13 ms·
Clickbait title: USPS did not share anything intentionally. They negligently allowed tracking pixels from certain companies on their Informed Delivery page. Of
by vzaliva 2y ago
Clickbait title: USPS did not share anything intentionally. They negligently allowed tracking pixels from certain companies on their Informed Delivery page.
Of course, it's terrible from a privacy point of view, but let's be honest and call things as they are.
- rahimnathwani 2y agoHow can a tracking pixel cause a customers postal address to be sent to Meta?
- slotrans 2y ago1. customer enters their address in form fields 2. those form field values are templated into a GET request to the Meta tracking pixel (or POST request to the /events endpoint, or ...) 3. profit they've made it very easy https://developers.facebook.com/docs/meta-pixel/implementation/conversion-tracking/ https://developers.facebook.com/docs/meta-pixel/implementati...
- slotrans 2y agoit could have been much worse, I have seen passwords leaked this way ("seen" meaning "I worked at a company where this happened and read the code with my own eyes" not just "I read it in the newspaper")
- rahimnathwani 2y agoOK, based on your link the answer to my question seems to be: it's not a tracking pixel, but the "Meta Pixel", which the documentation describes as "a snippet of JavaScript code".
- jameshart 2y agoWelcome to the wonderful world of affiliate marketing, adtech, and tag management. In that world, third party ‘tags’ that are included in a page are generally referred to as ‘pixels’. Sometimes they are single pixel img tags. Frequently they are scripts. But the industry calls them ‘pixels’ anyway. It is, surprisingly, not a terribly honest industry.
- rahimnathwani 2y agoYeah semantic drift haha... https://chatgpt.com/share/3331fdec-c69c-46b0-9ffe-c48848fb2949 https://chatgpt.com/share/3331fdec-c69c-46b0-9ffe-c48848fb29...
- CyberDildonics 2y agoI don't know why you're being downvoted, calling full access javascript embedded into a page a 'tracking pixel' is a total lie. Then again 'serverless' is where you use a server, so the track record isn't great.
- rahimnathwani 2y agoI guess most people reading this already knew that the term 'tracking pixel' has evolved beyond its original meaning, and is now commonly understood to include all sorts of tracking code. I did not, but now I know :) (And although serverless doesn't mean 'no server', we know what the word means and it doesn't cause confusion.)
- ziml77 2y agoI also didn't know and I definitely don't like how it underplays the capabilities of the tracking.
- everybodyknows 2y ago>serverless Doesn't the term confuse anyone hearing it for the first time? It sure did me.
- TONIA1942 2y ago[dead]
- deleted 2y ago[deleted]
- segasaturn 2y agoWhy on earth is a government website linking anything from Facebook, Snapchat, etc? USPS isn't a trendy coffee shop or a designer brand, they're a federal agency of the United States government and should be held to a higher trust and privacy standard.
- mindslight 2y agoI wholeheartedly agree with where you're coming from, but don't try to login to your IRS account these days without first taking some Xanax (tm).
- Klonoar 2y agoI am pretty sure they said they’d reevaluate that ID login change but instead rammed it through. I think about it every time I have to use it.
- mindslight 2y agoThe worst part is that it had been working just fine for me before. I already had a login that I think had been verified via postal mail. My IRS account obviously isn't going anywhere. Why do I have to create a completely new login, just to use less secure surveillance based authentication? It smells of corruption where someone gets a kickback based on how many people they can herd into the surveillance industry slaughterhouse. There are probably several layers of indirection (grift) because "government can't do anything", but that's still the underlying dynamic.
- snotrockets 2y agoIf I had to guess, the kickback isn’t from the auth provider. Maintaining a system takes people & resources. For 40+ years, there’s a push to not allow the government to actually hire and manage those itself, but use commercial entities, because “big government is bad”. So it is easier to get the approval to pay x2 as much for a 3rd party than do it for half the budget internally. And as things need to be done, you end up saying f*k it and help ruin public service because it was mandated you’ll do so. And then you end up with shitty services, which was the intent all along: it’s not about big government, it’s about outsourcing government contracts to you and yours.
- Terr_ 2y ago> They negligently allowed tracking pixels from certain companies on their Informed Delivery page. I had to work on a feature like that, where individual client-companies wanted to sprinkle arbitrary pixel-trackers across different steps in our website's workflow for their users... Even today, I still worry I wasn't paranoid enough. _______ For the curious/critiquing: When conditions are met, the main page JS creates a temporary <iframe src="..." sandbox="allow-scripts allow-same-origin">, and the destination URL (signed, time-limited) instructs a different subdomain to host up the icky arbitrary markup. Yes, I know about the srcdoc attribute, and that would have been much easier except it breaks some tracker-code. In particular, Google Tag Manager silently stopped working, and it was because it contained some logic looking for "real site" aspects. This affected both `srcdoc` and also confused things when testing with `file://` URLs.
- lupusreal 2y agoI've been flat out blocking google tags manager for years and never noticed any breakage because of this.
- CWuestefeld 2y agoI spend a fair amount of time fending off requests from our marketing team to add every tracker they can think of into our site. It's as if they don't even think about the possibility that our customers might not like that.
- crowcroft 2y agoThere are layers to the problem. The platforms do an incredible job of selling their ad tech across a business. No matter what business you're in the expectation is that Google or Meta etc. SHOULD work, and if they don't your marketing team isn't doing it right. So then the pressure comes from execs to do whatever is needed to make these platforms work well. The execs aren't close to the details of what that means, but they want results. Marketing then gets told they need to push more data to the platforms to make things work. This lines up with the what the execs have been told as well, more data is a good thing right? Since marketers are non-technical the platforms want to make passing data to the platforms AS SIMPLE AS POSSIBLE. Which leads to these all encompassing data trackers (which conveniently is good for the platforms as well). Marketers don't really understand the tradeoffs, they just know more data is a good thing, and they HAVE to get this platform working well or else they're out of a job. Then the question of should we trust Google or Meta is just hand waved away. They're huge companies 'of course we should trust them, they're the best in the world' – is a pretty easy pitch for a personable account rep to make over an expensive lunch. Even if you don't trust them, what are you going to do, not work with them while you're competitors make money??? IMO it's clear market failure and govt intervention is the solution. Complaining about marketing departments not doing the right thing is never going solve the problem.
- ysacfanboi 2y agoIf they allowed the tracking pixels, they intentionally shared the data. We all know what the tracking pixels do.
- dotancohen 2y agoIt's right there in the name.
- DevKoala 2y agoThis is so naive. When you allow those tracking pixels you get paid to do it.
- smelendez 2y agoNot directly. They’re used to track people’s behavior on your website after seeing an ad for your company, like knowing that people who see a Facebook ad for stamps are 12% more likely to buy them or whatever.
- roadbuster 2y agoNot at all. Tracking pixels are installed by advertisers so they can understand if advertising on platform A, B, C actually drives business outcomes X, Y, Z. In other words, they're primarily a tool to see whether you're getting value for the ad dollars you're spending. (Their secondary purpose is to let you show ads to people who already came to your website, i.e.: focusing your ad dollars on people who might actually care about your products and services in the first place)
- gwerbret 2y ago> Clickbait title: USPS did not share anything intentionally. They negligently allowed tracking pixels from certain companies on their Informed Delivery page. You needed to read through to the end of the article. TechCrunch did its own testing and confirmed that the mentioned sites were scraping data from the USPS, including but not limited to the postal addresses. The negligence that allowed USPS to leak such information in the name of analytics or whatever it is they were gaining from Facebook et al. is unconscionable, and USPS are very much responsible, just as they would be for a trivial hack with the same effect.
- 1000100_1000101 2y agoWhen a researcher notices they can show source, or tweak an id in a URL and see data they shouldn't, and report it, they're threatened with jail time. How come Meta can secretly scrape my web session, steal information, and that's not considered a massive violation of these same laws? These companies act like they're entitled to everything. Some CEOs and senior managers jailed for plotting these data theft tactics would be a welcome change... But it's never going to happen, and they know it.
- throawayonthe 2y ago[dead]
- muteh 2y agoSo the data wasn’t shared? These companies do not have USPS PII?
- colinstone 2y ago[dead]
- dtgriscom 2y agoI got an email from a co-worker today, and noticed at the bottom of his signature a "Create your own email signature" link, which led to wisestamp.com. Turns out they sell an email signature service to companies. I pointed out to him that advertising an unrelated company in his corporate emails was tacky, but even worse there was a tracking pixel in the email, clearly specific to him. So, any time someone opened one of his emails, WiseStamp would know. He removed it immediately.
- SoftTalker 2y agoI was critiqued on here the other day for saying I thought HTML was inappropriate for emails and that I use a plain text email client. This is one of the reasons. Reading an email should not expose you to “tracking pixels” and for me it doesn’t.
- iamacyborg 2y agoPeople want to be able to include images in their emails, or bold text. HTML is fine for email, just turn images off by default
- g15jv2dp 2y agoThey intentionally shared data with "certain companies" that then shared it with meta etc. Let's be even more honest.
- 1vuio0pswjnm7 2y agoTitle could be misleading but only if the reader jumps to conclusions; it does say anything about intent. It only says data was shared. That's 100% accurate. USPS customers have no recourse so arguably intent is irrelevent anyway.
- nkrisc 2y agoOk so they unintentionally shared customer postal addresses with Meta, LinkedIn and Snap. Doesn’t really seem like clickbait to me.
- rkagerer 2y agoI have trouble accepting that as mere negligence (vs. gross negligence). Anyone hosting a website should be familiar with the trackers and other cruft that comes from third parties they utilize. This is why I'm incredibly choosy about what libraries I use and which third parties I allow to put content on my site (directly or indirectly). If you don't have good insight on this you have no business including their assets/snippets. I use open-source analytics tools that run entirely on my infrastructure, not the junk from Meta etc. "Everyone else does it" is not a palatable excuse. These companies are known for having user-hostile, privacy-invasive reputations, so as developers we should by default be wary of them. E.g. Including a Facebook "Like" snippet on your page lets them siphon all sorts of data from your visitors, particularly if the user hasn't logged out of their Facebook account. It's not how users expect the web to work, and it's an insidious technique (they're deliberately taking advantage of thousands of unwitting webmasters who don't understand the baggage that snippet comes with). More examples here: https://www.consumerreports.org/electronics-computers/privacy/how-facebook-tracks-you-even-when-youre-not-on-facebook-a7977954071/ https://www.consumerreports.org/electronics-computers/privac... Frankly, even if USPS was unaware, the data still ended up in those third party hands via their services so as far as I'm concerned, yes, they did facilitate the sharing of said data. At least they plugged the hole once it was pointed out to them.
- not_wyoming 2y agoPost: Car strikes, kills pedestrian at crosswalk Top post: Title is clickbait, driver didn't kill pedestrian on purpose. Pedestrian: <is dead>
- dreamcompiler 2y ago> USPS did not share anything intentionally. We don't actually know that. What we know is that they said they didn't share anything intentionally. But there is almost no penalty for lying about such things and the USPS is desperate for money, so I don't think it's impossible that some USPS person made an under-the-table deal with Meta or another company to add this stuff to its website in exchange for a kickback. Only a detailed audit would be able to find out the truth, and that seems unlikely to happen unless Congress gets upset about the issue.
- vzaliva 2y ago> USPS did not share anything intentionally. >> We don't actually know that. Hanlon's razor: "Never attribute to malice that which is adequately explained by stupidity."
- dreamcompiler 2y agoHanlon's Corollary: Always make your malicious acts look like stupidity and Hanlon's Razor will save you.
- YeBanKo 2y agoYou are right, it’s not sharing. It leaking. It should be “USPS leaked customer postal addresses to Meta, LinkedIn and Snap”
- username135 2y agoYet another reason why ublock should be a default extension for everyone as it blocks those by default.