5 ms·

Given their tracking pixels are installed on at least 8 million websites(1), they are effectively watching everything you do on a large proportion of popular/co

Given their tracking pixels are installed on at least 8 million websites(1), they are effectively watching everything you do on a large proportion of popular/commercial websites. They were also caught a few years ago asking users to "verify their emails" by providing Facebook their email account password(2), after which FB's servers logged into the user's email account and scraped their contacts out without warning. They also acquired a popular VPN app explicitly so they could comb through the users' traffic data and identify competing apps for acquisition.(3) In my opinion it's core to how the company has always been. Facebook's predecessor, or perhaps first iteration, FaceMash, was a hot-or-not game based on student photos scraped from Harvard's internal websites(4). [1] https://theoutline.com/post/4578/facebook-is-tracking-you-on-over-8-million-websites?zd=1&zi=jgbzi7gu https://theoutline.com/post/4578/facebook-is-tracking-you-on... [2] https://www.theverge.com/2019/4/18/18485089/facebook-email-password-contacts-upload-1-5-million-security-cybersecurity https://www.theverge.com/2019/4/18/18485089/facebook-email-p... [3] https://techcrunch.com/2019/02/21/facebook-removes-onavo/ https://techcrunch.com/2019/02/21/facebook-removes-onavo/ [4] https://www.thecrimson.com/article/2003/11/19/facemash-creator-survives-ad-board-the/ https://www.thecrimson.com/article/2003/11/19/facemash-creat...

ccktlmazeltov 6y ago
the pixel is installed by web developers, the same way google analytics or any script is setup on a website.
- aeternum 6y ago
  Which makes it even worse. At least with the extension the user is deciding to install it. In the webpage case, the web developer is choosing to provide the user's data to Facebook or Google (without the user's consent). The vast majority of people don't even understand how this works and think that Facebook can only see activity performed on Facebook itself.
  - ccktlmazeltov 6y ago
    Yes, but thinking that it's a specific issue is misguided. This is how the web works and it is extremely hard to change it. By default you do send your IP, and other metadata, to a server who can do whatever they want with it. You can either refuse this reality and try to invent a new set of internet protocols, or try to fix them on the client-side with VPNs and browsers that randomize metadata, etc. Not super practical though.
ciarannolan 6y ago
> They were also caught a few years ago asking users to "verify their emails" by providing Facebook their email account password(2), after which FB's servers logged into the user's email account and scraped their contacts out without warning. Why aren't developers in jail for this? Breaking into someone's email account and exfiltrating their data - disgusting. Clicking "OK" on a 500 page ToS doesn't get you out of this. I'm so sick of this criminal behavior being brushed off as "growth hacking", "move fast and break things", or some other bullshit. The people creating this garbage should feel some shame and face real consequences.

ccktlmazeltov 6y ago

the pixel is installed by web developers, the same way google analytics or any script is setup on a website.

aeternum 6y ago
Which makes it even worse. At least with the extension the user is deciding to install it. In the webpage case, the web developer is choosing to provide the user's data to Facebook or Google (without the user's consent). The vast majority of people don't even understand how this works and think that Facebook can only see activity performed on Facebook itself.
- ccktlmazeltov 6y ago
  Yes, but thinking that it's a specific issue is misguided. This is how the web works and it is extremely hard to change it. By default you do send your IP, and other metadata, to a server who can do whatever they want with it. You can either refuse this reality and try to invent a new set of internet protocols, or try to fix them on the client-side with VPNs and browsers that randomize metadata, etc. Not super practical though.

ciarannolan 6y ago

> They were also caught a few years ago asking users to "verify their emails" by providing Facebook their email account password(2), after which FB's servers logged into the user's email account and scraped their contacts out without warning. Why aren't developers in jail for this? Breaking into someone's email account and exfiltrating their data - disgusting. Clicking "OK" on a 500 page ToS doesn't get you out of this. I'm so sick of this criminal behavior being brushed off as "growth hacking", "move fast and break things", or some other bullshit. The people creating this garbage should feel some shame and face real consequences.