7 ms·

Why staying logged in to your FB/Twitter is dangerous

46 points by finebanana 15y ago

The seemingly harmless "Like" & "Tweet This" button on the websites you visited can be used to track your browsing habit even if you never click on them

lordlarm 15y ago
Link to original story: http://online.wsj.com/article/SB10001424052748704281504576329441432995616.html http://online.wsj.com/article/SB1000142405274870428150457632...
jbk 15y ago
It's not really "dangerous", it is just that you give a bit more information to FB/Twitter/$SocialCompany than you thought you would. While, I usually logout of FB or Twitter, I have a few adblock rules to block them on other webpages. It works fairly well... If I want to like and share, I believe I can do it manually...
- yuhong 15y ago
  One reason it can be dangerous is that not all of them use HTTPS. And hopefully you know what Firesheep is by now.
- kanak 15y ago
  You could add the EasyPrivacy list ( http://easylist.adblockplus.org/en/ http://easylist.adblockplus.org/en/ ) to your adblock subscription.
  - jbk 15y ago
    Many thanks, I didn't know about this one.
- lukejduncan 15y ago
  From what I gathered in the article, logging out doesn't solve the problem. The cookie works if you've logged in anytime in the last month
  - code_duck 15y ago
    Also, Facebook uses a Flash LSO. You have to clear that to really be logged out.
    - jbk 15y ago
      I don't have Flash :D
  - jbk 15y ago
    Which is why I said that I used adblockplus rules for this.
edoloughlin 15y ago
This doesn't seem to be the full story. If I log out of FB I still have multiple cookies for the .facebook.com domain (e.g., c_user, which seems to contain my user id). The like/comment/etc. 'widgets' are served from facebook.com, so presumably they are still tracking me. Don't know why this article didn't mention Ghostery or http://disconnect.me http://disconnect.me
- wladimir 15y ago
  You could also use multiple profiles (at least in Firefox), one for browsing around and one for social network sites. In that case there will be guaranteed no cookie cross-pollution as the sites are completely isolated from each other. Just logging out is indeed simply ineffective.
  - RexRollman 15y ago
    My wife is a Google Chrome user and she logs into Facebook and Twitter in an incognito window. Everything else she does in a regular Chrome window (which is set to delete all cookie when the browser is turned off). Another option would be to install a second browser and use it solely for FB/Twitter.
  - code_duck 15y ago
    If only... Facebook uses a Flash LSO, which is of course shared between browsers.
    - wladimir 15y ago
      "of course shared between browsers" Is it? Are saying that the flash crap doesn't distinguish between browsers/profiles? That's another very bad security problem with flash. For me, it's the final straw. I'm going to wipe flash from all my machines now.
- nikcub 15y ago
  Brian Kennish, who is mentioned in the story, is the author of disconnect. He helped the WSJ do the research, here is the original article: http://online.wsj.com/article/SB10001424052748704281504576329441432995616.html http://online.wsj.com/article/SB1000142405274870428150457632... for some reason the Y! version trimmed some parts of the story
pstack 15y ago
They couldn't have published a more obvious story. Anyone with any sense doesn't log into either service and you don't need to be logged into either service for them to track you. It's amazing what freely available information (your IP, the sites you visit, etc) can do to help turn you from an aggregate anonymous identity into a fairly well "guessed" identity. And since webmasters carelessly litter their sites with this third party crap, they can build up a significant database of the places you've visisted and your habits, without knowing much else about you. The first thing I did when Facebook rolled out all of that garbage was redirect everything facebook related to localhost and then created adblock/element rules to filter out all twitter and facebook buttons, tags, etc. I even filter out the whole "facebook discussions" crap that are attached to seemingly 80% of pages, these days. Then again, I guess the public lags behind such things. I'm sure there are people out there just today learning what a cookie is, so . . . ~shrug~
- finebanana 15y ago
  Yeah, most people would think that those buttons on the sites they've visited won't do anything unless they click on it. So yes, this is an obvious story to some, but also a "why didn't I think of that!" moment for the rest. just sayin. ;)
  - RexRollman 15y ago
    I have to agree. A vast majority of people don't know about this, and the one who I have mentioned this to don't seem to even care.
- raganwald 15y ago
  I agree with the other commenters that "common sense is remarkably uncommon." Yes, once you've grasped how web cookies and iframes and other mechanisms can be combined to track you across web sites, it is obvious that Facebook can track you even if you don't click the "like" button. But most people don't have this level of understanding, and I'd say that Facebook goes out of their way to make this non-obvious. So yes, you're right, but also yes, this type of article is relevant. You probably read something like this once, and it was a revelation for you. Now others are getting their tall, cool, glass of reality. No idea why you're getting downvotes, unless people equate your comments slightly dismissive tone with being non-contributory. Personally, I've seen far worse, and you have some useful tips embedded in the comments, so as far as I'm concerned your comment is a win. Thanks. You might want to consider amplifying on your methods of maintaining your privacy, others may find a more detailed set of instructions helpful.
compay 15y ago
Ironically, the article's header has Facebook "Recommend" and Twitter "Tweet" buttons. The Facebook one has 4,000 "likes" and the Twitter one has 235 Tweets.

46 points by finebanana 15y ago

The seemingly harmless "Like" & "Tweet This" button on the websites you visited can be used to track your browsing habit even if you never click on them

lordlarm 15y ago

Link to original story: http://online.wsj.com/article/SB10001424052748704281504576329441432995616.html http://online.wsj.com/article/SB1000142405274870428150457632...

jbk 15y ago

It's not really "dangerous", it is just that you give a bit more information to FB/Twitter/$SocialCompany than you thought you would. While, I usually logout of FB or Twitter, I have a few adblock rules to block them on other webpages. It works fairly well... If I want to like and share, I believe I can do it manually...

yuhong 15y ago
One reason it can be dangerous is that not all of them use HTTPS. And hopefully you know what Firesheep is by now.
kanak 15y ago
You could add the EasyPrivacy list ( http://easylist.adblockplus.org/en/ http://easylist.adblockplus.org/en/ ) to your adblock subscription.
- jbk 15y ago
  Many thanks, I didn't know about this one.
lukejduncan 15y ago
From what I gathered in the article, logging out doesn't solve the problem. The cookie works if you've logged in anytime in the last month
- code_duck 15y ago
  Also, Facebook uses a Flash LSO. You have to clear that to really be logged out.
  - jbk 15y ago
    I don't have Flash :D
- jbk 15y ago
  Which is why I said that I used adblockplus rules for this.

edoloughlin 15y ago

This doesn't seem to be the full story. If I log out of FB I still have multiple cookies for the .facebook.com domain (e.g., c_user, which seems to contain my user id). The like/comment/etc. 'widgets' are served from facebook.com, so presumably they are still tracking me. Don't know why this article didn't mention Ghostery or http://disconnect.me http://disconnect.me

wladimir 15y ago
You could also use multiple profiles (at least in Firefox), one for browsing around and one for social network sites. In that case there will be guaranteed no cookie cross-pollution as the sites are completely isolated from each other. Just logging out is indeed simply ineffective.
- RexRollman 15y ago
  My wife is a Google Chrome user and she logs into Facebook and Twitter in an incognito window. Everything else she does in a regular Chrome window (which is set to delete all cookie when the browser is turned off). Another option would be to install a second browser and use it solely for FB/Twitter.
- code_duck 15y ago
  If only... Facebook uses a Flash LSO, which is of course shared between browsers.
  - wladimir 15y ago
    "of course shared between browsers" Is it? Are saying that the flash crap doesn't distinguish between browsers/profiles? That's another very bad security problem with flash. For me, it's the final straw. I'm going to wipe flash from all my machines now.
nikcub 15y ago
Brian Kennish, who is mentioned in the story, is the author of disconnect. He helped the WSJ do the research, here is the original article: http://online.wsj.com/article/SB10001424052748704281504576329441432995616.html http://online.wsj.com/article/SB1000142405274870428150457632... for some reason the Y! version trimmed some parts of the story

pstack 15y ago

They couldn't have published a more obvious story. Anyone with any sense doesn't log into either service and you don't need to be logged into either service for them to track you. It's amazing what freely available information (your IP, the sites you visit, etc) can do to help turn you from an aggregate anonymous identity into a fairly well "guessed" identity. And since webmasters carelessly litter their sites with this third party crap, they can build up a significant database of the places you've visisted and your habits, without knowing much else about you. The first thing I did when Facebook rolled out all of that garbage was redirect everything facebook related to localhost and then created adblock/element rules to filter out all twitter and facebook buttons, tags, etc. I even filter out the whole "facebook discussions" crap that are attached to seemingly 80% of pages, these days. Then again, I guess the public lags behind such things. I'm sure there are people out there just today learning what a cookie is, so . . . ~shrug~

finebanana 15y ago
Yeah, most people would think that those buttons on the sites they've visited won't do anything unless they click on it. So yes, this is an obvious story to some, but also a "why didn't I think of that!" moment for the rest. just sayin. ;)
- RexRollman 15y ago
  I have to agree. A vast majority of people don't know about this, and the one who I have mentioned this to don't seem to even care.
raganwald 15y ago
I agree with the other commenters that "common sense is remarkably uncommon." Yes, once you've grasped how web cookies and iframes and other mechanisms can be combined to track you across web sites, it is obvious that Facebook can track you even if you don't click the "like" button. But most people don't have this level of understanding, and I'd say that Facebook goes out of their way to make this non-obvious. So yes, you're right, but also yes, this type of article is relevant. You probably read something like this once, and it was a revelation for you. Now others are getting their tall, cool, glass of reality. No idea why you're getting downvotes, unless people equate your comments slightly dismissive tone with being non-contributory. Personally, I've seen far worse, and you have some useful tips embedded in the comments, so as far as I'm concerned your comment is a win. Thanks. You might want to consider amplifying on your methods of maintaining your privacy, others may find a more detailed set of instructions helpful.

compay 15y ago

Ironically, the article's header has Facebook "Recommend" and Twitter "Tweet" buttons. The Facebook one has 4,000 "likes" and the Twitter one has 235 Tweets.