but I’d like to add something anyway: I don’t know if it’s just experience or if the quality of non-Stackoverflow resources has increased but I find myself needing it less and less in the past couple years.
- robertAngst 7y ago
  I see this as 2 options- >If you don't like Facebook, get rid of it. I have. And I still have friends. >Let Facebook advertise really specific to you. Weirdly specific, it might be useful. * *might get blackmailed later if you were doing socially unacceptable things. But you could not participate in Facebook, the same company you are trying to avoid.
  - JohnFen 7y ago
    > But you could not participate in Facebook That doesn't stop Facebook from tracking you, though. It only makes the tracking a bit coarser.
Someone1234 7y ago
I have a Facebook account, this creates limitations when it comes to blocking (e.g. I cannot use a DNS block/piHole). What I found works for me is to use Multi-Account Containers with Facebook being forced-open in a specific container (that's only for Facebook) and then using Firefox's built in Content Blocking to block trackers in other containers (Content Blocking -> Custom -> In All Windows). This allows you to use Facebook but makes it significantly harder for them to track you across other sites (via shadow accounts or your actual profile). For example this works for Stackoverflow where I see: > The resource at “https://graph.facebook.com/[xxxx]/picture?type=large” https://graph.facebook.com/[xxxx]/picture?type=large” was blocked because content blocking is enabled. On mobile I simply don't install Facebook's apps and use the mobile web browser and still receive notifications via that.
- snthd 7y ago
  Alternatively there's https://facebookcorewwwi.onion https://facebookcorewwwi.onion
- Caligatio 7y ago
  I'm a huge fan of Firefox's first party isolation (FPI) and using Containers to control Google. FPI kills trackers and Containers allow me to stay logged into certain Google services without having things like my search history tracked.
  - gdulli 7y ago
    I was a huge fan too. I had a lot of containers set up on three different machines and they all got wiped out last week. I haven't put in all the work to rebuild them yet and I'm losing the wherewithal to keep putting up with Firefox.
    - ukyrgf 7y ago
      Yeah I lost my main container last week as well. Containers are okay, but, I wish they had their own database for things like saved passwords and addresses. I still end up using a separate profile for work, because I don't want _anything_ from work on my personal profile. Although, if entire container profiles can disappear with an update, that could be even more of a hassle.
Skyywalker 7y ago
Won't the privacy filterlists in uBlock Origin fix this?
- m463 7y ago
  You might like umatrix (same guy afaik). Change settings to load only first-party sites then unblock other sites as necessary.
  - klyrs 7y ago
    Yeah I love umatrix. Sometimes it's awful and it takes an extra few minutes to figure out the magic combination of things to allow. Sometimes it breaks a page altogether and I use an un-Matrix'd Chrome as a last resort (which I wipe after use). But I think it's worth the hassle.
- ldavison 7y ago
  They should. I use the Fanboy Anti-Facebook list (https://www.fanboy.co.nz/ https://www.fanboy.co.nz/) and the avatars from FB on SO don't load for me.
therufa 7y ago
Shame https://media.giphy.com/media/Ob7p7lDT99cd2/giphy.gif https://media.giphy.com/media/Ob7p7lDT99cd2/giphy.gif
lucb1e 7y ago
I like self hosted avatars. From the title I thought SO purposefully lets Facebook track us, perhaps through a like button, but instead the complaint is that they don't have a domain blacklist on user avatars, which sounds silly to me. I care about privacy but there are bigger fish to fry. This is not structural and hosting your own stuff (like your avatar) is a part of the old Internet I miss.
- dylan604 7y ago
  Is there a significant bandwidth advantage by allowing users to host their avatar image on 3rd party site rather than self-hosting it? I too am a believer in self-hosted content, but I don't have any site that gets any kind of traffic to worry about costs so I have no insight on if avatars add up to make this a thing.
pdjstone 7y ago
Seems like it would be a good idea to add crossorigin="anonymous" referrerpolicy="origin" attributes to user-provided images. This would prevent any 3rd party tracking or referrer leaking.
- amluto 7y ago
  One might reasonably argue that this should be the default.
  - sneak 7y ago
    The most popular browser is made by an ad targeting company. It would be foolish of them to enable this by default.
neilv 7y ago
Of course, most all Web sites add in third-party tracking through HTTP requests, in one way or another. Offhand, HN is the only site that comes to mind as not doing that. (I've been working on anti-tracking for a long time, and my current hand-edited ruleset has over 10k rules, which I usually have to look at multiple times each day.)
0xmohit 7y ago
Stack Overflow does not honor Do Not Track [0] and in response to a question [1] indicated that they don't intend to do that either. Tracking (including third-party tracking) seems like a feature. [0] https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track [1] https://meta.stackexchange.com/questions/237062/does-stack-exchange-have-an-official-policy-on-honoring-do-not-track-browser-s https://meta.stackexchange.com/questions/237062/does-stack-e...
- EpicEng 7y ago
  Almost no one does.
- variable11 7y ago
  Maybe an EU law will require sites to honor do not track or face stiff fines.
- emptysea 7y ago
  Safari has even removed Do Not Track because it can be used for fingerprinting. https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130299 https://developer.apple.com/documentation/safari_release_not...
- icebraining 7y ago
  > including third-party tracking I don't see how this follows. What does SO have to gain by allowing FB to track SO users? Just seems like laziness to me.
lone_haxx0r 7y ago
Install Privacy Badger. "Privacy Badger automatically learns to block invisible trackers." https://www.eff.org/privacybadger https://www.eff.org/privacybadger
drinane 7y ago
Just start saying really inappropriate things into the microphones that are not there... LOL
pixelrevision 7y ago
Firefox’s containers really should be a standard browser feature at this point.
baroffoos 7y ago
I noticed this last week in my umatrix blocked domains. Its pretty terrible. Hopefully this gets reverted and doesn't signify the downfall of stack exchange because its a super important resource on the internet.
fulldecent2 7y ago
What options does a Safari user have to prepare for war on the web?
- Nextgrid 7y ago
  While Safari lacks in certain features, it’s a reasonably mainstream browser which is a very good thing against browser fingerprinting. I use Safari combined with AdGuard to block cancer. It’s not perfect but I think it’s better than let’s say Firefox (you’d get more “blocking” power thanks to better extensions like uBlock Origin, but you get fingerprinted very easily by trackers that slip through the blocking).
neutrinoguy 7y ago
Collection of tools to protect privacy online. https://www.privacytools.io https://www.privacytools.io
Buetol 7y ago
That may be the "Microsoft buys GitHub" moment of StackOveflow: people realizing the power we gave to this private company and migrating to non-profit-managed website instead (like https://framagit.org https://framagit.org) But I do not see a good alternative to StackOverflow available now.

384 points by Thorondor 7y ago

eveningcoffee 7y ago

I believe that one day boycott will help them reconsider these practices.

xellisx 7y ago
"One day boycott" reads as if the boycott lasts one day and that's it, you are back to normal, using the site, getting tracked. So I don't think I would be too scared if I were a business.
- c0vfefe 7y ago
  Pretty sure they meant "one day a boycott."
- eveningcoffee 7y ago
  Yes, it does not work if it is not coordinated but if significant number of users stops the service at the same time then it will leave sizable tent in the revenue.
  - joaomacp 7y ago
    > sizable tent in the revenue. I'm sorry. http://imageenvision.com/450/24542-clip-art-graphic-of-a-flat-green-dollar-bill-cartoon-character-camping-with-a-tent-and-fire-by-toons4biz.jpg http://imageenvision.com/450/24542-clip-art-graphic-of-a-fla...
cwbrandsma 7y ago
are you talking about boycotting Stackoverflow or Facebook? I could reasonably boycott Facebook, sure. But the day Stackoverflow gets boycotted is the day no code gets written. /s
- Nextgrid 7y ago
  I know this is sarcasm but I’d like to add something anyway: I don’t know if it’s just experience or if the quality of non-Stackoverflow resources has increased but I find myself needing it less and less in the past couple years.
robertAngst 7y ago
I see this as 2 options- >If you don't like Facebook, get rid of it. I have. And I still have friends. >Let Facebook advertise really specific to you. Weirdly specific, it might be useful. * *might get blackmailed later if you were doing socially unacceptable things. But you could not participate in Facebook, the same company you are trying to avoid.
- JohnFen 7y ago
  > But you could not participate in Facebook That doesn't stop Facebook from tracking you, though. It only makes the tracking a bit coarser.

Someone1234 7y ago

I have a Facebook account, this creates limitations when it comes to blocking (e.g. I cannot use a DNS block/piHole). What I found works for me is to use Multi-Account Containers with Facebook being forced-open in a specific container (that's only for Facebook) and then using Firefox's built in Content Blocking to block trackers in other containers (Content Blocking -> Custom -> In All Windows). This allows you to use Facebook but makes it significantly harder for them to track you across other sites (via shadow accounts or your actual profile). For example this works for Stackoverflow where I see: > The resource at “https://graph.facebook.com/[xxxx]/picture?type=large” https://graph.facebook.com/[xxxx]/picture?type=large” was blocked because content blocking is enabled. On mobile I simply don't install Facebook's apps and use the mobile web browser and still receive notifications via that.

snthd 7y ago
Alternatively there's https://facebookcorewwwi.onion https://facebookcorewwwi.onion
Caligatio 7y ago
I'm a huge fan of Firefox's first party isolation (FPI) and using Containers to control Google. FPI kills trackers and Containers allow me to stay logged into certain Google services without having things like my search history tracked.
- gdulli 7y ago
  I was a huge fan too. I had a lot of containers set up on three different machines and they all got wiped out last week. I haven't put in all the work to rebuild them yet and I'm losing the wherewithal to keep putting up with Firefox.
  - ukyrgf 7y ago
    Yeah I lost my main container last week as well. Containers are okay, but, I wish they had their own database for things like saved passwords and addresses. I still end up using a separate profile for work, because I don't want _anything_ from work on my personal profile. Although, if entire container profiles can disappear with an update, that could be even more of a hassle.

Skyywalker 7y ago

Won't the privacy filterlists in uBlock Origin fix this?

m463 7y ago
You might like umatrix (same guy afaik). Change settings to load only first-party sites then unblock other sites as necessary.
- klyrs 7y ago
  Yeah I love umatrix. Sometimes it's awful and it takes an extra few minutes to figure out the magic combination of things to allow. Sometimes it breaks a page altogether and I use an un-Matrix'd Chrome as a last resort (which I wipe after use). But I think it's worth the hassle.
ldavison 7y ago
They should. I use the Fanboy Anti-Facebook list (https://www.fanboy.co.nz/ https://www.fanboy.co.nz/) and the avatars from FB on SO don't load for me.

therufa 7y ago

Shame https://media.giphy.com/media/Ob7p7lDT99cd2/giphy.gif https://media.giphy.com/media/Ob7p7lDT99cd2/giphy.gif

lucb1e 7y ago

I like self hosted avatars. From the title I thought SO purposefully lets Facebook track us, perhaps through a like button, but instead the complaint is that they don't have a domain blacklist on user avatars, which sounds silly to me. I care about privacy but there are bigger fish to fry. This is not structural and hosting your own stuff (like your avatar) is a part of the old Internet I miss.

dylan604 7y ago
Is there a significant bandwidth advantage by allowing users to host their avatar image on 3rd party site rather than self-hosting it? I too am a believer in self-hosted content, but I don't have any site that gets any kind of traffic to worry about costs so I have no insight on if avatars add up to make this a thing.

pdjstone 7y ago

Seems like it would be a good idea to add crossorigin="anonymous" referrerpolicy="origin" attributes to user-provided images. This would prevent any 3rd party tracking or referrer leaking.

amluto 7y ago
One might reasonably argue that this should be the default.
- sneak 7y ago
  The most popular browser is made by an ad targeting company. It would be foolish of them to enable this by default.

neilv 7y ago

Of course, most all Web sites add in third-party tracking through HTTP requests, in one way or another. Offhand, HN is the only site that comes to mind as not doing that. (I've been working on anti-tracking for a long time, and my current hand-edited ruleset has over 10k rules, which I usually have to look at multiple times each day.)

0xmohit 7y ago

Stack Overflow does not honor Do Not Track [0] and in response to a question [1] indicated that they don't intend to do that either. Tracking (including third-party tracking) seems like a feature. [0] https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track [1] https://meta.stackexchange.com/questions/237062/does-stack-exchange-have-an-official-policy-on-honoring-do-not-track-browser-s https://meta.stackexchange.com/questions/237062/does-stack-e...

EpicEng 7y ago
Almost no one does.
variable11 7y ago
Maybe an EU law will require sites to honor do not track or face stiff fines.
emptysea 7y ago
Safari has even removed Do Not Track because it can be used for fingerprinting. https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130299 https://developer.apple.com/documentation/safari_release_not...
icebraining 7y ago
> including third-party tracking I don't see how this follows. What does SO have to gain by allowing FB to track SO users? Just seems like laziness to me.

lone_haxx0r 7y ago

Install Privacy Badger. "Privacy Badger automatically learns to block invisible trackers." https://www.eff.org/privacybadger https://www.eff.org/privacybadger

drinane 7y ago

Just start saying really inappropriate things into the microphones that are not there... LOL

pixelrevision 7y ago

Firefox’s containers really should be a standard browser feature at this point.

baroffoos 7y ago

I noticed this last week in my umatrix blocked domains. Its pretty terrible. Hopefully this gets reverted and doesn't signify the downfall of stack exchange because its a super important resource on the internet.

fulldecent2 7y ago

What options does a Safari user have to prepare for war on the web?

Nextgrid 7y ago
While Safari lacks in certain features, it’s a reasonably mainstream browser which is a very good thing against browser fingerprinting. I use Safari combined with AdGuard to block cancer. It’s not perfect but I think it’s better than let’s say Firefox (you’d get more “blocking” power thanks to better extensions like uBlock Origin, but you get fingerprinted very easily by trackers that slip through the blocking).

neutrinoguy 7y ago

Collection of tools to protect privacy online. https://www.privacytools.io https://www.privacytools.io

Buetol 7y ago

That may be the "Microsoft buys GitHub" moment of StackOveflow: people realizing the power we gave to this private company and migrating to non-profit-managed website instead (like https://framagit.org https://framagit.org) But I do not see a good alternative to StackOverflow available now.