10 ms·

Facebook fixes logout issue

71 points by nikcub 15y ago

altrego99 15y ago
> There is a bug where a_user was not cleared on logout. Yeah, right! Sure it was a bug.
code_duck 15y ago
So, do the remaining cookies truly not contain data which can identify a specific user to Facebook?
- nikcub 15y ago
  Facebook say they do not I would prefer they deleted all cookies, since the user/browser can still be uniquely identified
- sp332 15y ago
  You can use this page to see how "unique" your browser is. https://panopticlick.eff.org/ https://panopticlick.eff.org/ It doesn't use cookies.
  - anonymoushn 15y ago
    Your browser fingerprint appears to be unique among the 1,777,057 tested so far That is a bit unsettling.
    - mirkules 15y ago
      Using Firefox with NoScript produces (OS X 10.6): "Within our dataset of several million visitors, only one in 27,775 browsers have the same fingerprint as yours." But turning on Javascript, but leaving FlashBlock on, produces the same message as yours. Interesting...
      - code_duck 15y ago
        Definitely, most of the identifiability comes from data only available from JavaScript such as the combination of screen resolution and available fonts.
  - keithpeter 15y ago
    I got the same number as anonymous below me. The biggest cause of uniqueness was the installed fonts reported by the browser. I'm on Linux and we have some weird ones....
    - sp332 15y ago
      Yeah, between plugins and fonts, most browsers show up as "unique" in that tool which are merely unusual. I'm using a Firefox alpha build, and it says that alone is enough to identify me, even though obviously it isn't.
      - true_religion 15y ago
        I think its the ordering of the installed fonts that matters. Your browser doesn't report the fonts on your computer in alphabetical order.
  - cousin_it 15y ago
    Most interesting link I've seen today, thanks! So as long as you log in to Facebook often enough (more often than you install new browser plugins or fonts or whatever), they can cookieless-track you perfectly when you're logged out, by remembering the browser fingerprint you had when you were logged in. And even if the fingerprint changes a little bit, they could use something like Levenshtein distance, combined with statistics of frequently visited sites, to have a good chance of identifying you anyway. In the hypothetical world where Facebook was an evil monster of surveillance, of course. I'm not talking about the real world here ;-) So what can you do when faced by a hypothetical monster like that? Disabling third-party cookies is only the first step. Is there any reasonable way to anonymize your browser fingerprint?
    - Vivtek 15y ago
      Use a different browser?
    - MartinCron 15y ago
      Is there any reasonable way to anonymize your browser fingerprint? Maybe not totally anonymize, but a lot of the data that gets used for browser fingerprinting relies on flash to work, so if you run without flash on by default (click to flash, or whatever) that should help.
y0ghur7_xxx 15y ago
They don't need the cookie to track you anyway. Cookie-less tracking is no problem. Not deleting the cookie was making the tracking just a little bit easier, but I am sure they track users anyway, as long as they download the like widgets that webmasters put on their pages.
- lbrandy 15y ago
  > I am sure they track users anyway Just so we are clear: we don't cookieless "track users anyway". I suppose you guys can line up to say I'm lying like you did to the other engineers who posted yesterday, and it is quite obviously impossible for me to prove otherwise. But suffice to say our policies are rather clear on the issue.
  - sp332 15y ago
    If I am logged out, and I just visit a page with a "Like" button, what info does Facebook get about me?
    - tiles 15y ago
      You can view browser headers and see this for yourself, if you're curious. In Chrome, go to the Developer Tools -> Network Tab, refresh a page with the "like" button, look for "like.php" and all the corresponding resources loaded by it, and look at the "headers" tab for each. You can see what data is being sent to Facebook and draw your own conclusions about how anonymous it makes you.
  - tiles 15y ago
    While it's unfortunate you're being thrown under the bus for this issue (I cannot prove Facebook is tracking me via my browser headers or not, it's simply dependent on how much trust I give to your company), this is a really healthy and important development that people are coming to. Facebook isn't the -only- company which has the potential to track you across the web; it's incredibly easy to do with ads, Digg buttons, Tweet buttons, and whatever new social network hits the stage. Some of these organizations may not have had such high profile cases as Facebook, which for all of its mishaps has at least responded to user's concerns. We need to enter into an awareness about how identifiable we are just browsing the internet. Average users need to know this. It's not like Facebook can force browsers to not send identifiable content and its refusing to--web browsing has been designed to allow third party content just like that. So we need to start exploring the ways in which this amount of trust to third party content isn't so implicit.
mingyeow 15y ago
"There is a bug where a_user was not cleared on logout. We will be fixing that today." PR speak. This seems much less like a bug to me, more like a poorly contemplated decision. What seems more likely is that they were contemplating what they should do, and given the general direction Facebook is headed, they probably thought little of just leaving it in. I love the facebook guys, but calling it a bug as opposed to a non-malicious decision is just PR speak
- yuliyp 15y ago
  The fact that it could be removed overnight should give you a hint about how much it was actually used.
  - hockeybias 15y ago
    Apples and oranges dude...
- deleted 15y ago
  [deleted]
Slimy 15y ago
A Facebook engineer has made a statement saying there was not tracking involved in the "Update" section of this article: http://www.zdnet.com/blog/facebook/facebook-fixes-cookie-behavior-after-logging-out/4120 http://www.zdnet.com/blog/facebook/facebook-fixes-cookie-beh...
newchimedes 15y ago
Wasn't there a FB engineer yesterday who said that this "problem" would take a long time to fix? Apparently it didn't take that long.
- newchimedes 15y ago
  Here's the article I mentioned: http://blogs.wsj.com/digits/2011/09/26/facebook-defends-getting-data-from-logged-out-users/ http://blogs.wsj.com/digits/2011/09/26/facebook-defends-gett...
RexRollman 15y ago
As anyone who frequents HN would notice, I do not care for Facebook. I don't like it as a company and I do not care for its founder. But with that said, I am glad to see that Facebook addressed this issue. And thanks to Nik for bringing this to the light.
- code_duck 15y ago
  Facebook created this issue... now we're supposed to thank them for addressing it after it was revealed in public?
  - RexRollman 15y ago
    I am willing to thank someone who listens and then fixes something. To do otherwise is just rude.
    - code_duck 15y ago
      Really, so if someone stabs you in the arm on purpose, and then bandages it up only after you alert the public, you'd thank them?
mjs 15y ago
"The other 'a' cookie, a_xs, is now also deleted on logout. a_xs is used to prevent cross-site request forgery." Does anyone know how this cookie is used to prevent CSRF?
- epochwolf 15y ago
  Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default. This functionality is referenced in the security guide. http://guides.rubyonrails.org/security.html#csrf-countermeasures http://guides.rubyonrails.org/security.html#csrf-countermeas...
  - mjs 15y ago
    From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.
    - epochwolf 15y ago
      The login form still requires a secret as does any other links that have side effects. I would imagine the like buttons require them to work properly.
shithead 15y ago
Q. How do you know that Mark Zuckerberg is lying? A. His lips are moving.

71 points by nikcub 15y ago

altrego99 15y ago

> There is a bug where a_user was not cleared on logout. Yeah, right! Sure it was a bug.

code_duck 15y ago

So, do the remaining cookies truly not contain data which can identify a specific user to Facebook?

nikcub 15y ago
Facebook say they do not I would prefer they deleted all cookies, since the user/browser can still be uniquely identified
sp332 15y ago
You can use this page to see how "unique" your browser is. https://panopticlick.eff.org/ https://panopticlick.eff.org/ It doesn't use cookies.
- anonymoushn 15y ago
  Your browser fingerprint appears to be unique among the 1,777,057 tested so far That is a bit unsettling.
  - mirkules 15y ago
    Using Firefox with NoScript produces (OS X 10.6): "Within our dataset of several million visitors, only one in 27,775 browsers have the same fingerprint as yours." But turning on Javascript, but leaving FlashBlock on, produces the same message as yours. Interesting...
    - code_duck 15y ago
      Definitely, most of the identifiability comes from data only available from JavaScript such as the combination of screen resolution and available fonts.
- keithpeter 15y ago
  I got the same number as anonymous below me. The biggest cause of uniqueness was the installed fonts reported by the browser. I'm on Linux and we have some weird ones....
  - sp332 15y ago
    Yeah, between plugins and fonts, most browsers show up as "unique" in that tool which are merely unusual. I'm using a Firefox alpha build, and it says that alone is enough to identify me, even though obviously it isn't.
    - true_religion 15y ago
      I think its the ordering of the installed fonts that matters. Your browser doesn't report the fonts on your computer in alphabetical order.
- cousin_it 15y ago
  Most interesting link I've seen today, thanks! So as long as you log in to Facebook often enough (more often than you install new browser plugins or fonts or whatever), they can cookieless-track you perfectly when you're logged out, by remembering the browser fingerprint you had when you were logged in. And even if the fingerprint changes a little bit, they could use something like Levenshtein distance, combined with statistics of frequently visited sites, to have a good chance of identifying you anyway. In the hypothetical world where Facebook was an evil monster of surveillance, of course. I'm not talking about the real world here ;-) So what can you do when faced by a hypothetical monster like that? Disabling third-party cookies is only the first step. Is there any reasonable way to anonymize your browser fingerprint?
  - Vivtek 15y ago
    Use a different browser?
  - MartinCron 15y ago
    Is there any reasonable way to anonymize your browser fingerprint? Maybe not totally anonymize, but a lot of the data that gets used for browser fingerprinting relies on flash to work, so if you run without flash on by default (click to flash, or whatever) that should help.

y0ghur7_xxx 15y ago

They don't need the cookie to track you anyway. Cookie-less tracking is no problem. Not deleting the cookie was making the tracking just a little bit easier, but I am sure they track users anyway, as long as they download the like widgets that webmasters put on their pages.

lbrandy 15y ago
> I am sure they track users anyway Just so we are clear: we don't cookieless "track users anyway". I suppose you guys can line up to say I'm lying like you did to the other engineers who posted yesterday, and it is quite obviously impossible for me to prove otherwise. But suffice to say our policies are rather clear on the issue.
- sp332 15y ago
  If I am logged out, and I just visit a page with a "Like" button, what info does Facebook get about me?
  - tiles 15y ago
    You can view browser headers and see this for yourself, if you're curious. In Chrome, go to the Developer Tools -> Network Tab, refresh a page with the "like" button, look for "like.php" and all the corresponding resources loaded by it, and look at the "headers" tab for each. You can see what data is being sent to Facebook and draw your own conclusions about how anonymous it makes you.
- tiles 15y ago
  While it's unfortunate you're being thrown under the bus for this issue (I cannot prove Facebook is tracking me via my browser headers or not, it's simply dependent on how much trust I give to your company), this is a really healthy and important development that people are coming to. Facebook isn't the -only- company which has the potential to track you across the web; it's incredibly easy to do with ads, Digg buttons, Tweet buttons, and whatever new social network hits the stage. Some of these organizations may not have had such high profile cases as Facebook, which for all of its mishaps has at least responded to user's concerns. We need to enter into an awareness about how identifiable we are just browsing the internet. Average users need to know this. It's not like Facebook can force browsers to not send identifiable content and its refusing to--web browsing has been designed to allow third party content just like that. So we need to start exploring the ways in which this amount of trust to third party content isn't so implicit.

mingyeow 15y ago

"There is a bug where a_user was not cleared on logout. We will be fixing that today." PR speak. This seems much less like a bug to me, more like a poorly contemplated decision. What seems more likely is that they were contemplating what they should do, and given the general direction Facebook is headed, they probably thought little of just leaving it in. I love the facebook guys, but calling it a bug as opposed to a non-malicious decision is just PR speak

yuliyp 15y ago
The fact that it could be removed overnight should give you a hint about how much it was actually used.
- hockeybias 15y ago
  Apples and oranges dude...
deleted 15y ago
[deleted]

Slimy 15y ago

A Facebook engineer has made a statement saying there was not tracking involved in the "Update" section of this article: http://www.zdnet.com/blog/facebook/facebook-fixes-cookie-behavior-after-logging-out/4120 http://www.zdnet.com/blog/facebook/facebook-fixes-cookie-beh...

newchimedes 15y ago

Wasn't there a FB engineer yesterday who said that this "problem" would take a long time to fix? Apparently it didn't take that long.

newchimedes 15y ago
Here's the article I mentioned: http://blogs.wsj.com/digits/2011/09/26/facebook-defends-getting-data-from-logged-out-users/ http://blogs.wsj.com/digits/2011/09/26/facebook-defends-gett...

RexRollman 15y ago

As anyone who frequents HN would notice, I do not care for Facebook. I don't like it as a company and I do not care for its founder. But with that said, I am glad to see that Facebook addressed this issue. And thanks to Nik for bringing this to the light.

code_duck 15y ago
Facebook created this issue... now we're supposed to thank them for addressing it after it was revealed in public?
- RexRollman 15y ago
  I am willing to thank someone who listens and then fixes something. To do otherwise is just rude.
  - code_duck 15y ago
    Really, so if someone stabs you in the arm on purpose, and then bandages it up only after you alert the public, you'd thank them?

mjs 15y ago

"The other 'a' cookie, a_xs, is now also deleted on logout. a_xs is used to prevent cross-site request forgery." Does anyone know how this cookie is used to prevent CSRF?

epochwolf 15y ago
Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default. This functionality is referenced in the security guide. http://guides.rubyonrails.org/security.html#csrf-countermeasures http://guides.rubyonrails.org/security.html#csrf-countermeas...
- mjs 15y ago
  From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.
  - epochwolf 15y ago
    The login form still requires a secret as does any other links that have side effects. I would imagine the like buttons require them to work properly.

shithead 15y ago

Q. How do you know that Mark Zuckerberg is lying? A. His lips are moving.