6 ms·

"Facebook's new ad service, launched earlier this month, gets around the traditional third-party advertising cookies by doing the tracking on its own. When a pe

"Facebook's new ad service, launched earlier this month, gets around the traditional third-party advertising cookies by doing the tracking on its own. When a person visits a website selling shoes on a work PC, a piece of Facebook code placed on that site—Facebook's own cookie—recognizes that the person has logged into Facebook using that browser before. The shoe seller can then send the person an ad for the shoe on Facebook's mobile app—even if that person never registered with the shoe seller." This highlights the dangers of the seemingly harmless social widgets. Anyone who doesn't already, I highly recommend using a plugin such as ghostery[1] to block them. [1]https://www.ghostery.com/ https://www.ghostery.com/

kmfrk 13y ago
A good example is this privacy vulnerability in IntenseDebate: https://news.ycombinator.com/item?id=6591282 https://news.ycombinator.com/item?id=6591282.
ddorian43 13y ago
isn't ghostery very/very/very slow?
- ihsw 13y ago
  Been a ghostery user for a long time now. Haven't noticed any slowdowns ever.
- whyenot 13y ago
  no.
webjprgm 13y ago
On my personal blog I made a button to disable/enable all the social media plugins. I don't know if anybody uses it (my readership is approximately zero, so no point in tracking clicks or A/B testing), but I figured I'd give users the option out of courtesy. It does use a cookie to track your preference. The default is to enable them (since most users are not tech savvy enough to know they want them off, and those same users wouldn't easily find a button to turn them on).
- Revisor 13y ago
  Why do you use them at all if you know that they leak your readers' privacy?
- robotmay 13y ago
  Similarly on my current pet project (https://www.photographer.io https://www.photographer.io) I opted to not use the standard sharing buttons at all due to the cookies involved, and I also added an option for users to remove all social buttons from across the site (even though they just use the pop-up share windows now). I've had a few people say they appreciated it, so it's definitely worth giving users that option if possible.
- icebraining 13y ago
  Instead of tracking by default, consider the approach taken by a few sites, where you have "dumb" images with the various social networking logos, that are replaced by the real button when clicked.
pachydermic 13y ago
Ghostery seems like a good thing... but how can you really trust them with your privacy? Isn't installing a browser plugin potentially a lot worse for your privacy than just being tracked with cookies? Hate to spread FUD, but I just don't understand how I'm supposed to trust these guys - I would certainly like to.
- k3n 13y ago
  Well, you can inspect the entirety of the plugin code yourself. While they could of course update it with something bad, there is nothing inherently hidden from you that I'm aware of.
  - pachydermic 13y ago
    Really? Where can you find the source code? I never noticed it on their site - seems like they're a typically closed-source company to me. Am I missing something obvious?
    - k3n 13y ago
      Lots of ways! First and easiest would be to simply 'inspect popup' on the icon, and then navigate to the sources tab, though you may not get all of the code this way (perhaps if it was conditionally/dynamically loaded). Second way, and probably the best, would be to go to its store page, and in the URL will be the extension ID; for Ghostery, it's "mlomiejdfkolichcflejclcbmpeaniij". Now, just find that in your Chrome installation directory, e.g. for Win7 the extension would be located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\. The last way would be to intercept or otherwise directly down the .crx file (curl, wget, etc.), which is just a compressed zip archive. You can do the same for FF extensions as well, those .xpi files are just zip files.
      - pachydermic 13y ago
        Man, I don't know. That's not open source - they don't seem to intend for you to easily be able to see and understand the code. There's less peer review that way. They're also an ad (analytics?) company. I just don't trust them.
gabemart 13y ago
Webmasters can create static sharing "widgets" that are nothing more than an href to a url which encodes the page to be shared. This doesn't use any javascript and can't be used to track anyone (unless they actually share the page, in which case tracking is unavoidable). This can be done programmatically or with a simple web service (e.g. [1]). [1] http://www.sharelinkgenerator.com/ http://www.sharelinkgenerator.com/
- brymaster 13y ago
  Heise.de started "two clicks for better privacy" that Bruce Scheiner also uses on his blog. http://www.heise.de/extras/socialshareprivacy/ http://www.heise.de/extras/socialshareprivacy/ & https://github.com/panzi/SocialSharePrivacy https://github.com/panzi/SocialSharePrivacy
  - magicalist 13y ago
    This is a great technique, because despite the mood in the echochamber here sometimes (I also have absolutely zero interest in using them), many many users legitimately do want to like things or share things or interact with social widget whatevers at some point on some sites. Using libraries like this makes that interaction absolutely explicit, with minimal loss of ease of use, which means that nothing is shared until that explicit signal that the user wants to share.
- taway2012 13y ago
  I think you've probably misunderstood. The mere loading of the widget sends a signal to Facebook that you visited the shoes page. You don't have to interact with the widget for the info to be sent. Ghostery blocks the widget from loading.
  - gabemart 13y ago
    I describe an alternate widget that uses a single link instead of the typical javascript. Loading such a widget sends nothing at all to Facebook, and is untrackable unless clicked by the user.
blparker 13y ago
"Facebook's new ad service, launched earlier this month, gets around the traditional third-party advertising cookies by doing the tracking on its own. When a person visits a website selling shoes on a work PC, a piece of Facebook code placed on that site—Facebook's own cookie—recognizes that the person has logged into Facebook using that browser before." How does this even work? Is the shoe seller placing some kind of JavaScript snippet on their website in order to allow Facebook to track users? Is this coming from their "Like" button?
- sp332 13y ago
  Yes. https://developers.facebook.com/docs/plugins/like-button/ https://developers.facebook.com/docs/plugins/like-button/
- rbaud 13y ago
  Yes, the "Like" button is used by Facebook to track users across third-party sites. Clicking the button is not necessary for information to be transmitted to Facebook. More information straight from Facebook: https://www.facebook.com/help/186325668085084 https://www.facebook.com/help/186325668085084
pygy_ 13y ago
I prefer "Request Policy", which blocks everything that comes from external domains, and allows you to selectively enable what's needed on a per domain basis, i.e. you can enable googleapis.com on google domains, but it remains off everywhere else. It's usually obvious to spot the CDNs and avoid the spies. It breaks a lot of things initially, but after a while, the sites you use often are properly whitelisted, and it isn't a pain anymore.
- zwegner 13y ago
  Seconded. I use this along with NoScript, SelfDestructingCookies, and Adblock Edge (an ABP fork without any "acceptable ads" feature). A lot of the time it's a big pain to get it working right (say, to watch a video on a news site), but that's simply the price I have to pay in today's web to retain at least a bit of privacy and security. If anyone wants to make a neat extension, it seems like all these extensions could be combined into one with a slightly better user interface. If you want to make it really spiffy, the black/white listing for these could be shared in a distributed hash table with some sort of voting/trust mechanism.
  - cpeterso 13y ago
    Is the only difference between Adblock Edge and Adblock Plus that ABE removes the "acceptable ads" checkbox? The ABE site is unclear because it talks about being a fork.
  - xarball 13y ago
    I've been thinking this for a while too! The best comparison would be something akin to "Would you like to allow cnn.com to access XYZ?" that most mobile phones use these days. It seems that the more locked-down hardware manufacturers may have accidentally stumbled upon a kind of end-user workflow that may actually work for controlling what they want to share with the web!
- pygy_ 13y ago
  The edit window is now closed, and I realise I forgot to post a link. To make up for it, I'll give you two for the same price. https://www.requestpolicy.com/ https://www.requestpolicy.com/ and https://addons.mozilla.org/en-US/firefox/addon./RequestPolicy/ https://addons.mozilla.org/en-US/firefox/addon./RequestPolic...

kmfrk 13y ago

A good example is this privacy vulnerability in IntenseDebate: https://news.ycombinator.com/item?id=6591282 https://news.ycombinator.com/item?id=6591282.

ddorian43 13y ago

isn't ghostery very/very/very slow?

ihsw 13y ago
Been a ghostery user for a long time now. Haven't noticed any slowdowns ever.
whyenot 13y ago
no.

webjprgm 13y ago

On my personal blog I made a button to disable/enable all the social media plugins. I don't know if anybody uses it (my readership is approximately zero, so no point in tracking clicks or A/B testing), but I figured I'd give users the option out of courtesy. It does use a cookie to track your preference. The default is to enable them (since most users are not tech savvy enough to know they want them off, and those same users wouldn't easily find a button to turn them on).

Revisor 13y ago
Why do you use them at all if you know that they leak your readers' privacy?
robotmay 13y ago
Similarly on my current pet project (https://www.photographer.io https://www.photographer.io) I opted to not use the standard sharing buttons at all due to the cookies involved, and I also added an option for users to remove all social buttons from across the site (even though they just use the pop-up share windows now). I've had a few people say they appreciated it, so it's definitely worth giving users that option if possible.
icebraining 13y ago
Instead of tracking by default, consider the approach taken by a few sites, where you have "dumb" images with the various social networking logos, that are replaced by the real button when clicked.

pachydermic 13y ago

Ghostery seems like a good thing... but how can you really trust them with your privacy? Isn't installing a browser plugin potentially a lot worse for your privacy than just being tracked with cookies? Hate to spread FUD, but I just don't understand how I'm supposed to trust these guys - I would certainly like to.

k3n 13y ago
Well, you can inspect the entirety of the plugin code yourself. While they could of course update it with something bad, there is nothing inherently hidden from you that I'm aware of.
- pachydermic 13y ago
  Really? Where can you find the source code? I never noticed it on their site - seems like they're a typically closed-source company to me. Am I missing something obvious?
  - k3n 13y ago
    Lots of ways! First and easiest would be to simply 'inspect popup' on the icon, and then navigate to the sources tab, though you may not get all of the code this way (perhaps if it was conditionally/dynamically loaded). Second way, and probably the best, would be to go to its store page, and in the URL will be the extension ID; for Ghostery, it's "mlomiejdfkolichcflejclcbmpeaniij". Now, just find that in your Chrome installation directory, e.g. for Win7 the extension would be located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\. The last way would be to intercept or otherwise directly down the .crx file (curl, wget, etc.), which is just a compressed zip archive. You can do the same for FF extensions as well, those .xpi files are just zip files.
    - pachydermic 13y ago
      Man, I don't know. That's not open source - they don't seem to intend for you to easily be able to see and understand the code. There's less peer review that way. They're also an ad (analytics?) company. I just don't trust them.

gabemart 13y ago

Webmasters can create static sharing "widgets" that are nothing more than an href to a url which encodes the page to be shared. This doesn't use any javascript and can't be used to track anyone (unless they actually share the page, in which case tracking is unavoidable). This can be done programmatically or with a simple web service (e.g. [1]). [1] http://www.sharelinkgenerator.com/ http://www.sharelinkgenerator.com/

brymaster 13y ago
Heise.de started "two clicks for better privacy" that Bruce Scheiner also uses on his blog. http://www.heise.de/extras/socialshareprivacy/ http://www.heise.de/extras/socialshareprivacy/ & https://github.com/panzi/SocialSharePrivacy https://github.com/panzi/SocialSharePrivacy
- magicalist 13y ago
  This is a great technique, because despite the mood in the echochamber here sometimes (I also have absolutely zero interest in using them), many many users legitimately do want to like things or share things or interact with social widget whatevers at some point on some sites. Using libraries like this makes that interaction absolutely explicit, with minimal loss of ease of use, which means that nothing is shared until that explicit signal that the user wants to share.
taway2012 13y ago
I think you've probably misunderstood. The mere loading of the widget sends a signal to Facebook that you visited the shoes page. You don't have to interact with the widget for the info to be sent. Ghostery blocks the widget from loading.
- gabemart 13y ago
  I describe an alternate widget that uses a single link instead of the typical javascript. Loading such a widget sends nothing at all to Facebook, and is untrackable unless clicked by the user.

blparker 13y ago

"Facebook's new ad service, launched earlier this month, gets around the traditional third-party advertising cookies by doing the tracking on its own. When a person visits a website selling shoes on a work PC, a piece of Facebook code placed on that site—Facebook's own cookie—recognizes that the person has logged into Facebook using that browser before." How does this even work? Is the shoe seller placing some kind of JavaScript snippet on their website in order to allow Facebook to track users? Is this coming from their "Like" button?

sp332 13y ago
Yes. https://developers.facebook.com/docs/plugins/like-button/ https://developers.facebook.com/docs/plugins/like-button/
rbaud 13y ago
Yes, the "Like" button is used by Facebook to track users across third-party sites. Clicking the button is not necessary for information to be transmitted to Facebook. More information straight from Facebook: https://www.facebook.com/help/186325668085084 https://www.facebook.com/help/186325668085084

pygy_ 13y ago

I prefer "Request Policy", which blocks everything that comes from external domains, and allows you to selectively enable what's needed on a per domain basis, i.e. you can enable googleapis.com on google domains, but it remains off everywhere else. It's usually obvious to spot the CDNs and avoid the spies. It breaks a lot of things initially, but after a while, the sites you use often are properly whitelisted, and it isn't a pain anymore.

zwegner 13y ago
Seconded. I use this along with NoScript, SelfDestructingCookies, and Adblock Edge (an ABP fork without any "acceptable ads" feature). A lot of the time it's a big pain to get it working right (say, to watch a video on a news site), but that's simply the price I have to pay in today's web to retain at least a bit of privacy and security. If anyone wants to make a neat extension, it seems like all these extensions could be combined into one with a slightly better user interface. If you want to make it really spiffy, the black/white listing for these could be shared in a distributed hash table with some sort of voting/trust mechanism.
- cpeterso 13y ago
  Is the only difference between Adblock Edge and Adblock Plus that ABE removes the "acceptable ads" checkbox? The ABE site is unclear because it talks about being a fork.
- xarball 13y ago
  I've been thinking this for a while too! The best comparison would be something akin to "Would you like to allow cnn.com to access XYZ?" that most mobile phones use these days. It seems that the more locked-down hardware manufacturers may have accidentally stumbled upon a kind of end-user workflow that may actually work for controlling what they want to share with the web!
pygy_ 13y ago
The edit window is now closed, and I realise I forgot to post a link. To make up for it, I'll give you two for the same price. https://www.requestpolicy.com/ https://www.requestpolicy.com/ and https://addons.mozilla.org/en-US/firefox/addon./RequestPolicy/ https://addons.mozilla.org/en-US/firefox/addon./RequestPolic...