13 ms·
Facebook Shadow Profiles [pdf]
- civilized 5y agoFB should fix the dozen or so shadow profiles of everyone's grandma that have been cropping up for several years now.
- kritiko 5y agoI would be interested to know how the claim here that 50% of all sites are tracked by Facebook compares to Google's profiling across the web...
- zelphirkalt 5y agoWithout looking up any sources, I would say that Google is even more pervasive. I would estimate around 80-90% of the websites include some kind of Google tracking.
- u2077 5y agoI have been using DDG on mobile for about a few years. It shows you the most blocked trackers and google is by far the worst. Google trackers were found on 31% of websites I visit whereas Facebook trackers are at 4%. My results may be skewed because I never visit or view any content on Facebook, but I do the occasional google search when I can’t find something.
- zelphirkalt 5y agoOnly 31%? Are you sure? I mean, I block all Google domains, including fonts and stuff, but 31% seems low. Does that count things like fonts from Google domains and other things that could be used to track users? It feels like whenever I check my ad blocker's block settings for a page, I see Google stuff.
- u2077 5y agoNote that this is on mobile where my searches aren’t all that unique. I mostly visit HN and a few other sites daily. I guess if you want more realistic results then I should look at my pc. I visit a lot more sites when researching/coding so that would be more accurate, but I don’t have the extension installed.
- MikeGale 5y agoI'm not using DDG but I have checked how many sites use Google facilities which track. A lot more than 0.3.
- agmater 5y agoAre you counting Google Analytics as tracking as well?
- zelphirkalt 5y agoOf course. What else would you name it?
- specialist 5y agoNSA, Facebook, LexisNexus (neé Seisent), others, have uniquely identified and track everyone, in near realtime. There need not be any bots, sockpuppets, fake accounts. Alas, fraud is Facebook's biz model. Effectively preventing inauthentic activity would reveal the lie. Better the bureaucratic kabuki, shielding Facebook (and others) with the respectable veneer of plausible denability.
- mistrial9 5y agofor multiple reasons, this is not accurate. The actual situation is difficult, lets not use words like "everyone" "all" "always" for untangling the mess, right?
- specialist 5y agoFor the Americas, since at least mid 2000s, everyone is tagged and tracked in near real time. I'd be surprised (shocked) if those systems weren't global today. How could it be otherwise?
- netsharc 5y agoGot proof, or "just trust me"? How do people still disappear, or commit attacks like the Boston bombing and the authorities have to go on man hunts trying to figure out who they were?
- nebula8804 5y agoThis event was ~9 years ago. Thats eons in the tech industry.
- specialist 5y agoProof? You want proof for something that has to be true? Phones, accounts, habits, preferences, property, births, deaths. Everything recorded, aggregated. Everything. Do you doubt this? Everyone's entire lifestream is archived. To leave no record, no trace, takes extraordinary effort and resources. Or to be completely off grid, living like a neolithic nomad; the same as not existing at all. -- Even in 2000s, Seisent was being used to solve cold cases. Queries to identify suspects. Big data to reveal any one without an allibi. It's like the 1,000s of rape kits, collected but unprocessed. Why? What possible reason can there be to not investigate? To not close those cases? We can only guess. Perhaps the people responsible don't want to know.
- anonu 5y agoI watched the Zuckerberg Senate hearings back in 2018. Transcript here [1]. I remember his answer on whether users are tracked when logged off. I mean the answer can really be a very simple Yes. But instead we got this evasion (I lightly cleaned up): WICKER: One other thing: There have been reports that Facebook can track a user's Internet browsing activity, even after that user has logged off of the Facebook platform. Can you confirm whether or not this is true? ZUCKERBERG: Senator — I — I want to make sure I get this accurate, so it would probably be better to have my team follow up afterwards. WICKER: You don't know? ZUCKERBERG: I know that the — people use cookies on the Internet, and that you can probably correlate activity between — between sessions. We do that for a number of reasons, including security, and including measuring ads to make sure that the ad experiences are the most effective, which, of course, people can opt out of. But I want to make sure that I'm precise in my answer, so let me ... WICKER: When — well, when you get ... ZUCKERBERG: ... follow up with you on that. [1] https://www.washingtonpost.com/news/the-switch/wp/2018/04/10/transcript-of-mark-zuckerbergs-senate-hearing/ https://www.washingtonpost.com/news/the-switch/wp/2018/04/10...
- harles 5y agoThe senate hearings are just theater. Important questions like this should probably be async - compel the companies to provide specific answers on the record.
- colordrops 5y agoEspecially Feinstein grilling him about privacy, when she votes for and often even sponsors every privacy invading bill and three letter agency out there.
- ceejayoz 5y agoIt's not necessarily inconsistent to hold the position that government should be able to invade privacy in ways private corporations should not. As a concrete example, search warrants for crimes. That said, I'm of the opinion Feinstein is largely senile at this point, and wish she'd retire.
- sebow 5y agoRhetorical question ahead: Wasn't this a conspiracy theory?What happened? Well, short memory/attention span or straight out ignorance of the masses happened.When those ideas first circulated mainly by affected users noticing such practices(shadow-banning for example), those were the first to be burned at the stake.Then whistle blowers came and dropped some well intentioned crumbs first amongst circles of "techies", mainly anonymously.(it was much later on when 'actual proof' was given to the media outlets -- out of which the vast majority disregarded them --) Did not matter in the grand scheme though: employees were fired, media articles did damage control(>for< the company, most often than not; because a Company doing the damage control is partially admitting a degree of truth to the claim), and let's also mention the 'useful idiots' who believed the authoritative voices because 'history is written by the victors': which is now mostly a cyclic numbers game of how well one controls a narrative in the social network(/any other information channel).Considering the attacked entity is the social media platform itself, the discourse medium was inevitable advantageous and easily skewed for the platform to defend itself.The more principled either staid in the mud, fighting skeptics of the rumors, or moved platforms towards less censorious and/or anonymous places.Truth ultimately did not matter, the platform did the required divide & conquer to shift the attention. It's really miniaturized politics, except it's actually worse: there's no democracy(well unless you're talking board of directors and such, but that almost never happens: such optics tank your stock).To quote the hypocritical statement of people who like authoritative voices and also 'like the free markets'[which by the way ideologically speaking is a contradiction, unlike you're by definition a fascist; Granted here we've substituted the authority from the state to the company itself]: "They're a private company, they can do whatever they want."; At the end of the day FB is already ~dead, and Zuck knows this.Some people (users who know the skeletons in the closet, the company, entities that use it to push their narratives) probably will continue to ride it out as long as the naivety of the vast majority continues.
- slg 5y agoFacebook also has shadow profiles for non-users that connect directly to name, email address, and/or phone number. At the very least these seem to be populated when people share their contact list with Facebook. I have long wondered whether they can match these two kinds of shadow profiles together. One profile with personally identifiable information. The other profile with detailed browsing history. That would raise a huge privacy concern especially since these are non-Facebook users and therefore people who have not opted into this at any level.
- tacotacotaco 5y agoI was told by a friend that when they uploaded a picture with me in it Facebook auto tagged me. I have never created a Facebook or Instagram account. I want no business with that company. I am annoyed that I am still profiled by them.
- kibwen 5y agoIn the grim darkness of the near future, nobody leaves their house without painting their faces with CSAM in order to prevent cloud services from storing their images.
- cryptonector 5y agoWow, that's pretty dark. On the plus side, pedophiles working at Facebook will have a great time. /s
- disqard 5y agoDid you happen to read this today, or did you just come up with that purely by coincidence? https://www.invenglobal.com/articles/16506/facebookmeta-executive-loses-job-after-attempted-child-sex-allegations-following-sting-operation https://www.invenglobal.com/articles/16506/facebookmeta-exec...
- cryptonector 5y ago
- kleinsch 5y agoIf I'm reading the actual paper correctly, they looked at Nielsen data from 2016 and figured out that FB trackers fire for a large percentage of web traffic for both FB users and non-users. Their conclusion is that it's likely FB has the data to be able to build shadow profiles, not that they have any indication FB actually does build shadow profiles. I would be curious about an update based on newer data. 6 years later, even more traffic is mobile where privacy protection is stronger and GDPR has companies more concerned about data sharing and trackers. I'm sure if you included mobile traffic, the trend over time is dropping (with a big dip when iOS 14 came out).
- romanhn 5y agoYeah, I was really curious about the current state of things, but lost interest after reading the abstract, which was very careful to use "may" everywhere. It's quite a leap to go from "they could do X if they wanted to" to "they're doing X". FWIW, when I worked at Facebook the internal narrative was that shadow profiles were not a thing. Given that everyone had access to source control, one would think any enterprising engineer could easily contradict this, but I don't recall it being actively questioned internally (while many of the company's policies were).
- disgruntledphd2 5y agoMan, i hate finally admitting this on HN, but I spent a bunch of years as an FB employee, as a data scientist (on ads). I can speak with complete sincerity and say that shadow profiles were not a thing, and were never a thing during or before my time (before, I can't be 100% certain, but I schlepped through the repos and never found examples of same). What generally happens is that you pick a userid (maybe zero for arguments sake), and everyone who doesn't match to an FB userid gets that number. It didn't make it impossible to build an individual profile, but it made it much, much, much more difficult and I never saw anyone do it. I left in 2018, and would be massively surprised if anyone had built this since. Now, it is entirely possible that not everyone was as rigorous as removing userid=0 (for example) and so some FB data probably counts them, and they may be in some of the clustering models but the notion that they have profiles indexed by browser/device id is completely false (for ads at least, some of the crap they did for PYMK was insane).
- gzer0 5y ago> We have access to individual-level desktop browsing data of a representative sample of the U.S. population via the market research firm Nielsen. Participants are incentivized to install a software that records all web browsing activity and fill in a survey of basic demographics, such as gender, employment, age, education, and income This seems to be an inherently flawed collection methodology. The users that one would expect to be involved with these "install this software, download this app and earn free money!!" schemes would also typically be associated with certain activities that would not necessarily reflect the overall population. The experiment groups themselves are flawed, but then again, I also cannot think of an ethical/legal way to conduct this kind of research.
- reaperducer 5y agoSelection bias is kind of a HN go-to for dismissing this people don't agree with. Bit something I learned in my college statistics courses is that with a large enough sample, self-selection bias stops becoming a problem. It was a long time ago, so I can't explain the math here. But from what I remember, you need a surprisingly small sample size to actually achieve real representation.
- pid-1 5y agoThe math is called law of large numbers. It might work well, badly or not work at all depending on the distribution and the sampling methodology. Statistics as an area is full of gotchas, I never dismiss this sort of complain unless I have robust assumptions about the distribution being studied.
- disgruntledphd2 5y agoWho needs a distribution when you have a collection of means?
- dragonwriter 5y ago> The math is called law of large numbers That reduces sampling error, not non-sampling error.
- apollo1213 5y agoDirect link to view the pdf file: https://docmadeeasy.com/v/003107877 https://docmadeeasy.com/v/003107877
- axegon_ 5y agoThat shouldn't be a surprise. At an old job with far smaller user base, we used to do something very similar and while the shadow profiles were not materialized in the form of actual profiles, the amount of data you can gather about someone just by having his/her number pop up in the contact list of several of your actual users is staggering: full name, workplace, city/neighborhood where they live, their partners, their hobbies and all sorts of things which you generally should not know. And we are not talking people who have their entire life published online, but people with little to no online visibility. Assuming that facebook is not doing something similar considering that their main business comes from profiling and modeling user behavior is just naive.
- matchagaucho 5y agoSeriously. Once a mobile app is granted access to contacts, it has your entire social graph. Every app since 2012 has been building these shadow social graphs.
- spullara 5y agoWell before 2012. Started as soon as you could access the address book through an API - not just on the phone. First one that got a lot of bad press was Plaxo which launched in 2002.
- scoot 5y agoNot forgetting sixdegrees.com (1997-2000). Sure, it didn't access your address book directly, but it did abuse your social graph. In my memory Plaxo was connected somehow (same founder?), but it's a long time ago, so I might be mistaken.
- chaostheory 5y agoAmazon bought six degrees
- hutzlibu 5y ago"Every app since 2012 has been building these shadow social graphs." No, not every app. There are still open source apps who usually do not do this and there are probably also some proprietary ones with ethics who have not given into it. But that this is the default and there is no big outcry is probably because allmost no one outside tech circles understands anything of it, or just throw their hands in the air.
- hyperpallium2 5y agolink to pdf https://www.cesifo.org/DocDL/cesifo1_wp9571.pdf https://www.cesifo.org/DocDL/cesifo1_wp9571.pdf
- john-doe 5y agoHTML: https://papertohtml.org/paper?id=bc062760a8938d7e4bec9aedfd4528d053397860 https://papertohtml.org/paper?id=bc062760a8938d7e4bec9aedfd4...
- mhardcastle 5y agoI've always wondered how this works with CCPA. I attempted to exercise my right to data deletion and was directed to log in. Do those with shadow accounts not have the right to have their data deleted?
- jedberg 5y agoTechnically that isn’t your data it’s their data (or your friend’s data). It’s definitely a gray area.
- Hamuko 5y agoIf a company has your personal information, it is your data, no matter who uploaded it.
- bagels 5y agoI'm not so sure it's so obvious, legally, that you own facts about you.
- littlestymaar 5y agoNot a lawyer, and I know nothing about CCPA, but under GDPR at least, this is unambiguously your personal data.
- stingraycharles 5y agoI think the point was that this data, the shadow profile, is derived from a friend’s pictures etc, and as such the legal copyright to the picture (that would need to be deleted) lies with the friend. Or that’s how I understood it anyway, correct me if I’m wrong.
- lmkg 5y agoThe copyright doesn't affect anything. The information about people derived from the picture is a separate artifact from the picture itself. That information is owned by Facebook, not the copyright holder of the picture, and its distribution is subject to a different set of laws. It counts as Personal Data under GDPR and Personal Information under CCPA, as well as biometric information under BIPA in Illinois. The real issue is that CCPA can only be enforced by the California Attorney General's office. This means that Facebook's violation of CCPA is, quite literally, as much of a political issue as a legal one. (CCPA's private right of action only applies to data breaches, not to other CCPA violations.)
- saos 5y ago
- CSSer 5y ago> Google... has shifted to using its Chrome browser to track online activities. I really wish they were more specific about some of these claims.
- jeffbee 5y agoThe whole thing is wall-to-wall innuendo. There's no hard facts in here anywhere.
- littlestymaar 5y agoEvery now and then, on HN people complain about how the EU is boring with its stupid regulations (GDPR, mainly). But see, this is exactly the kind of things GDPR is made to prevent, and without it that's what you end up with.
- lillesvin 5y agoIt doesn't prevent much in this particular case though. I closed my Facebook account some 12-13 years ago and I recently contacted them and asked to see what data they had on me (under the GDPR, because of shadow profiles). They absolutely refused to neither confirm or deny that they were building shadow profiles but kept repeating that if I didn't have an account, they didn't hold any data on me and then followed up by answering that if someone let Facebook rummage through their contacts and I was among them, then they'd of course hold that data until that someone decided to delete it... So, yeah...
- littlestymaar 5y agoLaw alone doesn't prevent anything by itself, enforcement does. Facebook's answer is likely illegal (Not a lawyer), get in touch with your local privacy defense group.
- MichaelMoser123 5y agoA link that is shared on facebook gets an additional fbclid query parameter (interesting that google has it's equivalent glclid query parameter for links from google adds).I think that it is easy to get rid of this query parameter, when want to use such a link. (just adding, as I don't see that mentioned in the pdf) I think that the purpose of this query param is to act as a substitute for cross site cookies: when you click on some link then the original url is further transfered as the http referrer header of the http request, if they can get hold of the logs of some affiliated site, then they can possibly track the flow of these fbclid attributes. Interesting to observe, how every tiny detail is getting used for tracking purposes. I guess that browsers won't get rid of any specific query parameters when the url is passed as the referrer header, as that would be a violation of the protocol. However it may be possible to write a browser plug-in that does so.
- gridland 5y agoI work in advertising. The death of cookies is a huge annoyance to the industry. you are 100% correct that gclid or fbclid are just a means to store "the cookie" in plain text in the url string. All the big programmatic media platforms do it too now (The Trade Desk, Yahoo, etc).
- MichaelMoser123 5y agothanks! I don't know much about the advertising industry, I just thought about the following question: if some site is hosting a pop-up advertisement, then the javascript on that advertisement can get the referrer header by means of its own javascript code. Now my question is: do the different advertising networks share that data between one another? I guess that it might be a big business, if yahoo ads would trade the obtained glcid parameter values with google, or vise versa.
- jsemrau 5y agoAdvertising will change significantly in the years to come. All of this surveillance is not useful for both sides. I think we have reached a point where we can use better social networks and more fun concepts to connect with one another. Hint: I work at finclout.io
- Lamad123 5y agoThis evil company going to shit should feel like good news to most of us regular folks.
- elptacek 5y agoI've seen many apps sending metrics to domains owned by Facebook while I was testing them. This does not surprise me at all.
- makecheck 5y agoI’m reminded of those Apple commercials where a person is wandering around town and is followed by increasingly large groups of people (e.g. the cashiers of all the places they were just shopping), creepily looking over their shoulders at everything. This was never “OK” for people to be doing before the Internet/Facebook so why should it be “OK” now? Stalking is now stalking “with computers” so that makes it a novel concept? P.S. That’s why you never give your phone number to ANY company, it’s too easy for them to connect a bunch of dots. And if a service one day decides to ask “for security”, interpret it as “for farming your data” and stop using them.
- IMAYousaf 5y agoIf I wanted to learn how to build an algorithm that can create shadow profiles from say a set of data/inputs, where would I best learn that short of working on this at Facebook?