3 ms·

So if I get it correctly, foreign spy company sign up for one of the many real time bidding ad networks, pretends to bid on many many adverts, and starts to de-

So if I get it correctly, foreign spy company sign up for one of the many real time bidding ad networks, pretends to bid on many many adverts, and starts to de-anonymise ad bids - starts unpicking the 45 yo male who has a gym app that locates him next to the military base, but also drinks in the Wetherspoons pub on the base and visits the cycle-maniac website and suddenly you are tracking the colonel at the base Every minute his own phone is telling everyone “looking at Facebook page on X, 25-35 male single I did wonder how the data was exfiltrated out of FB or google - but it’s just published …

Xeamek 3y ago
Facebook claims that unlike most services, they don't sell your data outside. Instead the advertiser comes to them saying 'show this ad to X target group', and all the matching is done internally by facebook, so it data never leaves facebook. ...that's the theory at least. In practice, afaik facebook does provide some informations about how the audience interacted with your ads. So perhaps with enough effort and precise targetting you could effectively match given info to specific people? But dunno
- bigiain 3y ago
  Nice (old) writeup of doing exactly that: http://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ http://ghostinfluence.com/the-ultimate-retaliation-pranking-...
  - happytiger 3y ago
    Thank you for reposting this. I had forgotten how good a write up it was, and also just what social commentary about de-anonymization it is. The relevant part for that is right here: > EDIT: Facebook has since changed its policies and won’t allow you to market to any audience with less than 20 people. If you want to try this yourself, there’s a loophole. Let’s say you want to target one of your guy friends, add his email to a .CSV along with the emails of 19 female friends before uploading it to Facebook. You can then target anyone in that custom audience who is also male (thus eliminating the 19 women and effectively targeting a single person). This is the problem with audience segmentation. While there has been a lot of emphasis on protecting the export of audiences to disable bad actors and their use cases, it doesn’t apply to the data brokers themselves. So, the whole system of a data brokerage is available to anyone who owns a data brokering business or consumes raw data from DMPs and other data providers: a use case I am sure is used by threat actors. Good comment!
- Alifatisk 3y ago
  In that sense, Facebooks way feels better.

Xeamek 3y ago

Facebook claims that unlike most services, they don't sell your data outside. Instead the advertiser comes to them saying 'show this ad to X target group', and all the matching is done internally by facebook, so it data never leaves facebook. ...that's the theory at least. In practice, afaik facebook does provide some informations about how the audience interacted with your ads. So perhaps with enough effort and precise targetting you could effectively match given info to specific people? But dunno

bigiain 3y ago
Nice (old) writeup of doing exactly that: http://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ http://ghostinfluence.com/the-ultimate-retaliation-pranking-...
- happytiger 3y ago
  Thank you for reposting this. I had forgotten how good a write up it was, and also just what social commentary about de-anonymization it is. The relevant part for that is right here: > EDIT: Facebook has since changed its policies and won’t allow you to market to any audience with less than 20 people. If you want to try this yourself, there’s a loophole. Let’s say you want to target one of your guy friends, add his email to a .CSV along with the emails of 19 female friends before uploading it to Facebook. You can then target anyone in that custom audience who is also male (thus eliminating the 19 women and effectively targeting a single person). This is the problem with audience segmentation. While there has been a lot of emphasis on protecting the export of audiences to disable bad actors and their use cases, it doesn’t apply to the data brokers themselves. So, the whole system of a data brokerage is available to anyone who owns a data brokering business or consumes raw data from DMPs and other data providers: a use case I am sure is used by threat actors. Good comment!
Alifatisk 3y ago
In that sense, Facebooks way feels better.