10 ms·

Facebook doesn't like privacy countermeasures

346 points by xentronium 15y ago

jeza 15y ago
Apparently it's more of a copyright issue than the 2-click process. They don't like their logo being used on a locally hosted image. So heise.de made the button more generic and it's all good now.
- gurkendoktor 15y ago
  Are you pointing out that this is what they are saying, or do you believe that? The worst thing that could happen before is that Facebook would change their CI and the button would be outdated, looking dated. Now the button looks crappy from the start.
  - jeza 15y ago
    That's my interpretation of the following update posted by the original source (heise.de): "[2. Update: Mittlerweile äußerte sich erneut Tina Kulow von Facebook Deutschland. In einem Tweet schrieb sie: "Um es klar zu stellen: 2-klick-Button ist nicht ideal - aber kein Problem. Nur ein Like-Button der grafisch so tut als ob er einer ist, ist nicht ok. Das ist alles." Nachdem heise online dem Button für den ersten Click, der die Like-Funktion aktiviert, ein verändertes Design gegeben hat, sollte demnach der weiteren Nutzung des 2-Click-Buttons durch heise online und andere Websites auch von Seiten Facebooks nichts mehr im Wege stehen.] (ju) " So it says the two click button is not ideal, but not a problem. Though the graphic on the Like-Button is not okay, and so on.
slowpoke 15y ago
If it hadn't occurred to you yet that Facebook cares far more about the "Like" buttons that you don't click than about the ones that you do -- there you go. I've been telling this to people since ages. These stupid Like buttons are an infestation, and exactly the reason why I care so much about Facebook's privacy policies despite not being registered on it - it's just not as simple as "not having an account". This goes for the other networks, too, by the way. Besides, this solution with the two clicks is very clever, and privacy friendly. In addition, it speeds up page loading. It speaks for itself that the only measure Facebook has is trying to sue with a very broadly formulated policy, which I doubt applies in this case anyways: if such use could confuse users into thinking that the reference is to Facebook features or functionality. Well duh, it is a Facebook feature/functionality.
maeon3 15y ago
I forgot how when I click a like button on a foreign page, face book is keeping data about what pages I am visiting and (who,what,when,where,how) and is selling that click data about me to the highest bidder (and I cant turn it off) to advertisers or worse government agencies doing warrent-less surveillance. I'm never clicking a facebook like button again until I can turn off user website tracking.
- rlpb 15y ago
  You don't even need to click the like button. Facebook get the information as soon as you view the foreign page.
  - hbar 15y ago
    If you use Chrome(-ium), there's an extension for that. I believe there is an equivalent FF extension out there as well. https://chrome.google.com/webstore/detail/ejpepffjfmamnambagiibghpglaidiec https://chrome.google.com/webstore/detail/ejpepffjfmamnambag...
- FJCruiser79 15y ago
  By 'selling that click data about me' you realize that the only monetization tool Facebook has is a anonymized and aggregated ads tool...it doesn't sell click data.
  - igy 15y ago
    I find there's a general perception (especially Slashdot) that this isn't the case, I'm not sure why given that Facebook's been fairly explicit about it in the past
- code_duck 15y ago
  People, including myself, seem to forget that Google has a far more pervasive network that has been operating for much longer.
yuvadam 15y ago
Friendly reminder, blocking all and any of Facebook's pre-click tracking measures can be implemented easily in AdBlock Plus (or any equivalent ad blocker) with the following rules: ||facebook.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||facebook.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||fbcdn.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||fbcdn.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
- Estragon 15y ago
  Corresponding blocks are already in the EasyPrivacy list. https://easylist-downloads.adblockplus.org/easyprivacy.txt https://easylist-downloads.adblockplus.org/easyprivacy.txt
  - beaumartinez 15y ago
    I don't think they're as comprehensive. Regarding Facebook, it only has ||facebook.com/campaign/impression.php? ||facebook.com/js/conversions/tracking.js ||pixel.facebook.com^
- mike-cardwell 15y ago
  Also worth noting that Firefox users who prefer the idea of whitelisting cross-site requests rather than blacklisting them, can install RequestPolicy.
  - divtxt 15y ago
    Does anyone know the equivalent Chrome extension?
    - nikcub 15y ago
      I am working on it here: http://www.github.com/nikcub/parley http://www.github.com/nikcub/parley I will have a new version out at the end of this weekend I think it is time to kill all third-party requests. If you want to show users an ad, host it from your own server.
RexRollman 15y ago
Facebook is detestable. Just like its founder.
rickmb 15y ago
Facebook better wake up and realize that especially thanks to companies like them and their failure to self-regulate and respect privacy values outside the US, using Like-buttons for tracking is likely to become illegal in the EU and many other places in the next five years. Technically, one could argue that they already violate existing laws, but incidents like these will make absolutely sure that these practices will be explicitly outlawed very soon. It keeps surprising me how companies like Facebook and Google seem to be oblivious to the way privacy is perceived elsewhere, and are actively provoking stricter legislation than would be the case if they showed some respect. There is absolutely no question about these tracking practices being perceived as ethically unacceptable in many countries, so why provoke both negative publicity and legislation that is likely to handicap less intrusive solutions as well?
- doki_pen 15y ago
  Google claims that they do not use or keep this information for anything. When they talk about for debugging purposes, they probably mean their web access logs. http://www.google.com/support/+/bin/static.py?page=guide.cs&guide=1207011&answer=1319578 http://www.google.com/support/+/bin/static.py?page=guide.cs&...
- mypov 15y ago
  I would like to add that contrary to your impression we too value privacy in USA.
  - _delirium 15y ago
    To some extent, though we've been less active in doing anything about it. In part we tend to be less keen than Europeans on having the government regulate these kinds of things, but the various private-sector and non-profit initiatives (like TRUSTe) that are supposed to fill the gap have been fairly ineffectual.
    - alexqgb 15y ago
      Unlike Germans - who had the Statsi to contend with, and before that the SS - Americans have never been exposed to a genuine, law-unto-itself, every-phoneline-tapped, free-to-kidnap-torture-and-kill secret police force. One of the clearest lessons learned is that once these things take root, they are incredibly hard to dislodge. When they do go, it's only due to truly cataclysmic change. What naive Americans may regard as absurd hyper-sensitivity or a hopeless lack of technical sophistication is often an acute awareness that never letting it happen again means banning a lot of stuff that young innocents casually dismiss "as just being how the internet works". Evgeny Morozov (author of "The Net Delusion" http://amzn.to/nOOxzQ http://amzn.to/nOOxzQ) observes that casual openness is exactly how the web can be used to work against you. He makes the point that while folks safely ensconced in California should be grateful for their freedom from truly abusive government, they should also be a lot more sensitive to the concerns - and outright trauma - still found in places that haven't been so lucky. Of course, I'm over-simplifying his argument a bit. If you want a more complete (and much more entertaining) introduction, RSA did an especially good animation of a talk he gave, which you can see here: http://www.youtube.com/watch?v=Uk8x3V-sUgU http://www.youtube.com/watch?v=Uk8x3V-sUgU
deleted 15y ago
[deleted]
bryogenic 15y ago
A simple solution to this would be to not use facebook icons for your first click image. So maybe a simple 'social share' icon that brings up all the sharing options and at the same time loads the traditional facebook like button.
eloisius 15y ago
Not sure how great it works because I only sought it out after reading this, but here's Facebook Disconnect for Chrome. https://chrome.google.com/webstore/detail/ejpepffjfmamnambagiibghpglaidiec https://chrome.google.com/webstore/detail/ejpepffjfmamnambag...
blahedo 15y ago
I'm glad this came up to make me think about it more; I'd already gotten in the habit of logging out of FB except when actively viewing the feed, for precisely this reason---I didn't want FB tracking me across browsing other sites. (The FB-hosted comment systems were actually the proximate worry, as well as the Like button.) But that was my half-thought-through answer. Of course they're perfectly able to track me even without being logged in.[0] So the real answer is I need to be sure I'm not loading cross-site img and iframes... My Omniweb install I'd already configured to do that, but setting up proper privacy countermeasures on my Firefox install just jumped way up the priority list. [0] http://panopticlick.eff.org/ http://panopticlick.eff.org/
- alextingle 15y ago
  I just use a totally different browser for Facebook.
  - hautemechanic 15y ago
    This doesn't help as much as you'd hope. When you are using your non-FB browser and visit a website with the FB buttons installed, FB gets click data about you. You need to use a blocking extension in your non-FB browser in order to effectively implement your technique.
- spc476 15y ago
  I used to do that. I also started deleting any Facebook cookies before logging into Facebook, and after logging out of Facebook. I then realized that was stupid, because I have a static IP address (helps with my job, which requires remotely logging into servers). With Facebook cookies everywhere, you don't need to be logged in for them to track you. And in my case, even if I used a different browser for logging into Facebook, they could (in theory---I have no idea if they actually do this or not) still track me based on the IP address alone. Google is just as scary. A few months ago I did a few searches for local casinos (I was helping a friend of mine get a job at one) and now, I see ads for casinos on about a third of the webpages I visit. It's most annoying, and quite scary when I think about it too much.
Xuzz 15y ago
Before we spend too much time attacking Facebook over this, let's try and think of possible reasons why this might be not an "evil" move. No need to go out of our way to conclude "omg they're evil stealing our privacy". Firstly, what if they just don't want to confuse users? I see people confused all the time of when you need to click and when you need to double-click, every time I see someone using the computer — I'm sure I do this myself, too. What does allowing someone to introduce uncertainty as to what's required here do, especially when their click-through buttons look just like Facebook's normal ones on other sites? I'd say it'd just confuse people. I don't have an issue with Facebook doing that, I'd actually rather have them enforce, this, so you know what is going on when you see a standard Like button. (As a few other comments have noted, just replacing the button with a custom-styled one would solve this issue. It'd also solve user confusion, since it no longer appears to be Facebook requiring a double click.) So, maybe they're not just after destroying privacy, after all? Maybe? (I don't work for Facebook, or even know anyone who does. I just like to try and see both sides of something like this.)
- slowpoke 15y ago
  I just like to try and see both sides of something like this. While I can certainly agree to that general notion, in Facebook's case that's simply a bit too stretched. I find it pretty hard - if not impossible - to assume honest intentions regarding these cases from a corporations whose founder openly opposes privacy and considers it "obsolete".
doki_pen 15y ago
Is this really just a facebook problem? Isn't it a problem for any client side service that is used across the web? Analytics packages, ad software, value add stuff like disqus, etc.
pacemkr 15y ago
Don't use the Like button. There, problem solved. If your startup isn't social and free, it isn't hip. If you don't have a Facebook page and seven shades of "Like" buttons, you are destroying your business. Just stop. Stop putting that social media flare (crap) on your website. Your users don't care, because sharing a link is not an unsolved problem.
jcfrei 15y ago
what about the like buttons on techcrunch? they only load if you hover over them as well.
- lukejduncan 15y ago
  techcrunch uses a custom image for their preloaded button
thedjpetersen 15y ago
I was surprised to find out that Facebook tracks not only what 'like' buttons you have been clicking but also where you have been browsing. Is there a privacy browser extension?
- ordinary 15y ago
  For Firefox, RequestPolicy adds a whitelist for requests to third-party websites. It's a hassle to set up, but it works. I don't know if an equivalent exists for Chrome.
  - waqf 15y ago
    Re Chrome, see http://news.ycombinator.com/item?id=2957201 http://news.ycombinator.com/item?id=2957201
- brokentone 15y ago
  Disconnect for Chrome is great, but it only blocks a limited number of social sites.
Sigi 15y ago
A possibly related note: I use two browsers to browse the web in an attempt to protect my privacy (as futile as it seems to be); one is logged in to google, and the other is not. When using the browser that is logged in, I get 15 "+1"s for google like-like button. however, when using the other browser that's not logged in, I get 0 "+1"s. Can anyone explain?
rudiger 15y ago
Is there an open-source implementation of this two-click system for Facebook's Like button (and others like Google's +1 and Twitter's tweet button)?
- blauwbilgorgel 15y ago
  I often use a simple (button image) link to twitter.com/share or facebook.com/sharer.php (now http://developers.facebook.com/docs/reference/dialogs/ http://developers.facebook.com/docs/reference/dialogs/). That is one-click without javascript execution or, worse IMO, company custom html tags. AFAIK Google+1 doesn't, as of yet, have such an URL where you can share. Sharing seems to go through the +1 button. I'd really like a share url for Google+ for technical and privacy reasons and keep everything one-click to share. I bet you could make a two-click system for the Google+1 button, now asynchronous javaScript loading is enabled, but I don't know if that is within TOS. Again I would love a simple share link (like Linkedin, Facebook or Twitter) and be done with it. I know that sharing on Facebook is different from liking, but I feel sharing is more valuable from a marketing POV.
- mason2 15y ago
  For Firefox there's an add-on, take a look: https://addons.mozilla.org/en-US/firefox/addon/2-click-like/ https://addons.mozilla.org/en-US/firefox/addon/2-click-like/ It supports five or six like buttons.
thelovelyfish 15y ago
Facebook, google, all these other giant technology firms... They will be looked back on in the future as ruthless opportunists doing their best to take advantage of the public with technology before anyone can figure out what they're doing and stop them. The world is not some cute friendly little place. It is equally as barbarous today as it was in the dark ages. The TVs have convinced everyone otherwise it seems. Evil people are using machines to take over the world. http://www.youtube.com/watch?v=z9RiRfMYVlQ&feature=channel_video_title http://www.youtube.com/watch?v=z9RiRfMYVlQ&feature=chann...
cletus 15y ago
This is a non-story for the reasons stated but a story for other reasons. It's standard that widget publishers require to use their widget "as is". That's basically what Facebook is saying. Not only do you not know what any custom modifications will necessarily do but it's a completely valid argument that you want a consistent user experience with your widget. As for user tracking, this is basically an inevitable byproduct of Facebook hosting the widget, a situation I'm sure they're not unhappy about, but this really isn't a big deal in the context of how the Web works. The story here (IMHO) is trust. Most pages have a Google Analytics tracking script on them. Do you trust Google? I do (disclaimer: I work for Google). Protecting user data and privacy are key priorities here. It's why Google+ has relatively simple privacy controls and allows you to export your data at any time. Do you trust Facebook? I don't. Then again, there aren't many companies I do trust. But Facebook's track record seems to be to befuddle the user and trick or opt them into sharing things wider than they understand or want.
- alnayyir 15y ago
  So when are you guys going to back up the openness propaganda and open source something of substance other than protobuf?
- nikcub 15y ago
  > But Facebook's track record seems to be to befuddle the user and trick or opt them into sharing things wider than they understand or want. Just like Google did with Buzz That was such a clusterfuck that for most people Google is in the same bucket as Facebook when it comes to 'caring about user privacy'
  - alexqgb 15y ago
    I never considered any of FB privacy curtailments to be 'clusterfucks' in the sense that they involved Buzz-level incompetence, bad planning, or lack of foresight. To the contrary, I always felt FB knew exactly what it was doing, and was operating in a very calculated way. Three steps forward and (maybe) one step back.
    - 15y ago
baby 15y ago
I was doing it on my website, I never had any problems with facebook. Actually, I had other problems with them, and what they did is just plainly banned my application and blocked my website from using facebook API.
calbear81 15y ago
I love the privacy "oh no they're selling our data!" paranoia that people still have without considering WHY and what legitimate reasons Facebook has for sending back data when a Like button is implemented. First, they are a SOCIAL network, this data helps them figure out the engagement level with different brands that participate on the Facebook social platform. Second, in this case, the use of 2-click solution creates a disconnect with the expected behavior of the Facebook Like widget which means users going across different sites will not know whether they need to make one or two clicks to enable a "Like". Third, when you don't use the Facebook Like widget, you don't get any insight into your connections with your social graph unless you click on the Like button which defeats the purpose of being able to see that "4 of your friends like this". There are real privacy concerns that we should consider but I'm tired of reading EU Privacy office statements that show a lack of understanding of how the web works and without regard to the impact to the monetization ecosystem which is the lifeblood of many web publishers. What bothers me more is that there's a lack of consideration that there are legitimate reasons a certain level of data is collected in order to make the web more social.
- beagle3 15y ago
  > What bothers me more is that there's a lack of consideration that there are legitimate reasons a certain level of data is collected in order to make the web more social. It isn't for making the web more social. It's for making (e.g.) Facebook more all-knowing, which is a task on the way for more profit. Just like the tobacco industry should be regulated against making cigarettes more addictive, privacy should be regulated -- either by attaching a mouse-over saying "warning: facebook tracks you on every page you visit that has a like button", or by limiting what and how they can collect. The copyright issue is a red herring. Facebook could create an official "data:..." url like button that has the original image instead of linking to their server. It would be better for everyone involved, including facebook's bandwidth and the site's loading speed -- except that facebook would lose their tracking data.
- rhizome 15y ago
  First, they are a SOCIAL network, this data helps them figure out the engagement level with different brands that participate on the Facebook social platform. Non-sequitur. What does their knowing the "engagement level" with a brand have to do with social networking? In what way would Facebook be less social if you eliminate the entire like-button feature (for the sake of argument)?
hayeah 15y ago
I think the 2-clicks "like" button is super smart. I am going to implement it as a Chrome extension, what do you guys think? I've created a repo on github: https://github.com/hayeah/FaceOff https://github.com/hayeah/FaceOff
deleted 15y ago
[deleted]
yason 15y ago
What are web browsers doing by sharing this accidental data between 3rd party sites anyway? The default setting ought to be that connections to 3rd party sites are done in incognito mode. This would disallow tracking by looking up the referer and sites like Facebook couldn't also tell who's login cookies the browser is storing. You could then whitelist connections on a per-site basis.
kragen 15y ago
The most important update, from Aristotle: "Tina Kulow of Facebook Germany has spoken again. In a tweet, she wrote: “To clarify: a 2-click button is not ideal – but not a problem. Only a Like button that merely visually pretends to be one is not OK. That’s all.” Since heise online changed the design of the button for the first click that activates the Like function, there should now be no obstacles on Facebook’s part to further use of the 2-click button by heise online and other websites."
jaekwon 15y ago
It's the visitor's choice to visit a webpage. It's the developer's choice to choose widgets. Do you really think it's fair to say, "I want to use your widget, FB, which happens through your servers, and I want to use them my way without your consent." The default option (not choosing the widget) is always fair. My point is that to make such widgets illegal, widgets that service three consenting parties, is completely retarded.
- jaekwon 15y ago
  I take that back. If people don't understand the natural laws of the Internet, it may stand to reason that blocking widgets is a matter of national security. However, I think a better approach is to educate each other on how the Internet works, so that blanket measures can be avoided.

346 points by xentronium 15y ago

jeza 15y ago

Apparently it's more of a copyright issue than the 2-click process. They don't like their logo being used on a locally hosted image. So heise.de made the button more generic and it's all good now.

gurkendoktor 15y ago
Are you pointing out that this is what they are saying, or do you believe that? The worst thing that could happen before is that Facebook would change their CI and the button would be outdated, looking dated. Now the button looks crappy from the start.
- jeza 15y ago
  That's my interpretation of the following update posted by the original source (heise.de): "[2. Update: Mittlerweile äußerte sich erneut Tina Kulow von Facebook Deutschland. In einem Tweet schrieb sie: "Um es klar zu stellen: 2-klick-Button ist nicht ideal - aber kein Problem. Nur ein Like-Button der grafisch so tut als ob er einer ist, ist nicht ok. Das ist alles." Nachdem heise online dem Button für den ersten Click, der die Like-Funktion aktiviert, ein verändertes Design gegeben hat, sollte demnach der weiteren Nutzung des 2-Click-Buttons durch heise online und andere Websites auch von Seiten Facebooks nichts mehr im Wege stehen.] (ju) " So it says the two click button is not ideal, but not a problem. Though the graphic on the Like-Button is not okay, and so on.

slowpoke 15y ago

If it hadn't occurred to you yet that Facebook cares far more about the "Like" buttons that you don't click than about the ones that you do -- there you go. I've been telling this to people since ages. These stupid Like buttons are an infestation, and exactly the reason why I care so much about Facebook's privacy policies despite not being registered on it - it's just not as simple as "not having an account". This goes for the other networks, too, by the way. Besides, this solution with the two clicks is very clever, and privacy friendly. In addition, it speeds up page loading. It speaks for itself that the only measure Facebook has is trying to sue with a very broadly formulated policy, which I doubt applies in this case anyways: if such use could confuse users into thinking that the reference is to Facebook features or functionality. Well duh, it is a Facebook feature/functionality.

maeon3 15y ago

I forgot how when I click a like button on a foreign page, face book is keeping data about what pages I am visiting and (who,what,when,where,how) and is selling that click data about me to the highest bidder (and I cant turn it off) to advertisers or worse government agencies doing warrent-less surveillance. I'm never clicking a facebook like button again until I can turn off user website tracking.

rlpb 15y ago
You don't even need to click the like button. Facebook get the information as soon as you view the foreign page.
- hbar 15y ago
  If you use Chrome(-ium), there's an extension for that. I believe there is an equivalent FF extension out there as well. https://chrome.google.com/webstore/detail/ejpepffjfmamnambagiibghpglaidiec https://chrome.google.com/webstore/detail/ejpepffjfmamnambag...
FJCruiser79 15y ago
By 'selling that click data about me' you realize that the only monetization tool Facebook has is a anonymized and aggregated ads tool...it doesn't sell click data.
- igy 15y ago
  I find there's a general perception (especially Slashdot) that this isn't the case, I'm not sure why given that Facebook's been fairly explicit about it in the past
code_duck 15y ago
People, including myself, seem to forget that Google has a far more pervasive network that has been operating for much longer.

yuvadam 15y ago

Friendly reminder, blocking all and any of Facebook's pre-click tracking measures can be implemented easily in AdBlock Plus (or any equivalent ad blocker) with the following rules: ||facebook.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||facebook.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||fbcdn.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||fbcdn.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net

Estragon 15y ago
Corresponding blocks are already in the EasyPrivacy list. https://easylist-downloads.adblockplus.org/easyprivacy.txt https://easylist-downloads.adblockplus.org/easyprivacy.txt
- beaumartinez 15y ago
  I don't think they're as comprehensive. Regarding Facebook, it only has ||facebook.com/campaign/impression.php? ||facebook.com/js/conversions/tracking.js ||pixel.facebook.com^
mike-cardwell 15y ago
Also worth noting that Firefox users who prefer the idea of whitelisting cross-site requests rather than blacklisting them, can install RequestPolicy.
- divtxt 15y ago
  Does anyone know the equivalent Chrome extension?
  - nikcub 15y ago
    I am working on it here: http://www.github.com/nikcub/parley http://www.github.com/nikcub/parley I will have a new version out at the end of this weekend I think it is time to kill all third-party requests. If you want to show users an ad, host it from your own server.

RexRollman 15y ago

Facebook is detestable. Just like its founder.

rickmb 15y ago

Facebook better wake up and realize that especially thanks to companies like them and their failure to self-regulate and respect privacy values outside the US, using Like-buttons for tracking is likely to become illegal in the EU and many other places in the next five years. Technically, one could argue that they already violate existing laws, but incidents like these will make absolutely sure that these practices will be explicitly outlawed very soon. It keeps surprising me how companies like Facebook and Google seem to be oblivious to the way privacy is perceived elsewhere, and are actively provoking stricter legislation than would be the case if they showed some respect. There is absolutely no question about these tracking practices being perceived as ethically unacceptable in many countries, so why provoke both negative publicity and legislation that is likely to handicap less intrusive solutions as well?

doki_pen 15y ago
Google claims that they do not use or keep this information for anything. When they talk about for debugging purposes, they probably mean their web access logs. http://www.google.com/support/+/bin/static.py?page=guide.cs&guide=1207011&answer=1319578 http://www.google.com/support/+/bin/static.py?page=guide.cs&...
mypov 15y ago
I would like to add that contrary to your impression we too value privacy in USA.
- _delirium 15y ago
  To some extent, though we've been less active in doing anything about it. In part we tend to be less keen than Europeans on having the government regulate these kinds of things, but the various private-sector and non-profit initiatives (like TRUSTe) that are supposed to fill the gap have been fairly ineffectual.
  - alexqgb 15y ago
    Unlike Germans - who had the Statsi to contend with, and before that the SS - Americans have never been exposed to a genuine, law-unto-itself, every-phoneline-tapped, free-to-kidnap-torture-and-kill secret police force. One of the clearest lessons learned is that once these things take root, they are incredibly hard to dislodge. When they do go, it's only due to truly cataclysmic change. What naive Americans may regard as absurd hyper-sensitivity or a hopeless lack of technical sophistication is often an acute awareness that never letting it happen again means banning a lot of stuff that young innocents casually dismiss "as just being how the internet works". Evgeny Morozov (author of "The Net Delusion" http://amzn.to/nOOxzQ http://amzn.to/nOOxzQ) observes that casual openness is exactly how the web can be used to work against you. He makes the point that while folks safely ensconced in California should be grateful for their freedom from truly abusive government, they should also be a lot more sensitive to the concerns - and outright trauma - still found in places that haven't been so lucky. Of course, I'm over-simplifying his argument a bit. If you want a more complete (and much more entertaining) introduction, RSA did an especially good animation of a talk he gave, which you can see here: http://www.youtube.com/watch?v=Uk8x3V-sUgU http://www.youtube.com/watch?v=Uk8x3V-sUgU

deleted 15y ago

[deleted]

bryogenic 15y ago

A simple solution to this would be to not use facebook icons for your first click image. So maybe a simple 'social share' icon that brings up all the sharing options and at the same time loads the traditional facebook like button.

eloisius 15y ago

Not sure how great it works because I only sought it out after reading this, but here's Facebook Disconnect for Chrome. https://chrome.google.com/webstore/detail/ejpepffjfmamnambagiibghpglaidiec https://chrome.google.com/webstore/detail/ejpepffjfmamnambag...

blahedo 15y ago

I'm glad this came up to make me think about it more; I'd already gotten in the habit of logging out of FB except when actively viewing the feed, for precisely this reason---I didn't want FB tracking me across browsing other sites. (The FB-hosted comment systems were actually the proximate worry, as well as the Like button.) But that was my half-thought-through answer. Of course they're perfectly able to track me even without being logged in.[0] So the real answer is I need to be sure I'm not loading cross-site img and iframes... My Omniweb install I'd already configured to do that, but setting up proper privacy countermeasures on my Firefox install just jumped way up the priority list. [0] http://panopticlick.eff.org/ http://panopticlick.eff.org/

alextingle 15y ago
I just use a totally different browser for Facebook.
- hautemechanic 15y ago
  This doesn't help as much as you'd hope. When you are using your non-FB browser and visit a website with the FB buttons installed, FB gets click data about you. You need to use a blocking extension in your non-FB browser in order to effectively implement your technique.
spc476 15y ago
I used to do that. I also started deleting any Facebook cookies before logging into Facebook, and after logging out of Facebook. I then realized that was stupid, because I have a static IP address (helps with my job, which requires remotely logging into servers). With Facebook cookies everywhere, you don't need to be logged in for them to track you. And in my case, even if I used a different browser for logging into Facebook, they could (in theory---I have no idea if they actually do this or not) still track me based on the IP address alone. Google is just as scary. A few months ago I did a few searches for local casinos (I was helping a friend of mine get a job at one) and now, I see ads for casinos on about a third of the webpages I visit. It's most annoying, and quite scary when I think about it too much.

Xuzz 15y ago

Before we spend too much time attacking Facebook over this, let's try and think of possible reasons why this might be not an "evil" move. No need to go out of our way to conclude "omg they're evil stealing our privacy". Firstly, what if they just don't want to confuse users? I see people confused all the time of when you need to click and when you need to double-click, every time I see someone using the computer — I'm sure I do this myself, too. What does allowing someone to introduce uncertainty as to what's required here do, especially when their click-through buttons look just like Facebook's normal ones on other sites? I'd say it'd just confuse people. I don't have an issue with Facebook doing that, I'd actually rather have them enforce, this, so you know what is going on when you see a standard Like button. (As a few other comments have noted, just replacing the button with a custom-styled one would solve this issue. It'd also solve user confusion, since it no longer appears to be Facebook requiring a double click.) So, maybe they're not just after destroying privacy, after all? Maybe? (I don't work for Facebook, or even know anyone who does. I just like to try and see both sides of something like this.)

slowpoke 15y ago
I just like to try and see both sides of something like this. While I can certainly agree to that general notion, in Facebook's case that's simply a bit too stretched. I find it pretty hard - if not impossible - to assume honest intentions regarding these cases from a corporations whose founder openly opposes privacy and considers it "obsolete".

doki_pen 15y ago

Is this really just a facebook problem? Isn't it a problem for any client side service that is used across the web? Analytics packages, ad software, value add stuff like disqus, etc.

pacemkr 15y ago

Don't use the Like button. There, problem solved. If your startup isn't social and free, it isn't hip. If you don't have a Facebook page and seven shades of "Like" buttons, you are destroying your business. Just stop. Stop putting that social media flare (crap) on your website. Your users don't care, because sharing a link is not an unsolved problem.

jcfrei 15y ago

what about the like buttons on techcrunch? they only load if you hover over them as well.

lukejduncan 15y ago
techcrunch uses a custom image for their preloaded button

thedjpetersen 15y ago

I was surprised to find out that Facebook tracks not only what 'like' buttons you have been clicking but also where you have been browsing. Is there a privacy browser extension?

ordinary 15y ago
For Firefox, RequestPolicy adds a whitelist for requests to third-party websites. It's a hassle to set up, but it works. I don't know if an equivalent exists for Chrome.
- waqf 15y ago
  Re Chrome, see http://news.ycombinator.com/item?id=2957201 http://news.ycombinator.com/item?id=2957201
brokentone 15y ago
Disconnect for Chrome is great, but it only blocks a limited number of social sites.

Sigi 15y ago

A possibly related note: I use two browsers to browse the web in an attempt to protect my privacy (as futile as it seems to be); one is logged in to google, and the other is not. When using the browser that is logged in, I get 15 "+1"s for google like-like button. however, when using the other browser that's not logged in, I get 0 "+1"s. Can anyone explain?

rudiger 15y ago

Is there an open-source implementation of this two-click system for Facebook's Like button (and others like Google's +1 and Twitter's tweet button)?

blauwbilgorgel 15y ago
I often use a simple (button image) link to twitter.com/share or facebook.com/sharer.php (now http://developers.facebook.com/docs/reference/dialogs/ http://developers.facebook.com/docs/reference/dialogs/). That is one-click without javascript execution or, worse IMO, company custom html tags. AFAIK Google+1 doesn't, as of yet, have such an URL where you can share. Sharing seems to go through the +1 button. I'd really like a share url for Google+ for technical and privacy reasons and keep everything one-click to share. I bet you could make a two-click system for the Google+1 button, now asynchronous javaScript loading is enabled, but I don't know if that is within TOS. Again I would love a simple share link (like Linkedin, Facebook or Twitter) and be done with it. I know that sharing on Facebook is different from liking, but I feel sharing is more valuable from a marketing POV.
mason2 15y ago
For Firefox there's an add-on, take a look: https://addons.mozilla.org/en-US/firefox/addon/2-click-like/ https://addons.mozilla.org/en-US/firefox/addon/2-click-like/ It supports five or six like buttons.

thelovelyfish 15y ago

Facebook, google, all these other giant technology firms... They will be looked back on in the future as ruthless opportunists doing their best to take advantage of the public with technology before anyone can figure out what they're doing and stop them. The world is not some cute friendly little place. It is equally as barbarous today as it was in the dark ages. The TVs have convinced everyone otherwise it seems. Evil people are using machines to take over the world. http://www.youtube.com/watch?v=z9RiRfMYVlQ&feature=channel_video_title http://www.youtube.com/watch?v=z9RiRfMYVlQ&feature=chann...

cletus 15y ago

This is a non-story for the reasons stated but a story for other reasons. It's standard that widget publishers require to use their widget "as is". That's basically what Facebook is saying. Not only do you not know what any custom modifications will necessarily do but it's a completely valid argument that you want a consistent user experience with your widget. As for user tracking, this is basically an inevitable byproduct of Facebook hosting the widget, a situation I'm sure they're not unhappy about, but this really isn't a big deal in the context of how the Web works. The story here (IMHO) is trust. Most pages have a Google Analytics tracking script on them. Do you trust Google? I do (disclaimer: I work for Google). Protecting user data and privacy are key priorities here. It's why Google+ has relatively simple privacy controls and allows you to export your data at any time. Do you trust Facebook? I don't. Then again, there aren't many companies I do trust. But Facebook's track record seems to be to befuddle the user and trick or opt them into sharing things wider than they understand or want.

alnayyir 15y ago
So when are you guys going to back up the openness propaganda and open source something of substance other than protobuf?
nikcub 15y ago
> But Facebook's track record seems to be to befuddle the user and trick or opt them into sharing things wider than they understand or want. Just like Google did with Buzz That was such a clusterfuck that for most people Google is in the same bucket as Facebook when it comes to 'caring about user privacy'
- alexqgb 15y ago
  I never considered any of FB privacy curtailments to be 'clusterfucks' in the sense that they involved Buzz-level incompetence, bad planning, or lack of foresight. To the contrary, I always felt FB knew exactly what it was doing, and was operating in a very calculated way. Three steps forward and (maybe) one step back.
  - 15y ago

baby 15y ago

I was doing it on my website, I never had any problems with facebook. Actually, I had other problems with them, and what they did is just plainly banned my application and blocked my website from using facebook API.

calbear81 15y ago

I love the privacy "oh no they're selling our data!" paranoia that people still have without considering WHY and what legitimate reasons Facebook has for sending back data when a Like button is implemented. First, they are a SOCIAL network, this data helps them figure out the engagement level with different brands that participate on the Facebook social platform. Second, in this case, the use of 2-click solution creates a disconnect with the expected behavior of the Facebook Like widget which means users going across different sites will not know whether they need to make one or two clicks to enable a "Like". Third, when you don't use the Facebook Like widget, you don't get any insight into your connections with your social graph unless you click on the Like button which defeats the purpose of being able to see that "4 of your friends like this". There are real privacy concerns that we should consider but I'm tired of reading EU Privacy office statements that show a lack of understanding of how the web works and without regard to the impact to the monetization ecosystem which is the lifeblood of many web publishers. What bothers me more is that there's a lack of consideration that there are legitimate reasons a certain level of data is collected in order to make the web more social.

beagle3 15y ago
> What bothers me more is that there's a lack of consideration that there are legitimate reasons a certain level of data is collected in order to make the web more social. It isn't for making the web more social. It's for making (e.g.) Facebook more all-knowing, which is a task on the way for more profit. Just like the tobacco industry should be regulated against making cigarettes more addictive, privacy should be regulated -- either by attaching a mouse-over saying "warning: facebook tracks you on every page you visit that has a like button", or by limiting what and how they can collect. The copyright issue is a red herring. Facebook could create an official "data:..." url like button that has the original image instead of linking to their server. It would be better for everyone involved, including facebook's bandwidth and the site's loading speed -- except that facebook would lose their tracking data.
rhizome 15y ago
First, they are a SOCIAL network, this data helps them figure out the engagement level with different brands that participate on the Facebook social platform. Non-sequitur. What does their knowing the "engagement level" with a brand have to do with social networking? In what way would Facebook be less social if you eliminate the entire like-button feature (for the sake of argument)?

hayeah 15y ago

I think the 2-clicks "like" button is super smart. I am going to implement it as a Chrome extension, what do you guys think? I've created a repo on github: https://github.com/hayeah/FaceOff https://github.com/hayeah/FaceOff

deleted 15y ago

[deleted]

yason 15y ago

What are web browsers doing by sharing this accidental data between 3rd party sites anyway? The default setting ought to be that connections to 3rd party sites are done in incognito mode. This would disallow tracking by looking up the referer and sites like Facebook couldn't also tell who's login cookies the browser is storing. You could then whitelist connections on a per-site basis.

kragen 15y ago

The most important update, from Aristotle: "Tina Kulow of Facebook Germany has spoken again. In a tweet, she wrote: “To clarify: a 2-click button is not ideal – but not a problem. Only a Like button that merely visually pretends to be one is not OK. That’s all.” Since heise online changed the design of the button for the first click that activates the Like function, there should now be no obstacles on Facebook’s part to further use of the 2-click button by heise online and other websites."

jaekwon 15y ago

It's the visitor's choice to visit a webpage. It's the developer's choice to choose widgets. Do you really think it's fair to say, "I want to use your widget, FB, which happens through your servers, and I want to use them my way without your consent." The default option (not choosing the widget) is always fair. My point is that to make such widgets illegal, widgets that service three consenting parties, is completely retarded.

jaekwon 15y ago
I take that back. If people don't understand the natural laws of the Internet, it may stand to reason that blocking widgets is a matter of national security. However, I think a better approach is to educate each other on how the Internet works, so that blanket measures can be avoided.