3 ms·

Did Backblaze ever issue an explanation for that?

kbaker 6y ago
Write up here. Accidentally added the Facebook pixel to all pages instead of the marketing pages. https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr...
- ethbr0 6y ago
  If you want to nail a company to the cross for being in bed with Facebook... Backblaze probably shouldn't be at the top of your naughty list. IMHO, over-ado about a small something. "A new campaign was launched beginning on March 8, 2021 on the marketing web pages using Google Tag Manager which included the Facebook pixel. That new campaign resulted in the Facebook advertising pixel being accidentally configured in Google Tag Manager to run on all platform pages instead of just the marketing web pages." "We’ve confirmed that there was only a single page (b2_browse_files2.htm) where the Facebook advertising pixel had the ability to access certain metadata. We tested this on Chrome, Safari, Firefox, and Edge. Our investigation determined that 9,245 users visited that page during the window when the Facebook campaign was active (March 8 at 12:39 p.m. Pacific time, through March 21st at 11:19 p.m. Pacific time when we removed the offending code)." "If users were browsing their B2 Cloud Storage files on b2_browse_files2.htm during that period, AND clicked to preview file information, then the Facebook pixel pulled the following metadata: folder/file name, folder/file size, and the date the folder/file was uploaded. The folder/file metadata was limited to file information that was currently loaded in the browser. No actual files or file contents were shared at any time. The data that was pulled did not include any user account information."
  - AnonC 6y ago
    In previous threads about this leak, commenters gave examples of how exposing filenames could be harmful to certain classes of paying customers. It is not a small thing by any stretch of imagination.
    - ethbr0 6y ago
      To me, 13 days of inadvertent use, followed by immediate removal, is a small thing. Your imagination may stretch differently.
    - philjohn 6y ago
      Then those users probably shouldn't be using something with servers in the US that can be accessed with a court order. They should backup to an offsite store they have full control over.
- deleted 6y ago
  [deleted]
shakna 6y ago
The official response from Backblaze is here [0]. > We use Google Tag Manager to help deploy key third-party code in a streamlined fashion. The Google Tag Manager implementation includes a Facebook trigger. On March 8, 2021 at 12:39 p.m. Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages. [0] https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr...
- brightball 6y ago
  I can see how that can happen. The moment that GTM was pushed for at my last company it made me really uncomfortable but ultimately got pushed through. I wish it had a built in process for review and approval. It looks like it does but the permissions are so frustrating to use that it just becomes overly permissive as a side effect.

Write up here. Accidentally added the Facebook pixel to all pages instead of the marketing pages. https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr...

ethbr0 6y ago
If you want to nail a company to the cross for being in bed with Facebook... Backblaze probably shouldn't be at the top of your naughty list. IMHO, over-ado about a small something. "A new campaign was launched beginning on March 8, 2021 on the marketing web pages using Google Tag Manager which included the Facebook pixel. That new campaign resulted in the Facebook advertising pixel being accidentally configured in Google Tag Manager to run on all platform pages instead of just the marketing web pages." "We’ve confirmed that there was only a single page (b2_browse_files2.htm) where the Facebook advertising pixel had the ability to access certain metadata. We tested this on Chrome, Safari, Firefox, and Edge. Our investigation determined that 9,245 users visited that page during the window when the Facebook campaign was active (March 8 at 12:39 p.m. Pacific time, through March 21st at 11:19 p.m. Pacific time when we removed the offending code)." "If users were browsing their B2 Cloud Storage files on b2_browse_files2.htm during that period, AND clicked to preview file information, then the Facebook pixel pulled the following metadata: folder/file name, folder/file size, and the date the folder/file was uploaded. The folder/file metadata was limited to file information that was currently loaded in the browser. No actual files or file contents were shared at any time. The data that was pulled did not include any user account information."
- AnonC 6y ago
  In previous threads about this leak, commenters gave examples of how exposing filenames could be harmful to certain classes of paying customers. It is not a small thing by any stretch of imagination.
  - ethbr0 6y ago
    To me, 13 days of inadvertent use, followed by immediate removal, is a small thing. Your imagination may stretch differently.
  - philjohn 6y ago
    Then those users probably shouldn't be using something with servers in the US that can be accessed with a court order. They should backup to an offsite store they have full control over.
deleted 6y ago
[deleted]

shakna 6y ago

The official response from Backblaze is here [0]. > We use Google Tag Manager to help deploy key third-party code in a streamlined fashion. The Google Tag Manager implementation includes a Facebook trigger. On March 8, 2021 at 12:39 p.m. Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages. [0] https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr...

brightball 6y ago
I can see how that can happen. The moment that GTM was pushed for at my last company it made me really uncomfortable but ultimately got pushed through. I wish it had a built in process for review and approval. It looks like it does but the permissions are so frustrating to use that it just becomes overly permissive as a side effect.