3 ms·

Stopping to use Facebook is way harder than you may think. For example, Facebook is provided as authentification service on a huge amount of websites, meaning

Stopping to use Facebook is way harder than you may think. For example, Facebook is provided as authentification service on a huge amount of websites, meaning those websites send parts of your data to Facebook even if you don't use this authentication.

unbanned 5y ago
This is not how it works.
- jsemrau 5y ago
  Maybe this is of interest for you: https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_... Seems to me, this is pretty much exactly how this works.
- david_allison 5y ago
  In Android apps, that's how it works. The SDK (recommended for login) is set up by default to collect information and installs handlers for app lifecycle events as soon as the app is installed. The default is to do this without requesting user consent. A rough summary of the data: (Ad ID, device, locale, phone network, maybe install referrer). To attribute advert -> install, Facebook ads pass on an encrypted blob containing campaign information to the Play Store, this blob is readable by the app, and is transmitted back to Facebook where it's decrypted. The setting: https://github.com/facebook/facebook-android-sdk/blob/fcd4eff6e4d63f6e2922ae10aea298c7587b96b7/facebook-core/src/main/java/com/facebook/UserSettingsManager.kt#L71 https://github.com/facebook/facebook-android-sdk/blob/fcd4ef... Defaulted to true: https://github.com/facebook/facebook-android-sdk/blob/5fe6e2a9d7056a17f54c1cae13e00788723d34f6/facebook-core/src/main/java/com/facebook/UserSettingsManager.kt#L52-L53 https://github.com/facebook/facebook-android-sdk/blob/5fe6e2... https://developers.facebook.com/docs/app-events/getting-started-app-events-android#disable-auto-events https://developers.facebook.com/docs/app-events/getting-star...
  - foverzar 5y ago
    Wow, that's a very dark pattern. In any case, this is not how it's supposed to work in oauth, and it's definitely not required for it to work. I suppose developers could pretty much use any generic oauth lib for the login purposes.
readflaggedcomm 5y ago
Do you mean passive third-party requests I could block on my end, or something built into their backend that exposes their entire registration list? I thought it was only the former.
- david_allison 5y ago
  Both. Facebook scans form fields for content that can be uploaded [0], and a developer can upload hashed data (I believe potentially from their backends[1][2]). [0] https://www.facebook.com/business/help/611774685654668?id=1205376682832142 https://www.facebook.com/business/help/611774685654668?id=12... > Automatic advanced matching will tell your pixel to look for recognisable form fields and other sources on your website that contain information such as first name, last name and email address. The Facebook pixel receives that information along with the event, or action, that took place. This information gets hashed in the visitor's browser. We can then use the hashed information to more accurately determine which people took action in response to your ad. After matching, we promptly discard the hashed information. [1] https://developers.facebook.com/docs/facebook-pixel/advanced/advanced-matching/ https://developers.facebook.com/docs/facebook-pixel/advanced... - technical specs for uploading hashed user content. Typically done on the frontend. [2] https://www.facebook.com/business/m/signalshealth/accelerate/manual-advanced-matching https://www.facebook.com/business/m/signalshealth/accelerate... > The manual method feature enables advertisers to leverage their own customer data, such as email address, phone number and so on. This method allows advertisers to report on more conversions, optimise their ads against more conversion data and reach more people on Facebook with their website Custom Audiences or dynamic ads.
prmoustache 5y ago
I don't know any website that uses facebook as its only way to authenticate. I never use the usual suspect for authentication, always choose the regular account option tied to an email address. That is what password managers are for anyway.

unbanned 5y ago

This is not how it works.

jsemrau 5y ago
Maybe this is of interest for you: https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_... Seems to me, this is pretty much exactly how this works.
david_allison 5y ago
In Android apps, that's how it works. The SDK (recommended for login) is set up by default to collect information and installs handlers for app lifecycle events as soon as the app is installed. The default is to do this without requesting user consent. A rough summary of the data: (Ad ID, device, locale, phone network, maybe install referrer). To attribute advert -> install, Facebook ads pass on an encrypted blob containing campaign information to the Play Store, this blob is readable by the app, and is transmitted back to Facebook where it's decrypted. The setting: https://github.com/facebook/facebook-android-sdk/blob/fcd4eff6e4d63f6e2922ae10aea298c7587b96b7/facebook-core/src/main/java/com/facebook/UserSettingsManager.kt#L71 https://github.com/facebook/facebook-android-sdk/blob/fcd4ef... Defaulted to true: https://github.com/facebook/facebook-android-sdk/blob/5fe6e2a9d7056a17f54c1cae13e00788723d34f6/facebook-core/src/main/java/com/facebook/UserSettingsManager.kt#L52-L53 https://github.com/facebook/facebook-android-sdk/blob/5fe6e2... https://developers.facebook.com/docs/app-events/getting-started-app-events-android#disable-auto-events https://developers.facebook.com/docs/app-events/getting-star...
- foverzar 5y ago
  Wow, that's a very dark pattern. In any case, this is not how it's supposed to work in oauth, and it's definitely not required for it to work. I suppose developers could pretty much use any generic oauth lib for the login purposes.

readflaggedcomm 5y ago

Do you mean passive third-party requests I could block on my end, or something built into their backend that exposes their entire registration list? I thought it was only the former.

david_allison 5y ago
Both. Facebook scans form fields for content that can be uploaded [0], and a developer can upload hashed data (I believe potentially from their backends[1][2]). [0] https://www.facebook.com/business/help/611774685654668?id=1205376682832142 https://www.facebook.com/business/help/611774685654668?id=12... > Automatic advanced matching will tell your pixel to look for recognisable form fields and other sources on your website that contain information such as first name, last name and email address. The Facebook pixel receives that information along with the event, or action, that took place. This information gets hashed in the visitor's browser. We can then use the hashed information to more accurately determine which people took action in response to your ad. After matching, we promptly discard the hashed information. [1] https://developers.facebook.com/docs/facebook-pixel/advanced/advanced-matching/ https://developers.facebook.com/docs/facebook-pixel/advanced... - technical specs for uploading hashed user content. Typically done on the frontend. [2] https://www.facebook.com/business/m/signalshealth/accelerate/manual-advanced-matching https://www.facebook.com/business/m/signalshealth/accelerate... > The manual method feature enables advertisers to leverage their own customer data, such as email address, phone number and so on. This method allows advertisers to report on more conversions, optimise their ads against more conversion data and reach more people on Facebook with their website Custom Audiences or dynamic ads.

prmoustache 5y ago

I don't know any website that uses facebook as its only way to authenticate. I never use the usual suspect for authentication, always choose the regular account option tied to an email address. That is what password managers are for anyway.