7 ms·

Aside stopping the use of Facebook, which of course is the best solution but not doable for many, the AdNauseam (.io, browser extension) approach to pollute the

Aside stopping the use of Facebook, which of course is the best solution but not doable for many, the AdNauseam (.io, browser extension) approach to pollute their tracking data might be inspirational. The gist is: can't eliminate ad links? Then have an app "click" all of them randomly so that counters become irrelevant. So there is this link that identifies user X?, well then write an extension that distributes and "clicks" it around on say 1000 other machines in a p2p way so that it becomes meaningless. I have no idea if it's doable in this FB context, but usually when links can't be anonymized, the next move is to make them produce irrelevant data by adding noise.

asdfologist 4y ago
- Nextgrid 4y ago
  Just as unethical as creating spyware that spies on users who haven’t given informed consent or sometimes even non-users.
- arthurcolle 4y ago
  Everything is fair game in asymmetric guerilla warfare against well-capitalized antagonists
- Calavar 4y ago
  Facebook also tracks the activity of people who have never registered an account while they browse on third party websites.
- kareemsabri 4y ago
  You can't just say something is unethical, you need to provide a rationale for why people are ethically obligated to preserve a company's revenue stream in their usage of its product. I don't think a consumer owes Facebook any responsibility in terms of protecting its revenue.
  - xwdv 4y ago
    - dataflow 4y ago
      I feel like if Facebook didn't have a history of playing unethical hardball then people would feel more guilty about returning the favor?
    - Justin_K 4y ago
      What happens when FB violates their own TOS, especially when it relates to privacy? Absolutely nothing. FB created their own game of cat and mouse.
    - ls15 4y ago
      > If you do not agree, just stop using the product. What’s so hard to understand? We are talking about Facebook here, the company that tracks unaware people as much as they can all over the internet, not just on their platform, and they created shadow profiles of people who never registered on their platform, which is something that is clearly against my terms of service, which they ignored. They never apologized or financially compensated me for that. Why would someone want to defend that company?
    - kareemsabri 4y ago
      Nothing is hard to understand, I just don't agree with your argument. Facebook does not offer the ability to pay for an ad-free version, so who knows whether people are going to pay. I imagine many would. That said, I am not a member of Facebook's board, I'm not an employee, I'm not even a stockholder. I don't see how it is my ethical obligation to support Facebook's revenue stream. Since the terms of service are not negotiated between myself and Facebook, but written by their lawyers and presented to me implicitly on a "take it or leave it" basis, I do not feel that I've opted into that agreement, nor any obligation to abide by it. Note that while I'm talking in the first person I don't literally mean me, as I don't use Facebook as mentioned in other comments, but any hypothetical consumer who wants to block ads or otherwise undermine Facebook's ability to track them.
    - deleted 4y ago
- majormajor 4y ago
  Is it ethical to give a product away for free in order to profit off ever-increasing surveillance? Would it be fair to proposal an ethical position of something like "if you won't offer your product in a way that uses my information ethically than I have the right to safeguard my information"? Yes, we could all refuse to use facebook, and only use an ethical (even possibly paid!) alternative, but in the race-to-the-bottom everyone-else-ruins-it-for-everyone-else real-world we live in, maybe there is a lot more gray area than you are proposing. In my view the "ever-increasing" aspect of FB's usage of data is particularly relevant in this case. I deleted my account because I'm aware of it. It's not easy to make everyone else aware of it, or understand the full implications, though. And, of course, FB tracks even those of us who don't have accounts.
  - kevin_thibedeau 4y ago
    Is it ethical to consume without giving anything back? Nobody is entitled to free services over the internet. If you aren't paying with money then expect to be paying with something else. The solution to invasive encroachment of personal data is GDPR-like regulation, not attacking the entities spending money to run servers and pay for development. If they are able to operate in a permissive environment that won't implement regulations then the blame rests with lazy regulators.
    - squarefoot 4y ago
      > Is it ethical to consume without giving anything back? Consider this: you sign up for a while, then delete your account forever. Your data however is still there, invisible to users yet available to them, ready to be accessed at will and sold years after you moved away. Would that be ethical? What if we already gave back for services we didn't use yet?
    - domador 4y ago
      I do wish we could just pay modest fees for membership in sites like Facebook. But I doubt they'd be willing to try that approach... or that we'd be willing to support it (even for useful services that haven't burned their ethical reputation like Facebook has.) As a society, we really need to learn that our expectation of free services tends to create inferior services, many of which eventually succumb to perverse incentives. On a related note, it was discouraging when Facebook used to say, "It's free, and always will be!" on it's login page. I read that statement as a threat.
- aporetics 4y ago
  Were it so simple. Unlike buying a product, like a banana, or using a service, like your barber, when you “use” facebook, YOU are the product. You are being sold to companies buying adds. So what is ethical?
- StillBored 4y ago
  Facebook is unethical, I never consented to the shadow profile I'm sure they keep on me. (since I'm an antisocial snob and have never used their offerings). They have acquired a few products I have used (oculus for one) and that fact makes it even more irritating, as far as I'm concerned the sooner their business model is destroyed the better off the world will be.
- crest 4y ago
  Facebook intentionally abuses its captive audience. Reducing the profit they extract from this harm is fully justified. Their combined abuses (not just invasive tracking) should hurt their revenue stream enough to thoroughly reform or break them.
- Schroedingersat 4y ago
  Facebook gave up heing the victim when they removed the optional bit. Once you force yourself into the social graph and 'become the village square' (their own words) then you are no longer entitled to anything.
- deleted 4y ago
  [deleted]
im3w1l 4y ago
For many years I was against AdNauseam, as by my reckoning it would be counterproductive and just end up hurting the the most privacy and freedom oriented voices, but now that Facebook is upping the stakes it's starting to seem like a reasonable countermeasure.
WheatM 4y ago
zozbot234 4y ago
> Aside stopping the use of Facebook, which of course is the best solution but not doable for many But quite doable for a content provider like Ghacks. Users should be able to share links to web content in a way that does not create privacy risks, and this whole URI encryption business makes that quite a bit harder.
matthewfcarlson 4y ago
When you can't get rid of signal, add noise.
gruez 4y ago
>the AdNauseam (.io, browser extension) approach to pollute their tracking data might be inspirational. The gist is: can't eliminate ad links? Then have an app "click" all of them randomly so that counters become irrelevant. So there is this link that identifies user X?, well then write an extension that distributes and "clicks" it around on say 1000 other machines in a p2p way so that it becomes meaningless. Except if you look at the documentation for AdNauseam, their fake click technique seems trivially filterable. The fake clicks are made as XHR requests, so all you have to do is look at the appropriate headers to filter them out. At best the only adtech companies that are getting fooled by this are upstarts that haven't added fraud detection yet. https://github.com/dhowe/adnauseam/wiki/FAQ#how-does-adnauseam-click-ads https://github.com/dhowe/adnauseam/wiki/FAQ#how-does-adnause...
- Klonoar 4y ago
  Unless I'm missing something, headers here can also be set to appear as another request type. (And to be clear - I could be missing something. Does the browser allow replacing e.g Sec-* headers on XHR requests?)
  - gruez 4y ago
    >Does the browser allow replacing e.g Sec-* headers on XHR requests? Probably not, according to this snippet from MDN > With this information a server can implement a resource isolation policy, allowing external sites to request only those resources that are intended for sharing, and that are used appropriately. This approach can help mitigate common cross-site web vulnerabilities such as CSRF, Cross-site Script Inclusion('XSSI'), timing attacks, and cross-origin information leaks. https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header https://developer.mozilla.org/en-US/docs/Glossary/Fetch_meta... being able to override it kills the whole point of the headers.
summerlight 4y ago
I guess this kind of efforts will be largely mitigated by the existing fraud detection systems. You'll probably need to devise much more sophisticated attacks to achieve such goal. And the attack should be also economical, which makes it a really challenging problem against FB-level targets.

asdfologist 4y ago

Nextgrid 4y ago
Just as unethical as creating spyware that spies on users who haven’t given informed consent or sometimes even non-users.
arthurcolle 4y ago
Everything is fair game in asymmetric guerilla warfare against well-capitalized antagonists
Calavar 4y ago
Facebook also tracks the activity of people who have never registered an account while they browse on third party websites.
kareemsabri 4y ago
You can't just say something is unethical, you need to provide a rationale for why people are ethically obligated to preserve a company's revenue stream in their usage of its product. I don't think a consumer owes Facebook any responsibility in terms of protecting its revenue.
- xwdv 4y ago
  - dataflow 4y ago
    I feel like if Facebook didn't have a history of playing unethical hardball then people would feel more guilty about returning the favor?
  - Justin_K 4y ago
    What happens when FB violates their own TOS, especially when it relates to privacy? Absolutely nothing. FB created their own game of cat and mouse.
  - ls15 4y ago
    > If you do not agree, just stop using the product. What’s so hard to understand? We are talking about Facebook here, the company that tracks unaware people as much as they can all over the internet, not just on their platform, and they created shadow profiles of people who never registered on their platform, which is something that is clearly against my terms of service, which they ignored. They never apologized or financially compensated me for that. Why would someone want to defend that company?
  - kareemsabri 4y ago
    Nothing is hard to understand, I just don't agree with your argument. Facebook does not offer the ability to pay for an ad-free version, so who knows whether people are going to pay. I imagine many would. That said, I am not a member of Facebook's board, I'm not an employee, I'm not even a stockholder. I don't see how it is my ethical obligation to support Facebook's revenue stream. Since the terms of service are not negotiated between myself and Facebook, but written by their lawyers and presented to me implicitly on a "take it or leave it" basis, I do not feel that I've opted into that agreement, nor any obligation to abide by it. Note that while I'm talking in the first person I don't literally mean me, as I don't use Facebook as mentioned in other comments, but any hypothetical consumer who wants to block ads or otherwise undermine Facebook's ability to track them.
  - deleted 4y ago
majormajor 4y ago
Is it ethical to give a product away for free in order to profit off ever-increasing surveillance? Would it be fair to proposal an ethical position of something like "if you won't offer your product in a way that uses my information ethically than I have the right to safeguard my information"? Yes, we could all refuse to use facebook, and only use an ethical (even possibly paid!) alternative, but in the race-to-the-bottom everyone-else-ruins-it-for-everyone-else real-world we live in, maybe there is a lot more gray area than you are proposing. In my view the "ever-increasing" aspect of FB's usage of data is particularly relevant in this case. I deleted my account because I'm aware of it. It's not easy to make everyone else aware of it, or understand the full implications, though. And, of course, FB tracks even those of us who don't have accounts.
- kevin_thibedeau 4y ago
  Is it ethical to consume without giving anything back? Nobody is entitled to free services over the internet. If you aren't paying with money then expect to be paying with something else. The solution to invasive encroachment of personal data is GDPR-like regulation, not attacking the entities spending money to run servers and pay for development. If they are able to operate in a permissive environment that won't implement regulations then the blame rests with lazy regulators.
  - squarefoot 4y ago
    > Is it ethical to consume without giving anything back? Consider this: you sign up for a while, then delete your account forever. Your data however is still there, invisible to users yet available to them, ready to be accessed at will and sold years after you moved away. Would that be ethical? What if we already gave back for services we didn't use yet?
  - domador 4y ago
    I do wish we could just pay modest fees for membership in sites like Facebook. But I doubt they'd be willing to try that approach... or that we'd be willing to support it (even for useful services that haven't burned their ethical reputation like Facebook has.) As a society, we really need to learn that our expectation of free services tends to create inferior services, many of which eventually succumb to perverse incentives. On a related note, it was discouraging when Facebook used to say, "It's free, and always will be!" on it's login page. I read that statement as a threat.
aporetics 4y ago
Were it so simple. Unlike buying a product, like a banana, or using a service, like your barber, when you “use” facebook, YOU are the product. You are being sold to companies buying adds. So what is ethical?
StillBored 4y ago
Facebook is unethical, I never consented to the shadow profile I'm sure they keep on me. (since I'm an antisocial snob and have never used their offerings). They have acquired a few products I have used (oculus for one) and that fact makes it even more irritating, as far as I'm concerned the sooner their business model is destroyed the better off the world will be.
crest 4y ago
Facebook intentionally abuses its captive audience. Reducing the profit they extract from this harm is fully justified. Their combined abuses (not just invasive tracking) should hurt their revenue stream enough to thoroughly reform or break them.
Schroedingersat 4y ago
Facebook gave up heing the victim when they removed the optional bit. Once you force yourself into the social graph and 'become the village square' (their own words) then you are no longer entitled to anything.
deleted 4y ago
[deleted]

im3w1l 4y ago

For many years I was against AdNauseam, as by my reckoning it would be counterproductive and just end up hurting the the most privacy and freedom oriented voices, but now that Facebook is upping the stakes it's starting to seem like a reasonable countermeasure.

WheatM 4y ago

zozbot234 4y ago

> Aside stopping the use of Facebook, which of course is the best solution but not doable for many But quite doable for a content provider like Ghacks. Users should be able to share links to web content in a way that does not create privacy risks, and this whole URI encryption business makes that quite a bit harder.

matthewfcarlson 4y ago

When you can't get rid of signal, add noise.

gruez 4y ago

>the AdNauseam (.io, browser extension) approach to pollute their tracking data might be inspirational. The gist is: can't eliminate ad links? Then have an app "click" all of them randomly so that counters become irrelevant. So there is this link that identifies user X?, well then write an extension that distributes and "clicks" it around on say 1000 other machines in a p2p way so that it becomes meaningless. Except if you look at the documentation for AdNauseam, their fake click technique seems trivially filterable. The fake clicks are made as XHR requests, so all you have to do is look at the appropriate headers to filter them out. At best the only adtech companies that are getting fooled by this are upstarts that haven't added fraud detection yet. https://github.com/dhowe/adnauseam/wiki/FAQ#how-does-adnauseam-click-ads https://github.com/dhowe/adnauseam/wiki/FAQ#how-does-adnause...

Klonoar 4y ago
Unless I'm missing something, headers here can also be set to appear as another request type. (And to be clear - I could be missing something. Does the browser allow replacing e.g Sec-* headers on XHR requests?)
- gruez 4y ago
  >Does the browser allow replacing e.g Sec-* headers on XHR requests? Probably not, according to this snippet from MDN > With this information a server can implement a resource isolation policy, allowing external sites to request only those resources that are intended for sharing, and that are used appropriately. This approach can help mitigate common cross-site web vulnerabilities such as CSRF, Cross-site Script Inclusion('XSSI'), timing attacks, and cross-origin information leaks. https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header https://developer.mozilla.org/en-US/docs/Glossary/Fetch_meta... being able to override it kills the whole point of the headers.

summerlight 4y ago

I guess this kind of efforts will be largely mitigated by the existing fraud detection systems. You'll probably need to devise much more sophisticated attacks to achieve such goal. And the attack should be also economical, which makes it a really challenging problem against FB-level targets.