17 ms·

Facebook is scaring me

553 points by moses1400 15y ago

dasil003 15y ago
This is the wild west and Facebook is doing a land grab.
dmoney 15y ago
From the RWW article, it looks like you have to enable a "social news app" for this to be an issue. I don't know why anyone would do that.
- sp332 15y ago
  Nope, the JS that Facebook gives people to embed a Like button on their page, sends the URL of the page back to FB without actually being clicked. http://www.zdnet.com/blog/facebook/germany-facebook-like-button-violates-privacy-laws/2837 http://www.zdnet.com/blog/facebook/germany-facebook-like-but...
  - mpclark 15y ago
    So how many of us are concerned about this from a personal privacy point of view, but still have all the Facebook buttons and markup all over our sites? I'm a little concerned that, as a website operator, I really ought to work with Facebook because it will lead to more PVs because it is advertising my site for me. But I've been uncomfortable for some time as I watch my friends and my children slowly confuse the web and Facebook. It's easy to see a day when, for most non-techy folks, the web is Facebook. So, I can close my FB account. But I think, in the spirit of doing the right thing for the world, the web and the future, I also have to take Facebook off my site and face whatever consequences that may bring. Or am I being a fuddy-duddy old reactionary?
    - sp332 15y ago
      You can implement a "two-click like" button that mostly solves the problem. http://www.heise.de/ct/artikel/2-Klicks-fuer-mehr-Datenschutz-1333879.html http://www.heise.de/ct/artikel/2-Klicks-fuer-mehr-Datenschut... (German) Just be sure not to make your non-standard FB button look like the official one because they will get on your back about trademarks. http://adland.tv/content/heise-creates-two-click-facebook-button-avoid-traffic-tracking-facebook-peeved http://adland.tv/content/heise-creates-two-click-facebook-bu...
    - mpclark 15y ago
      Having thought about this some more, I have taken Facebook off our site. As a business we may suffer some downside as a result, but I want to (a) protect the privacy of my site's users and (b) be able to hold my head up and say I'm not part of the problem when the revolution comes.
  - travisp 15y ago
    It's true that Facebook almost certainly tracks users through the like button, but that is different than what is being talked about here. When Facebook tracks that you read a webpage through a like button, they do not display it in your friends feeds. While many people reasonably aren't comfortable with Facebook knowing where you're going all the time, it is a very different thing than Facebook sharing that knowledge with all of your Facebook friends. That feature, the one the original article is talking about, requires you to specifically opt-in before the "Bob read an article about sexual dysfunction" starts showing up in everyone else's news feeds.
  - jhferris3 15y ago
    That may be true, but even if it is, it isn't sharing this activity with your friends, that would be facebook doing exactly what google does with their analytics platform/js. I don't get the freakout people have over fb potentially tracking you through something you can see (the like button) vs google doing it everywhere with something you can't (the analytics js)
  - shuw 15y ago
    Google Analytics sends URLs to Google on a even larger majority of websites. FB was hardly the one to start this trend. The different in FB case, that they are not "required" to track URLs so they could of chosen an alternate implementation where sites in-directly served FB scripts through their own servers. And FB would only received a request when someone interacted with their elements.
    - X-Istence 15y ago
      Google is providing a service to the owner of the website, that helps them track their content. Google isn't using it to post to a users wall/feed so that advertisers have more keywords to advertise to.
      - travisp 15y ago
        >Google isn't using it to post to a users wall/feed so that advertisers have more keywords to advertise to. Neither is Facebook. Facebook is not using their like buttons for this feature, it is a separate opt-in feature.
    - mpclark 15y ago
      Yes, this is a great idea. 'Passive' like buttons. There's no need (from my POV) for them to be active.
  - prostoalex 15y ago
    The app still has to request 'publish_actions' permissions, which requires an FBConnect dialog. That URL is being used for customization of Like button, so that on some sites you can see 'Friend A, Friend B and 345 others recommended it'.
sneak 15y ago
Logging out doesn't necessarily disable the tracking, though, as the cookies are still there. You could delete them, but I bet the like buttons reset new ones, which correlates your history to you the next time you log back in. Much better is to just nullroute their netblocks at your router. That's what I do.
- icebraining 15y ago
  It's been already shown that FB creates an unique ID for you even if you don't have a Facebook account.
  - dev1n 15y ago
    Where has this been proven?
    - polynomial 15y ago
      Poster may be referring to the phone address book scandal, probably only one example. In that case importing your facebook contacts from your phone grabbed your entire address book, with what looked like account placeholders for anyone in your phone that wasn't already on facebook. Oh, and it published all their phone numbers too. I'm sure facebook has myriad nefarious ways for tracking everyone you interact with regardless whether they have an account. And do we need to point out Double click got caught tracking individual users and lying about it over 10 years ago. Some sources would obviously be helpful, but I don't think anyone is kidding themselves about what's going on.
    - icebraining 15y ago
      It was a blog post I can't find right now, but it's easy enough to reproduce: I deleted all the cookies from Facebook and then open a tab to a site with the Like button. A cookie for facebook.com is created called "datr" with an obvious ID and an expire date two years from now.
- grovulent 15y ago
  where does one find these netblocks?
zerostar07 15y ago
As always Winer is worried, rightfully so, but people aren't going to log out of facebook. It seems Zuck really wants to get back at people for making him pull "Beacon" back then, so he reintroduced it. Of course it's a privacy concern, but i think people no longer have illusions about their privacy on facebook.
- Alex3917 15y ago
  "people aren't going to log out of facebook." I actually have a separate browser that I use just for Facebook. Granted I only do this because FB doesn't work for me in Chrome, but it's still a pretty easy way of getting the same result.
  - hugh3 15y ago
    I'm seriously considering only using facebook on my phone.
    - asto 15y ago
      Your phone is where FB gets all your friends' phone numbers from whether any of you like it or not!
      - Xuzz 15y ago
        That's not true; there is a very, very specific alert shown before Facebook accesses any phone numbers. I'm not making this up, it's just how it works. Facebook does not get anything "whether you like it or not". They get the information if you specifically allow it, and only if you try to enable the Sync feature. Hell, here's a screenshot if you don't believe me: http://www.askdavetaylor.com/6-blog-pics/iphone-facebook-sync-profile-pics-3.png http://www.askdavetaylor.com/6-blog-pics/iphone-facebook-syn...
    - rhizome 15y ago
      Information leakage is much more difficult to prevent on your phone than in a browser.
badclient 15y ago
I recently decided to RSVP for a meetup on meetup.com. It was a meetup I don't, in fact, want most folks I know to know about. I made sure to use my junk email account that doesn't have my name tied to it. So I was scared shitless when after RSVP'ing I see faces of all my facebook friends and an offer to invite them. I always thought you had to do the whole facebook connect crap before websites could just splash your fb friends list at you? Then I thought about all the billion different ways facebook has to integrate them into your site and figured this must be one of the ways.
- watmough 15y ago
  If you don't immediate terminate your fb account when you see this, you're like one of those people who can't leave their abuser. That's just all there is to it. Just as a matter of interest, has anyone ever taken a close look at what's actually in the static content that you can download when you quit fb?
  - haldean 15y ago
    Pretty much any of it. If there's a photo I want a friend of mine to see, but they don't have permission to see it, I just send them the URL of the static content and it works every time, whether or not they're logged in.
    - rw 15y ago
      No longer. Images are obfuscated (view the source of a gallery image to see what I mean).
      - X-Istence 15y ago
        So you are not able to view the following link: https://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-snc4/148199_509098132490_138900699_30219016_5205632_n.jpg https://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-snc4/148199_... Just for reference the picture should be this: http://imgur.com/UYs6H http://imgur.com/UYs6H Oh ... the way I uploaded that to imgur? Using that URL above, so clearly that is wide open to the world.
xpressyoo 15y ago
Another analysis/viewpoint: https://plus.google.com/111297306144520956414/posts/JLQogwzooYd https://plus.google.com/111297306144520956414/posts/JLQogwzo...
Garbage 15y ago
I guess, I should always browse Facebook in "Private Browsing" mode, without any other site open in that session.
deleted 15y ago
[deleted]
mike-cardwell 15y ago
RequestPolicy users are protected against this entire class of problem. When I'm looking at a webpage, I know it isn't pulling in content from any other site, including Facebook, unless I specifically allow it to.
jordinl 15y ago
So it seems the solution would be to have different browser profiles. For instance, one for regular browsing, one for FB and one for gmail?
- cpeterso 15y ago
  Flash cookies ("shared objects") are across shared across all browsers and browser profiles. If FB uses Flash cookies, you could log into FB on Firefox and they can still track you in Chrome!
  - jordinl 15y ago
    scary...
codecaine 15y ago
I think Ghostery deserves some promotion here : http://www.ghostery.com/ http://www.ghostery.com/ available for all major browsers. It blocks near to all webbugs including the facebook social plugins.
- Lagged2Death 15y ago
  Great Scott, they've got an Opera plugin. (https://addons.opera.com/en/addons/extensions/details/ghostery/ https://addons.opera.com/en/addons/extensions/details/ghoste...)
keeran 15y ago
This is why I block FB in the hosts file (https://gist.github.com/1197453 https://gist.github.com/1197453) and only use my mobile devices for FB messaging.
suprgeek 15y ago
A good time to point out the Ghostery Browser extension. Use this at the most paranoid setting so that when FB and others pull stunts like these you have at least some measure of protection.
Terretta 15y ago
I recommend Ghostery: http://www.ghostery.com/ http://www.ghostery.com/ Quoting: Ghostery is your window into the invisible web – tags, web bugs, pixels and beacons that are included on web pages in order to get an idea of your online behavior. Ghostery tracks the trackers and gives you a roll-call of the ad networks, behavioral data providers, web publishers, and other companies interested in your activity. Choose to block - or not. You get control at a company level - are there some marketers you trust, but others you'd rather turn away? Ghostery lets you open the valve of your web behavior as wide or as narrow as you'd prefer.
- dotmanish 15y ago
  I just tried it and browsed to TechCrunch. wow.
  - getsat 15y ago
    Kind of amazing how it loads 10x faster, eh?
  - bryanh 15y ago
    Try avc.com next...
    - there 15y ago
      i think venturebeat.com wins. viewing an article there shows 18 blocked pieces-of-crap.
- joelhaasnoot 15y ago
  Another option I have installed as a Chrome extension is Disconnect.me
- LogEx 15y ago
  Ghostery and Disconnect are essential privacy tools in Firefox, Safari, or Chrome. Also try ShareNot on Firefox, which is experimental, but has somewhat more extensive blocking coverage than Disconnect. But more fundamental: don't log in unless you have to, log in only in private browsing windows or separate browsers from your other surfing, and also clear your cookies often to keep your not-logged-in browsing cleaner from a privacy perspective.
patangay 15y ago
I'm an engineer at facebook. I want to clear up a few things that you guys are talking about. For starters, it's true that a visit to a news story or watching a video will trigger a feed story. The point that most people seem to be missing is that this requires you to knowingly allow a social application. For example, in my case, I installed the social plugin for rdio (rdio.com). When I listen to a song on rdio, it publishes it to my friends ticker feeds. (Ticker is the bar on the side where likes, listens, reads, etc go). There are a couple websites that are doing read social browsing, for example the Washington Post's social reader (https://apps.facebook.com/wpsocialreader/ https://apps.facebook.com/wpsocialreader/). Again, just by visiting this page you will not trigger anything unless you have already allowed the application access. In the past I've setup my music player on the laptop to publish the songs I'd been listening to, to my IM client (as away messages) - Adium let's me do this out of the box. It's kind of the same idea, instead this is just built in to the website you visit or music you listen to. You can also disable any application you previously installed by going to Privacy Settings and clicking on Apps and Websites. It should all be there. You don't have to log out of facebook or close your account. Just delete all your social apps. (https://www.facebook.com/settings/?tab=privacy https://www.facebook.com/settings/?tab=privacy)
- gmantastic 15y ago
  That's very helpful, thanks.
- paulsmith 15y ago
  Is it retroactive to apps that you've installed previously? For example, I signed in with my Facebook account on 3rd party site X and accepted the permissions, and at the time it didn't auto-publish to my feed (or "ticker" or whatever), but now suddenly it will be publishing automatically without my explicit say-so?
  - X-Istence 15y ago
    According to some the app will have to ask for those new permissions before it will be allowed to do them, for now.
  - 15y ago
orijing 15y ago
I am a software engineer at Facebook. Bear with me because I don't have any PR-quality answer to give you. I am not on the platform team, but I have built apps before in the wild-west days. The app requires explicit permission from the user in order to post activities automatically. The idea, if you watched Mark's presentation, is called "frictionless sharing." A lot of people don't share because it's another step, but if they could install an app like the Washington Post Reader (a great app--even Mark has it installed), they are happy with sharing articles they've read with their friends. I understand you might be concerned, for example if you added that app without realizing that it will post content. If you are concerned about the privacy implications, you can always change individual permissions for an app by going to your account settings, then selecting the 'app' tab on the left, or by going to https://www.facebook.com/settings?tab=applications https://www.facebook.com/settings?tab=applications. If you are concerned about spamming your friends' news feeds, that's why we built ticker, for the light-weight activities like "watched a movie" or "listened to a song" or "read an article". If I remember correctly, the exact wording of the app permission request was alarming enough to get my full attention ("I, the application, can post as you" or something like that), so I'm worried less about a user missing that part. In my known experiences, the app was installed with the knowledge that it will share your experiences--because the idea is you want to share your activities with your friends. As soon as I read an article, my first action is to either send the link to specific people who are interested, or post it on my wall if I think everyone is interested. We operate under the assumption that users will not do what they don't want to do, as long as we make it explicit what might happen. And if they make a mistake, they can always go change their settings. So I'm not so worried about users who sign up for the Washington Post Reader app, which is marketed as a social reading experiment, and subsequently complain that it shares your read articles. You might still be concerned, in which case, please let me know why (users being misinformed?), and I'll try to pass it onto the platform folks, who were really heads-down the past few months.
- X-Istence 15y ago
  The reason why this bothers me is that there is no longer any EXPLICIT confirmation that I want to post something. Not sure who said it but I read it in a TechCrunch article, "Just hit play in Spotify and it will share with your friends". No, any sharing I do HAS to REQUIRE an EXPLICIT action on my part. I have to be in full control. Visiting a web site does not mean that I believe it will be interesting to my friends NOR do I want that information shared with people on Facebook. A like button that shares, much like the Google+ 1+ button is perfectly fine, I have to hover over it, and choose my circles to share with, and then share. It is not automatic once I visit the site. I don't want articles automatically being linked just because I visited a page, or clicked play in Spotify, or put the toilet seat up. It is not just privacy concerns, it is the image I try to convey while using social media sites where it is common place to be friends with your boss and or co-workers. I don't need them knowing I like the Bloodhound Gang or that I read articles about atheism in the NYT but have never read a single article about religion. Eventually all this collected data will be used against me. What if I do a simple Google search for cancer and I end up reading an article about it, that is now shared publicly, my insurance company a few years later gets a claim for cancer they claim it was a pre-existing condition and deny me coverage. These are all scenarios going through my head. I am all for the interconnected web, and making it easier for me to introduce my friends to new content across it, however it has to be done on my terms, it has to require explicit authorisation and must never do something automatically without my consent. If I like the content enough I am extremely likely to copy and paste the URL into my social networking sites, I don't mind that extra step. Create a bookmarklet that fills in some of the forms ahead of time for me (I have a reddit bookmarklet that fills out title, URL and the sub-reddit to post in (personal one for me to share links with friends)). I am more than happy to continue using the platform, but this frictionless sharing scares the crap out of me, and will see me closing my account sooner rather than later if it continues down the path that it looks to be going down.
Bo102010 15y ago
I ditched Facebook this morning when I realized my carefully-constructed "Don't show this part of my profile" list was wiped out in the last redesign. I've always thought the complaints people make after each redesign were simply resistance to change, but this time it doesn't seem worth it to continue.
- zdrtx 15y ago
  Could you be a little more specific? What kinds of things were you not showing that are now showing?
  - Bo102010 15y ago
    I had my privacy settings set to "Custom" for wall posts, photos, and some other profile elements. I excluded a list of people from seeing posts I made and posts other people put on my wall. When I used the "View my profile as," I wouldn't see the excluded elements. Once the new design launch, I realized that all these settings were lost - I can do "View my profile as" one of the people on my excluded list, and see the stuff I didn't want shown.
- akarambir 15y ago
  I too for the same reason have deleted my account. I don't feel i'm in control. Its too risky.
  - watmough 15y ago
    Accessing facebook.com/watmough ('deleted' account) shows 'content currently unavailable'. This used to be my account. Accessing facebook.com/jonathanwatmough (likely not an account) shows standard 'page not found error'. Deleting a fb account may not mean what you would expect it does. I think they are keeping my data warm for me. And keeping your data warm too.
    - dkokelley 15y ago
      Your information will likely never leave Facebook. I know of a few people who "cancelled" their accounts, only to rejoin at a later time. Their information was preserved. They didn't even have to re-friend me.
chailatte 15y ago
Switch to other services (Instagram, Twitter, Google+). Problem solved. Unless you like to be in S/M relationship. You're the S.
- nemik 15y ago
  I think you got those mixed up.
martingordon 15y ago
As the two FB engineers mentioned, you have to allow access to the app before it can know anything about you or take action on your behalf. See Step 2 of the Open Graph tutorial: https://developers.facebook.com/docs/beta/opengraph/tutorial/ https://developers.facebook.com/docs/beta/opengraph/tutorial... Publishing actions requires the publish_actions permission, so if the app previously didn't ask for it, I believe you will be asked to re-authenticate the app with the new permissions. I, for one, am going to be reviewing the apps I've previously added to ensure that none of them are doing anything I wouldn't want to. Not sure where to file FB API feature requests, but it would be nice to not have an "all or nothing" approach to authentication (this is a problem with the Twitter API as well, FWIW). For example, if an app requires X, Y and Z permissions, I might want to only allow X and Y and just not use the features that require Z.
- Slizyboy 15y ago
  You can always remove Z later, but for the initial authentication I think you do have to grant all the permissions it asks for.
- rhizome 15y ago
  Indeed there is a race condition (if that) where you have to allow access at the default privileges before opting out of any of them. I'm sure every single application sucks in your entire graph as soon as you click that button, so the solution to limit permissions after installing the app is just so much closing of the barn door after the horses have left.
molecularbutter 15y ago
LOL at all the facebook employees who are chiming into this thread (and others) to defend the latest creepery from their professionally invasive advertising company. I know you're just waiting for the IPO to cash in, but come on, how can you defend this nonsense?
- lbrandy 15y ago
  Is this -really- what hacker news has become? Really?
- nak3d 15y ago
  It's the All-Hands Kool Aid Q&As with Zuck on Friday.
ngmcs8203 15y ago
This really comes down to Winer's tin foil hat obscuring what's actually happening and writing the story to reflect his lack of facts. For these "reading a story" posts to get to your timeline, you have to opt-in by installing the app and giving it permission to do that. If you're dumb enough to do that and get offended, maybe you should close your Facebook account.
- X-Istence 15y ago
  Some webapps require using Facebook to login to even create an account on their site. Now you can say that then they shouldn't use said site, but soon this is going to become more and more common, what then?
- deleted 15y ago
  [deleted]
- mpclark 15y ago
  Well, that may be the way it works after F8 2011, but there's got to be a good chance it will have changed to remove this little bit of 'friction' by F8 2012...
stfu 15y ago
Oh, so Facebook already sent their minions to HN? That was fast! Lately the negative stories are gaining a bit of a momentum. Very much like that development.
deleted 15y ago
[deleted]
pointyhat 15y ago
All the Facebook engineers on here sound like I imagine IBM executives do when asked about the involvement of IBM in the holocaust... I'm genuinely surprised that the EU haven't stepped on Facebook yet. It's the creepiest, most invasive thing ever developed.
mwsherman 15y ago
Wouldn’t disabling third-party cookies take care of this? (And many other questionable things?)
- nostromo 15y ago
  In Chrome the option is to block 3rd party cookies from being set, not from being sent. Since Facebook sets its cookie while I am on their domain, I don't believe Chrome's blocking option is of any use.
  - mikewest 15y ago
    In `about:flags` there's an option to change third-party cookie blocking behavior to prevent reading third-party cookies as well.
    - nostromo 15y ago
      Cool, thanks!
codeup 15y ago
The apologetic posts by Facebook engineers give deep insights. Of course they can argue well on what are, for average users, technical details. On that level, it is possible to get entangled in endless discussions. The real problem is that these posters seem to totally lack (or ignore) an understanding of the bigger picture of what they are contributing to.
guelo 15y ago
The latest url for app permissions is http://www.facebook.com/settings?tab=applications http://www.facebook.com/settings?tab=applications
kragen 15y ago
I've been logging in to Facebook and Google+ only in a Chrome Incognito window for this reason for a while now. I recommend the practice to everyone. However, yesterday Facebook locked my account because I was browsing "from an unknown device" (the netbook I've been using for years, on the IP address of PyCon Argentina). I unlocked it by identifying five of my Friends from 15 photos. So it's not without its drawbacks.
- nbm 15y ago
  In this case your account probably was not locked, you just needed to provide additional information to log in because something seemed unusual. So if you logged in from a known-good environment (ie, a computer we know you have logged in before), it would work - you aren't locked out of your account. This is one of a few different systems we have to protect our users - in this case from having their credentials used if they are exposed through others sites, through phishing, or through some other mechanisms. You can a little about it at https://blog.facebook.com/blog.php?post=389991097130 https://blog.facebook.com/blog.php?post=389991097130 The social authentication is one way we help people verify their identity in these cases - you can read about it at https://blog.facebook.com/blog.php?post=486790652130 https://blog.facebook.com/blog.php?post=486790652130 . There are others - the easiest for most people is through sending a text message to your phone when you log in from a new device, which you can read about at https://www.facebook.com/note.php?note_id=10150172618258920 https://www.facebook.com/note.php?note_id=10150172618258920 If you are concerned about privacy, but not happy about having to log in from scratch each time and occasionally have to go through these steps (or not comfortable giving or not able to give a phone number for text message authentication), you might want to use a separate dedicated browser for Facebook that does have cookies enabled.
deleted 15y ago
[deleted]
nextparadigms 15y ago
If people think Zuckerberg had "vision" doing this, I suppose I agree. But his vision wasn't "how can I help people have better online connections and experiences?" or anything like that. His vision was "how can I get people to share everything about their life, so Facebook can make more money?" They are not one and the same thing, because in the latter, the priority is put on optimizing the experience for Facebook, not for the user. Zuckerberg actually believes that there should be no privacy - at all. This is where he's leading Facebook. I believe that's a flawed vision, but he's probably sticking to it, because the less privacy you have, the more it helps the company.
- nak3d 15y ago
  "We Are Building A Web Where The Default Is Social" - Mark Zuckerberg Mark Zuckerberg is dead set on making Beacon work. This is his latest attempt by making the apps do their dirty work by asking for a permission and auto-sharing.
- orangecat 15y ago
  Zuckerberg actually believes that there should be no privacy - at all. This is where he's leading Facebook. I believe that's a flawed vision, but he's probably sticking to it, because the less privacy you have, the more it helps the company. My impression is that Zuckerberg honestly believes that the world would be better without privacy. Which is even worse than companies that are only focused on the bottom line, because at least they won't invade your privacy without a good business reason.
brudgers 15y ago
Am I the only person who has a virtual machine which is used only for Facebook?
- zorked 15y ago
  The big question is, if you don't trust it, why use it at all?
  - brudgers 15y ago
    Because people I know use it as a communication channel.
- Mistylynn 15y ago
  No, I use one.
Angostura 15y ago
I've been ensuring I log out for quite a while now. I also have all platform functions disabled in my settings. It's all extra work though. There's a lot of friction involved in remaining private
mtogo 15y ago
127.0.0.1 facebook.com 127.0.0.1 www.facebook.com 127.0.0.1 connect.facebook.com 127.0.0.1 fbcdn.com
- BrandonM 15y ago
  If you're going to go that route, it's much better to use 0.0.0.0 so that you're not sending HTTP requests to your machine. Otherwise, anything listening on port 80 (or 443, in some cases) will be receiving the requests intended for Facebook.
  - mtogo 15y ago
    Noted, thanks!
  - nieve 15y ago
    Good point, though that leads to a really simple hack to see part of what gets sent to facebook - just hook up something listening on those two and look at the logs? I like ngrep for that kind of thing, but it's perhaps perverse overkill.
indrax 15y ago
http://webgraph.com/resources/facebookblocker/ http://webgraph.com/resources/facebookblocker/ http://sharemenot.cs.washington.edu/ http://sharemenot.cs.washington.edu/
nrbafna 15y ago
okay. so, i always wanted to ask this. under privacy settings -> apps, there is a option to turn of all platform apps where i could select a few applications or all, and turn them off. but, the button to click on to turn them off is _always_ unchecked for me! screenshot for reference - http://i.minus.com/itBcjOfzcchw4.png http://i.minus.com/itBcjOfzcchw4.png
wedesoft 15y ago
I can recommend Fanboy's "Annoyance Block List". It will block requests to Twitter, Facebook, ... unless you are opening one of their sites directly. (*) http://www.fanboy.co.nz/adblock/ http://www.fanboy.co.nz/adblock/
- BrandonM 15y ago
  Don't miss the "Tracking/Stats Blocking" as well. Note that these are simply filters for AdBlock Plus. If you're already using it, it's pretty easy to add a couple more filters.
  - wedesoft 15y ago
    To block tracking I subscribed to EasyPrivacy (). () http://easylist.adblockplus.org/ http://easylist.adblockplus.org/
haberdasher 15y ago
You can use this Chrome extension to kill cookies when logging out: https://chrome.google.com/webstore/detail/bgonpegbhnjepleakgjdbaepkfedhhnf?hc=search&hcp=main https://chrome.google.com/webstore/detail/bgonpegbhnjepleakg...
matjazf 15y ago
My reply: http://matjaz.posterous.com/why-you-should-log-in-to-facebook http://matjaz.posterous.com/why-you-should-log-in-to-faceboo...
erikpukinskis 15y ago
Facebook needs to let you uncheck rights when you Connect to a site.
jfb 15y ago
One idly wonders if it is possible to turn the (to me) useless ticker feature off.
altrego99 15y ago
Don't log out, because logging out each time and logging back in is inconvenient. Use a tracker blocker instead - like Easy Privacy with Adblock Plus, or Ghostery.
random42 15y ago
One of the good way to make general users/facebook realize the privacy concerns of auto-sharing, if popular Porn websites install the FB like buttons.
chemmail 15y ago
I recently built a website on wordpress and put in facebook connect plugin. It saves ppl a few minutes to login ect. I was extremely scared about the widget that shows who has been on the site. I do not believe that just logging in gives a website permission to publish that user has been to that website. This is just the tip of the iceberg. Facebook is getting out of hand.
- nbm 15y ago
  There is no widget that shows who has been on the site, and it is not related to using Connect. There is a "Like" widget, which shows who has "Liked" the site.
eldina 15y ago
Life is fine without Dorkbook. Never used it and hopefully never will, although it is getting harder and harder as my school has started to actively use it for e.g. communication regarding potential jobs for students and graduates in companies and institutions the school cooperates with.
nikcub 15y ago
Logging out of Facebook does not do enough. It still retains cookies that specify your account ID even after you logout. You need to delete all of the Facebook cookies. Here is what cookies are retained, but you can test it for yourself to see. While logged in: datr, lu, openid_p, c_user, sct, xs and act act is your account number. now a new, fresh request after hitting logout still sends the following cookies: datr, openid_p, act, L, locale, lu, lsd, reg_fb_gate, reg_fb_ref If you do not delete cookies Facebook know and can track every user that has ever logged in at your computer.
joelanman 15y ago
Doesn't this 'frictionless' sharing have plenty of precedent online? Anyone can view the tunes I listen to on my Last.fm page, the pages I bookmark (visible by default) on Delicious. How are these social apps on Facebook different? On the point of 'noise', both these examples provide ways of making sense of the streams. Last.fm charts, Delicious popular streams, and tags.
motters 15y ago
I've been in the process of minimizing my Facebook presence, but have left the account open just in case a specific need to use it arises in future. I'm already on other social networks, and Facebook is relatively high maintenance in terms of chasing privacy issues and dealing with other nonsense. For me the cost/benefit just isn't worth it, although I realize that this won't be the case for everyone.
tarekayna 15y ago
Anything that you don't want to be published on facebook, just don't do it on facebook. So that article you want to read privately, just go to news.google.com and read as much as you want. Don't use the facebook app for that. Same thing, if you want to listen to spotify, don't link it to your facebook account, etc... This is how things have been for years, and if you are a more private person (like me), just reading news and listening to music "offline" and go to facebook when you feel like sharing.
poona 15y ago
Maybe because not everyone lives 10 minutes from each other and is 100% independently mobile? And gee... occasionally even people that you really enjoy spending time with have to move to other areas of the planet.
akulbe 15y ago
What most people fail to realize is this... Facebook is not the product Facebook is trying to sell. YOU (and everything about your life!) are what Facebook wants to sell. Facebook is the next great advertising platform, after Google.
on4n1st 15y ago
pg, you're a fucking cunt with a serious case of the gayface. unban me you little shit.
saraid216 15y ago
It's not about privacy. It's about discretion. Why is this hard to understand?
kositlaorngsri 15y ago
ผมอยู่ในสมาคมแห่งการแบ่งปันและมีนํ้าใจแบ่งปันกับเพื่อนๆในfacebook

553 points by moses1400 15y ago

This is the wild west and Facebook is doing a land grab.

From the RWW article, it looks like you have to enable a "social news app" for this to be an issue. I don't know why anyone would do that.

sp332 15y ago
Nope, the JS that Facebook gives people to embed a Like button on their page, sends the URL of the page back to FB without actually being clicked. http://www.zdnet.com/blog/facebook/germany-facebook-like-button-violates-privacy-laws/2837 http://www.zdnet.com/blog/facebook/germany-facebook-like-but...
- mpclark 15y ago
  So how many of us are concerned about this from a personal privacy point of view, but still have all the Facebook buttons and markup all over our sites? I'm a little concerned that, as a website operator, I really ought to work with Facebook because it will lead to more PVs because it is advertising my site for me. But I've been uncomfortable for some time as I watch my friends and my children slowly confuse the web and Facebook. It's easy to see a day when, for most non-techy folks, the web is Facebook. So, I can close my FB account. But I think, in the spirit of doing the right thing for the world, the web and the future, I also have to take Facebook off my site and face whatever consequences that may bring. Or am I being a fuddy-duddy old reactionary?
  - sp332 15y ago
    You can implement a "two-click like" button that mostly solves the problem. http://www.heise.de/ct/artikel/2-Klicks-fuer-mehr-Datenschutz-1333879.html http://www.heise.de/ct/artikel/2-Klicks-fuer-mehr-Datenschut... (German) Just be sure not to make your non-standard FB button look like the official one because they will get on your back about trademarks. http://adland.tv/content/heise-creates-two-click-facebook-button-avoid-traffic-tracking-facebook-peeved http://adland.tv/content/heise-creates-two-click-facebook-bu...
  - mpclark 15y ago
    Having thought about this some more, I have taken Facebook off our site. As a business we may suffer some downside as a result, but I want to (a) protect the privacy of my site's users and (b) be able to hold my head up and say I'm not part of the problem when the revolution comes.
- travisp 15y ago
  It's true that Facebook almost certainly tracks users through the like button, but that is different than what is being talked about here. When Facebook tracks that you read a webpage through a like button, they do not display it in your friends feeds. While many people reasonably aren't comfortable with Facebook knowing where you're going all the time, it is a very different thing than Facebook sharing that knowledge with all of your Facebook friends. That feature, the one the original article is talking about, requires you to specifically opt-in before the "Bob read an article about sexual dysfunction" starts showing up in everyone else's news feeds.
- jhferris3 15y ago
  That may be true, but even if it is, it isn't sharing this activity with your friends, that would be facebook doing exactly what google does with their analytics platform/js. I don't get the freakout people have over fb potentially tracking you through something you can see (the like button) vs google doing it everywhere with something you can't (the analytics js)
- shuw 15y ago
  Google Analytics sends URLs to Google on a even larger majority of websites. FB was hardly the one to start this trend. The different in FB case, that they are not "required" to track URLs so they could of chosen an alternate implementation where sites in-directly served FB scripts through their own servers. And FB would only received a request when someone interacted with their elements.
  - X-Istence 15y ago
    Google is providing a service to the owner of the website, that helps them track their content. Google isn't using it to post to a users wall/feed so that advertisers have more keywords to advertise to.
    - travisp 15y ago
      >Google isn't using it to post to a users wall/feed so that advertisers have more keywords to advertise to. Neither is Facebook. Facebook is not using their like buttons for this feature, it is a separate opt-in feature.
  - mpclark 15y ago
    Yes, this is a great idea. 'Passive' like buttons. There's no need (from my POV) for them to be active.
- prostoalex 15y ago
  The app still has to request 'publish_actions' permissions, which requires an FBConnect dialog. That URL is being used for customization of Like button, so that on some sites you can see 'Friend A, Friend B and 345 others recommended it'.

sneak 15y ago

Logging out doesn't necessarily disable the tracking, though, as the cookies are still there. You could delete them, but I bet the like buttons reset new ones, which correlates your history to you the next time you log back in. Much better is to just nullroute their netblocks at your router. That's what I do.

icebraining 15y ago
It's been already shown that FB creates an unique ID for you even if you don't have a Facebook account.
- dev1n 15y ago
  Where has this been proven?
  - polynomial 15y ago
    Poster may be referring to the phone address book scandal, probably only one example. In that case importing your facebook contacts from your phone grabbed your entire address book, with what looked like account placeholders for anyone in your phone that wasn't already on facebook. Oh, and it published all their phone numbers too. I'm sure facebook has myriad nefarious ways for tracking everyone you interact with regardless whether they have an account. And do we need to point out Double click got caught tracking individual users and lying about it over 10 years ago. Some sources would obviously be helpful, but I don't think anyone is kidding themselves about what's going on.
  - icebraining 15y ago
    It was a blog post I can't find right now, but it's easy enough to reproduce: I deleted all the cookies from Facebook and then open a tab to a site with the Like button. A cookie for facebook.com is created called "datr" with an obvious ID and an expire date two years from now.
grovulent 15y ago
where does one find these netblocks?

zerostar07 15y ago

As always Winer is worried, rightfully so, but people aren't going to log out of facebook. It seems Zuck really wants to get back at people for making him pull "Beacon" back then, so he reintroduced it. Of course it's a privacy concern, but i think people no longer have illusions about their privacy on facebook.

Alex3917 15y ago
"people aren't going to log out of facebook." I actually have a separate browser that I use just for Facebook. Granted I only do this because FB doesn't work for me in Chrome, but it's still a pretty easy way of getting the same result.
- hugh3 15y ago
  I'm seriously considering only using facebook on my phone.
  - asto 15y ago
    Your phone is where FB gets all your friends' phone numbers from whether any of you like it or not!
    - Xuzz 15y ago
      That's not true; there is a very, very specific alert shown before Facebook accesses any phone numbers. I'm not making this up, it's just how it works. Facebook does not get anything "whether you like it or not". They get the information if you specifically allow it, and only if you try to enable the Sync feature. Hell, here's a screenshot if you don't believe me: http://www.askdavetaylor.com/6-blog-pics/iphone-facebook-sync-profile-pics-3.png http://www.askdavetaylor.com/6-blog-pics/iphone-facebook-syn...
  - rhizome 15y ago
    Information leakage is much more difficult to prevent on your phone than in a browser.

badclient 15y ago

I recently decided to RSVP for a meetup on meetup.com. It was a meetup I don't, in fact, want most folks I know to know about. I made sure to use my junk email account that doesn't have my name tied to it. So I was scared shitless when after RSVP'ing I see faces of all my facebook friends and an offer to invite them. I always thought you had to do the whole facebook connect crap before websites could just splash your fb friends list at you? Then I thought about all the billion different ways facebook has to integrate them into your site and figured this must be one of the ways.

watmough 15y ago
If you don't immediate terminate your fb account when you see this, you're like one of those people who can't leave their abuser. That's just all there is to it. Just as a matter of interest, has anyone ever taken a close look at what's actually in the static content that you can download when you quit fb?
- haldean 15y ago
  Pretty much any of it. If there's a photo I want a friend of mine to see, but they don't have permission to see it, I just send them the URL of the static content and it works every time, whether or not they're logged in.
  - rw 15y ago
    No longer. Images are obfuscated (view the source of a gallery image to see what I mean).
    - X-Istence 15y ago
      So you are not able to view the following link: https://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-snc4/148199_509098132490_138900699_30219016_5205632_n.jpg https://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-snc4/148199_... Just for reference the picture should be this: http://imgur.com/UYs6H http://imgur.com/UYs6H Oh ... the way I uploaded that to imgur? Using that URL above, so clearly that is wide open to the world.

xpressyoo 15y ago

Another analysis/viewpoint: https://plus.google.com/111297306144520956414/posts/JLQogwzooYd https://plus.google.com/111297306144520956414/posts/JLQogwzo...

Garbage 15y ago

I guess, I should always browse Facebook in "Private Browsing" mode, without any other site open in that session.

deleted 15y ago

[deleted]

mike-cardwell 15y ago

RequestPolicy users are protected against this entire class of problem. When I'm looking at a webpage, I know it isn't pulling in content from any other site, including Facebook, unless I specifically allow it to.

jordinl 15y ago

So it seems the solution would be to have different browser profiles. For instance, one for regular browsing, one for FB and one for gmail?

cpeterso 15y ago
Flash cookies ("shared objects") are across shared across all browsers and browser profiles. If FB uses Flash cookies, you could log into FB on Firefox and they can still track you in Chrome!
- jordinl 15y ago
  scary...

codecaine 15y ago

I think Ghostery deserves some promotion here : http://www.ghostery.com/ http://www.ghostery.com/ available for all major browsers. It blocks near to all webbugs including the facebook social plugins.

Lagged2Death 15y ago
Great Scott, they've got an Opera plugin. (https://addons.opera.com/en/addons/extensions/details/ghostery/ https://addons.opera.com/en/addons/extensions/details/ghoste...)

keeran 15y ago

This is why I block FB in the hosts file (https://gist.github.com/1197453 https://gist.github.com/1197453) and only use my mobile devices for FB messaging.

suprgeek 15y ago

A good time to point out the Ghostery Browser extension. Use this at the most paranoid setting so that when FB and others pull stunts like these you have at least some measure of protection.

Terretta 15y ago

I recommend Ghostery: http://www.ghostery.com/ http://www.ghostery.com/ Quoting: Ghostery is your window into the invisible web – tags, web bugs, pixels and beacons that are included on web pages in order to get an idea of your online behavior. Ghostery tracks the trackers and gives you a roll-call of the ad networks, behavioral data providers, web publishers, and other companies interested in your activity. Choose to block - or not. You get control at a company level - are there some marketers you trust, but others you'd rather turn away? Ghostery lets you open the valve of your web behavior as wide or as narrow as you'd prefer.

dotmanish 15y ago
I just tried it and browsed to TechCrunch. wow.
- getsat 15y ago
  Kind of amazing how it loads 10x faster, eh?
- bryanh 15y ago
  Try avc.com next...
  - there 15y ago
    i think venturebeat.com wins. viewing an article there shows 18 blocked pieces-of-crap.
joelhaasnoot 15y ago
Another option I have installed as a Chrome extension is Disconnect.me
LogEx 15y ago
Ghostery and Disconnect are essential privacy tools in Firefox, Safari, or Chrome. Also try ShareNot on Firefox, which is experimental, but has somewhat more extensive blocking coverage than Disconnect. But more fundamental: don't log in unless you have to, log in only in private browsing windows or separate browsers from your other surfing, and also clear your cookies often to keep your not-logged-in browsing cleaner from a privacy perspective.

patangay 15y ago

I'm an engineer at facebook. I want to clear up a few things that you guys are talking about. For starters, it's true that a visit to a news story or watching a video will trigger a feed story. The point that most people seem to be missing is that this requires you to knowingly allow a social application. For example, in my case, I installed the social plugin for rdio (rdio.com). When I listen to a song on rdio, it publishes it to my friends ticker feeds. (Ticker is the bar on the side where likes, listens, reads, etc go). There are a couple websites that are doing read social browsing, for example the Washington Post's social reader (https://apps.facebook.com/wpsocialreader/ https://apps.facebook.com/wpsocialreader/). Again, just by visiting this page you will not trigger anything unless you have already allowed the application access. In the past I've setup my music player on the laptop to publish the songs I'd been listening to, to my IM client (as away messages) - Adium let's me do this out of the box. It's kind of the same idea, instead this is just built in to the website you visit or music you listen to. You can also disable any application you previously installed by going to Privacy Settings and clicking on Apps and Websites. It should all be there. You don't have to log out of facebook or close your account. Just delete all your social apps. (https://www.facebook.com/settings/?tab=privacy https://www.facebook.com/settings/?tab=privacy)

gmantastic 15y ago
That's very helpful, thanks.
paulsmith 15y ago
Is it retroactive to apps that you've installed previously? For example, I signed in with my Facebook account on 3rd party site X and accepted the permissions, and at the time it didn't auto-publish to my feed (or "ticker" or whatever), but now suddenly it will be publishing automatically without my explicit say-so?
- X-Istence 15y ago
  According to some the app will have to ask for those new permissions before it will be allowed to do them, for now.
- 15y ago

orijing 15y ago

I am a software engineer at Facebook. Bear with me because I don't have any PR-quality answer to give you. I am not on the platform team, but I have built apps before in the wild-west days. The app requires explicit permission from the user in order to post activities automatically. The idea, if you watched Mark's presentation, is called "frictionless sharing." A lot of people don't share because it's another step, but if they could install an app like the Washington Post Reader (a great app--even Mark has it installed), they are happy with sharing articles they've read with their friends. I understand you might be concerned, for example if you added that app without realizing that it will post content. If you are concerned about the privacy implications, you can always change individual permissions for an app by going to your account settings, then selecting the 'app' tab on the left, or by going to https://www.facebook.com/settings?tab=applications https://www.facebook.com/settings?tab=applications. If you are concerned about spamming your friends' news feeds, that's why we built ticker, for the light-weight activities like "watched a movie" or "listened to a song" or "read an article". If I remember correctly, the exact wording of the app permission request was alarming enough to get my full attention ("I, the application, can post as you" or something like that), so I'm worried less about a user missing that part. In my known experiences, the app was installed with the knowledge that it will share your experiences--because the idea is you want to share your activities with your friends. As soon as I read an article, my first action is to either send the link to specific people who are interested, or post it on my wall if I think everyone is interested. We operate under the assumption that users will not do what they don't want to do, as long as we make it explicit what might happen. And if they make a mistake, they can always go change their settings. So I'm not so worried about users who sign up for the Washington Post Reader app, which is marketed as a social reading experiment, and subsequently complain that it shares your read articles. You might still be concerned, in which case, please let me know why (users being misinformed?), and I'll try to pass it onto the platform folks, who were really heads-down the past few months.

X-Istence 15y ago
The reason why this bothers me is that there is no longer any EXPLICIT confirmation that I want to post something. Not sure who said it but I read it in a TechCrunch article, "Just hit play in Spotify and it will share with your friends". No, any sharing I do HAS to REQUIRE an EXPLICIT action on my part. I have to be in full control. Visiting a web site does not mean that I believe it will be interesting to my friends NOR do I want that information shared with people on Facebook. A like button that shares, much like the Google+ 1+ button is perfectly fine, I have to hover over it, and choose my circles to share with, and then share. It is not automatic once I visit the site. I don't want articles automatically being linked just because I visited a page, or clicked play in Spotify, or put the toilet seat up. It is not just privacy concerns, it is the image I try to convey while using social media sites where it is common place to be friends with your boss and or co-workers. I don't need them knowing I like the Bloodhound Gang or that I read articles about atheism in the NYT but have never read a single article about religion. Eventually all this collected data will be used against me. What if I do a simple Google search for cancer and I end up reading an article about it, that is now shared publicly, my insurance company a few years later gets a claim for cancer they claim it was a pre-existing condition and deny me coverage. These are all scenarios going through my head. I am all for the interconnected web, and making it easier for me to introduce my friends to new content across it, however it has to be done on my terms, it has to require explicit authorisation and must never do something automatically without my consent. If I like the content enough I am extremely likely to copy and paste the URL into my social networking sites, I don't mind that extra step. Create a bookmarklet that fills in some of the forms ahead of time for me (I have a reddit bookmarklet that fills out title, URL and the sub-reddit to post in (personal one for me to share links with friends)). I am more than happy to continue using the platform, but this frictionless sharing scares the crap out of me, and will see me closing my account sooner rather than later if it continues down the path that it looks to be going down.

Bo102010 15y ago

I ditched Facebook this morning when I realized my carefully-constructed "Don't show this part of my profile" list was wiped out in the last redesign. I've always thought the complaints people make after each redesign were simply resistance to change, but this time it doesn't seem worth it to continue.

zdrtx 15y ago
Could you be a little more specific? What kinds of things were you not showing that are now showing?
- Bo102010 15y ago
  I had my privacy settings set to "Custom" for wall posts, photos, and some other profile elements. I excluded a list of people from seeing posts I made and posts other people put on my wall. When I used the "View my profile as," I wouldn't see the excluded elements. Once the new design launch, I realized that all these settings were lost - I can do "View my profile as" one of the people on my excluded list, and see the stuff I didn't want shown.
akarambir 15y ago
I too for the same reason have deleted my account. I don't feel i'm in control. Its too risky.
- watmough 15y ago
  Accessing facebook.com/watmough ('deleted' account) shows 'content currently unavailable'. This used to be my account. Accessing facebook.com/jonathanwatmough (likely not an account) shows standard 'page not found error'. Deleting a fb account may not mean what you would expect it does. I think they are keeping my data warm for me. And keeping your data warm too.
  - dkokelley 15y ago
    Your information will likely never leave Facebook. I know of a few people who "cancelled" their accounts, only to rejoin at a later time. Their information was preserved. They didn't even have to re-friend me.

chailatte 15y ago

Switch to other services (Instagram, Twitter, Google+). Problem solved. Unless you like to be in S/M relationship. You're the S.

nemik 15y ago
I think you got those mixed up.

martingordon 15y ago

As the two FB engineers mentioned, you have to allow access to the app before it can know anything about you or take action on your behalf. See Step 2 of the Open Graph tutorial: https://developers.facebook.com/docs/beta/opengraph/tutorial/ https://developers.facebook.com/docs/beta/opengraph/tutorial... Publishing actions requires the publish_actions permission, so if the app previously didn't ask for it, I believe you will be asked to re-authenticate the app with the new permissions. I, for one, am going to be reviewing the apps I've previously added to ensure that none of them are doing anything I wouldn't want to. Not sure where to file FB API feature requests, but it would be nice to not have an "all or nothing" approach to authentication (this is a problem with the Twitter API as well, FWIW). For example, if an app requires X, Y and Z permissions, I might want to only allow X and Y and just not use the features that require Z.

Slizyboy 15y ago
You can always remove Z later, but for the initial authentication I think you do have to grant all the permissions it asks for.
rhizome 15y ago
Indeed there is a race condition (if that) where you have to allow access at the default privileges before opting out of any of them. I'm sure every single application sucks in your entire graph as soon as you click that button, so the solution to limit permissions after installing the app is just so much closing of the barn door after the horses have left.

molecularbutter 15y ago

LOL at all the facebook employees who are chiming into this thread (and others) to defend the latest creepery from their professionally invasive advertising company. I know you're just waiting for the IPO to cash in, but come on, how can you defend this nonsense?

lbrandy 15y ago
Is this -really- what hacker news has become? Really?
nak3d 15y ago
It's the All-Hands Kool Aid Q&As with Zuck on Friday.

ngmcs8203 15y ago

This really comes down to Winer's tin foil hat obscuring what's actually happening and writing the story to reflect his lack of facts. For these "reading a story" posts to get to your timeline, you have to opt-in by installing the app and giving it permission to do that. If you're dumb enough to do that and get offended, maybe you should close your Facebook account.

X-Istence 15y ago
Some webapps require using Facebook to login to even create an account on their site. Now you can say that then they shouldn't use said site, but soon this is going to become more and more common, what then?
deleted 15y ago
[deleted]
mpclark 15y ago
Well, that may be the way it works after F8 2011, but there's got to be a good chance it will have changed to remove this little bit of 'friction' by F8 2012...

stfu 15y ago

Oh, so Facebook already sent their minions to HN? That was fast! Lately the negative stories are gaining a bit of a momentum. Very much like that development.

deleted 15y ago

[deleted]

pointyhat 15y ago

All the Facebook engineers on here sound like I imagine IBM executives do when asked about the involvement of IBM in the holocaust... I'm genuinely surprised that the EU haven't stepped on Facebook yet. It's the creepiest, most invasive thing ever developed.

mwsherman 15y ago

Wouldn’t disabling third-party cookies take care of this? (And many other questionable things?)

nostromo 15y ago
In Chrome the option is to block 3rd party cookies from being set, not from being sent. Since Facebook sets its cookie while I am on their domain, I don't believe Chrome's blocking option is of any use.
- mikewest 15y ago
  In `about:flags` there's an option to change third-party cookie blocking behavior to prevent reading third-party cookies as well.
  - nostromo 15y ago
    Cool, thanks!

codeup 15y ago

The apologetic posts by Facebook engineers give deep insights. Of course they can argue well on what are, for average users, technical details. On that level, it is possible to get entangled in endless discussions. The real problem is that these posters seem to totally lack (or ignore) an understanding of the bigger picture of what they are contributing to.

guelo 15y ago

The latest url for app permissions is http://www.facebook.com/settings?tab=applications http://www.facebook.com/settings?tab=applications

kragen 15y ago

I've been logging in to Facebook and Google+ only in a Chrome Incognito window for this reason for a while now. I recommend the practice to everyone. However, yesterday Facebook locked my account because I was browsing "from an unknown device" (the netbook I've been using for years, on the IP address of PyCon Argentina). I unlocked it by identifying five of my Friends from 15 photos. So it's not without its drawbacks.

nbm 15y ago
In this case your account probably was not locked, you just needed to provide additional information to log in because something seemed unusual. So if you logged in from a known-good environment (ie, a computer we know you have logged in before), it would work - you aren't locked out of your account. This is one of a few different systems we have to protect our users - in this case from having their credentials used if they are exposed through others sites, through phishing, or through some other mechanisms. You can a little about it at https://blog.facebook.com/blog.php?post=389991097130 https://blog.facebook.com/blog.php?post=389991097130 The social authentication is one way we help people verify their identity in these cases - you can read about it at https://blog.facebook.com/blog.php?post=486790652130 https://blog.facebook.com/blog.php?post=486790652130 . There are others - the easiest for most people is through sending a text message to your phone when you log in from a new device, which you can read about at https://www.facebook.com/note.php?note_id=10150172618258920 https://www.facebook.com/note.php?note_id=10150172618258920 If you are concerned about privacy, but not happy about having to log in from scratch each time and occasionally have to go through these steps (or not comfortable giving or not able to give a phone number for text message authentication), you might want to use a separate dedicated browser for Facebook that does have cookies enabled.

deleted 15y ago

[deleted]

nextparadigms 15y ago

If people think Zuckerberg had "vision" doing this, I suppose I agree. But his vision wasn't "how can I help people have better online connections and experiences?" or anything like that. His vision was "how can I get people to share everything about their life, so Facebook can make more money?" They are not one and the same thing, because in the latter, the priority is put on optimizing the experience for Facebook, not for the user. Zuckerberg actually believes that there should be no privacy - at all. This is where he's leading Facebook. I believe that's a flawed vision, but he's probably sticking to it, because the less privacy you have, the more it helps the company.

nak3d 15y ago
"We Are Building A Web Where The Default Is Social" - Mark Zuckerberg Mark Zuckerberg is dead set on making Beacon work. This is his latest attempt by making the apps do their dirty work by asking for a permission and auto-sharing.
orangecat 15y ago
Zuckerberg actually believes that there should be no privacy - at all. This is where he's leading Facebook. I believe that's a flawed vision, but he's probably sticking to it, because the less privacy you have, the more it helps the company. My impression is that Zuckerberg honestly believes that the world would be better without privacy. Which is even worse than companies that are only focused on the bottom line, because at least they won't invade your privacy without a good business reason.

brudgers 15y ago

Am I the only person who has a virtual machine which is used only for Facebook?

zorked 15y ago
The big question is, if you don't trust it, why use it at all?
- brudgers 15y ago
  Because people I know use it as a communication channel.
Mistylynn 15y ago
No, I use one.

Angostura 15y ago

I've been ensuring I log out for quite a while now. I also have all platform functions disabled in my settings. It's all extra work though. There's a lot of friction involved in remaining private

mtogo 15y ago

127.0.0.1 facebook.com 127.0.0.1 www.facebook.com 127.0.0.1 connect.facebook.com 127.0.0.1 fbcdn.com

BrandonM 15y ago
If you're going to go that route, it's much better to use 0.0.0.0 so that you're not sending HTTP requests to your machine. Otherwise, anything listening on port 80 (or 443, in some cases) will be receiving the requests intended for Facebook.
- mtogo 15y ago
  Noted, thanks!
- nieve 15y ago
  Good point, though that leads to a really simple hack to see part of what gets sent to facebook - just hook up something listening on those two and look at the logs? I like ngrep for that kind of thing, but it's perhaps perverse overkill.

indrax 15y ago

http://webgraph.com/resources/facebookblocker/ http://webgraph.com/resources/facebookblocker/ http://sharemenot.cs.washington.edu/ http://sharemenot.cs.washington.edu/

nrbafna 15y ago

okay. so, i always wanted to ask this. under privacy settings -> apps, there is a option to turn of all platform apps where i could select a few applications or all, and turn them off. but, the button to click on to turn them off is _always_ unchecked for me! screenshot for reference - http://i.minus.com/itBcjOfzcchw4.png http://i.minus.com/itBcjOfzcchw4.png

wedesoft 15y ago

I can recommend Fanboy's "Annoyance Block List". It will block requests to Twitter, Facebook, ... unless you are opening one of their sites directly. (*) http://www.fanboy.co.nz/adblock/ http://www.fanboy.co.nz/adblock/

BrandonM 15y ago
Don't miss the "Tracking/Stats Blocking" as well. Note that these are simply filters for AdBlock Plus. If you're already using it, it's pretty easy to add a couple more filters.
- wedesoft 15y ago
  To block tracking I subscribed to EasyPrivacy (). () http://easylist.adblockplus.org/ http://easylist.adblockplus.org/

haberdasher 15y ago

You can use this Chrome extension to kill cookies when logging out: https://chrome.google.com/webstore/detail/bgonpegbhnjepleakgjdbaepkfedhhnf?hc=search&hcp=main https://chrome.google.com/webstore/detail/bgonpegbhnjepleakg...

matjazf 15y ago

My reply: http://matjaz.posterous.com/why-you-should-log-in-to-facebook http://matjaz.posterous.com/why-you-should-log-in-to-faceboo...

erikpukinskis 15y ago

Facebook needs to let you uncheck rights when you Connect to a site.

jfb 15y ago

One idly wonders if it is possible to turn the (to me) useless ticker feature off.

altrego99 15y ago

Don't log out, because logging out each time and logging back in is inconvenient. Use a tracker blocker instead - like Easy Privacy with Adblock Plus, or Ghostery.

random42 15y ago

One of the good way to make general users/facebook realize the privacy concerns of auto-sharing, if popular Porn websites install the FB like buttons.

chemmail 15y ago

I recently built a website on wordpress and put in facebook connect plugin. It saves ppl a few minutes to login ect. I was extremely scared about the widget that shows who has been on the site. I do not believe that just logging in gives a website permission to publish that user has been to that website. This is just the tip of the iceberg. Facebook is getting out of hand.

nbm 15y ago
There is no widget that shows who has been on the site, and it is not related to using Connect. There is a "Like" widget, which shows who has "Liked" the site.

eldina 15y ago

Life is fine without Dorkbook. Never used it and hopefully never will, although it is getting harder and harder as my school has started to actively use it for e.g. communication regarding potential jobs for students and graduates in companies and institutions the school cooperates with.

nikcub 15y ago

Logging out of Facebook does not do enough. It still retains cookies that specify your account ID even after you logout. You need to delete all of the Facebook cookies. Here is what cookies are retained, but you can test it for yourself to see. While logged in: datr, lu, openid_p, c_user, sct, xs and act act is your account number. now a new, fresh request after hitting logout still sends the following cookies: datr, openid_p, act, L, locale, lu, lsd, reg_fb_gate, reg_fb_ref If you do not delete cookies Facebook know and can track every user that has ever logged in at your computer.

joelanman 15y ago

Doesn't this 'frictionless' sharing have plenty of precedent online? Anyone can view the tunes I listen to on my Last.fm page, the pages I bookmark (visible by default) on Delicious. How are these social apps on Facebook different? On the point of 'noise', both these examples provide ways of making sense of the streams. Last.fm charts, Delicious popular streams, and tags.

motters 15y ago

I've been in the process of minimizing my Facebook presence, but have left the account open just in case a specific need to use it arises in future. I'm already on other social networks, and Facebook is relatively high maintenance in terms of chasing privacy issues and dealing with other nonsense. For me the cost/benefit just isn't worth it, although I realize that this won't be the case for everyone.

tarekayna 15y ago

Anything that you don't want to be published on facebook, just don't do it on facebook. So that article you want to read privately, just go to news.google.com and read as much as you want. Don't use the facebook app for that. Same thing, if you want to listen to spotify, don't link it to your facebook account, etc... This is how things have been for years, and if you are a more private person (like me), just reading news and listening to music "offline" and go to facebook when you feel like sharing.

poona 15y ago

Maybe because not everyone lives 10 minutes from each other and is 100% independently mobile? And gee... occasionally even people that you really enjoy spending time with have to move to other areas of the planet.

akulbe 15y ago

What most people fail to realize is this... Facebook is not the product Facebook is trying to sell. YOU (and everything about your life!) are what Facebook wants to sell. Facebook is the next great advertising platform, after Google.

on4n1st 15y ago

pg, you're a fucking cunt with a serious case of the gayface. unban me you little shit.

saraid216 15y ago

It's not about privacy. It's about discretion. Why is this hard to understand?

kositlaorngsri 15y ago

ผมอยู่ในสมาคมแห่งการแบ่งปันและมีนํ้าใจแบ่งปันกับเพื่อนๆในfacebook