7 ms·

How I Pranked My Roommate with Eerily Targeted Facebook Ads

343 points by manualwise 12y ago

dugmartin 12y ago
Reminds me of this post - http://www.gabrielweinberg.com/blog/2010/05/a-fb-ad-targeted-at-one-person-my-wife.html http://www.gabrielweinberg.com/blog/2010/05/a-fb-ad-targeted...
randomwalker 12y ago
The reason that Facebook changed their policy to disallow targeting to a very small audience is because of this paper http://repository.cmu.edu/cgi/viewcontent.cgi?article=1066&context=jpc http://repository.cmu.edu/cgi/viewcontent.cgi?article=1066&c... It studies the same problem as the author here exploited, but goes a lot farther to try and infer things about the targeted individual from the analytics that FB provides to the advertiser. The paper won the Privacy Enhancing Technologies award. That was back in 2010. If the author succeeded anyway, it seems that Facebook was careless in their implementation of the fix.
- RexRollman 12y ago
  Or they don't really care.
- petercooper 12y ago
  In this case they used Custom Audience Targeting which is different to what's used in the paper. CAT is advertising based on a list of personally identifiable information about your "targets" that you supply, which can include user IDs, phone numbers, e-mail addresses, etc. I can't confirm but suspect no limit is required for this since you already have their personal data. As an aside, an interesting use of this system I've seen in the Internet marketing world is to buy e-mail or phone number lists from list vendors and use them to create custom audiences in Facebook. You can't e-mail them because that's spam and you'll be busted very quickly, but using them as fodder for custom audiences on platforms like Facebook is a way of laundering the info, in a sense. (I've not tried it myself but thought the idea was clever.)
ecocentrik 12y ago
Nice try facebook...
arjie 12y ago
An incredibly amusing anecdote. Very clever of you!
mjwhansen 12y ago
Worth noting: you can no longer target based on user IDs (unless you obtained it through a Facebook app): https://www.facebook.com/help/community/question/?id=10202543406411671 https://www.facebook.com/help/community/question/?id=1020254...
Uhhrrr 12y ago
Interesting. Could one use this to harass an ex? Because unless these sorts of ads are flaggable, I bet that will happen, whether unintentionally ("Dear Angelina, I miss you and I know you have seen this 53 times") or intentionally ("YOU HORRIBLE DEMON BIRCH %$@#%$!!!").
- crazypyro 12y ago
  There are hundreds of examples where privacy could be violated and misused. This is why (or at least the negative PR is why) Facebook has attempted to remove the ability. Also are FB ads ever not flaggable/reportable?
- LordKano 12y ago
  My thought process went down a related path but found a completely different destination. "Your ex is much happier now and hopes that you're happy too but if you're not...Sorry about your luck."
baddox 12y ago
I feel like it stopped being "well played" when his roommate called him out and he just lied about it. At that point, there's nothing clever moving forward, other than the fact that he can apparently lie convincingly to a friend. Maybe that's just my "prank ethics" though.
- crazypyro 12y ago
  It's a white lie that became apparent to the roommate as soon as the next ad was shown. It added comedy to the joke, in my opinion. Did the lie hurt anyone?
  - sejje 12y ago
    Well, it's not for sure, but arguably. The author seems to think he was on the cusp of it, at least: >> I was afraid that if I didn’t end the torture he might need psychiatric treatment.
  - baddox 12y ago
    It didn't sound like it became apparent to the roommate shortly thereafter. According to the article, it was at least a week later, after the Snowden news broke and the roommate apparently became paranoid. I'm assuming that the report of paranoia and the sentence "I was afraid that if I didn’t end the torture he might need psychiatric treatment" is comedic hyperbole, but I cease giving any "prank credit" after the roommate explicitly and correctly called the author out as the source of the ads.
  - skizm 12y ago
    It isn't about hurting anyone, it is about having some pride as a trickster/troll. You played a good prank, your roommate figured it out. Time to move on. Anyone can lie through their teeth, that's not clever at that point.
  - unoti 12y ago
    It may not have hurt anyone. But a good rule to live by is: If you find yourself considering lying, then you have made some poor choices somewhere along the line. Every time you find yourself wanting to lie, think about it, and you may come to realize this is a solid rule to try to live by.
imranq 12y ago
You could use this for birthdays, anniversaries, special events...imagine once facebook takes over the web, we can pay them to make someone's day on the internet special.
- gknoy 12y ago
  Thank you for coming up with a much less creepy/prankish application. I think it totally would be cool to have my wife's ad feed on our anniversary (or her birthday, etc) be sponsored by me. :)
  - deleted 12y ago
    [deleted]
jrochkind1 12y ago
Today I learned that facebook adds can be targetted to a list of specific known individuals, not just demographics. It never occured to me that this would be.
- Zikes 12y ago
  Sort of makes sense, where some companies might have a list of customers' emails but they want to get around those pesky spam filters.
johnlbevan2 12y ago
To target just one person (in the new rules), rather than listing email addresses and only targeting one gender, couldn’t you upload one genuine and 19 fake email addresses? Or does FB filter your list based on those emails it recognises as users... in which case, is this a security hole where you can test an email against FB to see if that user’s registered by submitting 19 genuine addresses and 1 to-be-verified address to see if it’s accepted or not?
- pwnna 12y ago
  I assume it has to be real users on facebook. The author of the article suggest uploading 1 user targetted, and then 19 real users that's in a specific group, and exclude that group... Facebook could close this loophole by saying that the group targetted must be >20.. but even then I still think this kind of work will still work.. simply target people who liked Adblock or something + your friend, and your friend may be the only person that sees this.
  - gknoy 12y ago
    Or, bombard random people with Really Strange ads as collateral damage along with the pranking of one's friend. There are probably downsides to this, of course.
    - deleted 12y ago
      [deleted]
  - PeterisP 12y ago
    Well, there's no way to distinguish real users from "real" users - getting 19 sockpuppet accounts on FB is trivial, so just target them and your mark. As a bonus, if the advertising is per-view and your 19 fake accounts never log in, then the price of advertising to 19+1 is the same as advertising just to the intended target.
- jc4p 12y ago
  If the list you upload can't be matched to real users you get a generic error message of the form "Unable to match, check your input."
thrush 12y ago
nit: the scrolling on this page is interesting. what is the intent?
Zikes 12y ago
> It began innocently enough with me snagging the email address he had listed on his Facebook profile, adding it into an Excel worksheet, and exporting it as a .CSV file. This reminds me of the days when I'd get sent photos and screenshots embedded in Word documents.
- RobotCaleb 12y ago
  heh. It seems a CSV containing an email address would be pretty simple. Maybe just a V file.
zuck9 12y ago
wait, can i send zuckerberg whatever messages i want through this? how much would that cost?
- flavor8 12y ago
  He probably uses adblock.
  - zuck9 12y ago
    maybe facebook won't show him ads. no need for adblock
LukeB_UK 12y ago
Is it me or has this site hijacked the scrolling and changed the speed?
- meowface 12y ago
  It has. More and more sites do this nowadays. Not sure how I feel about it. Sometimes it's executed well, sometimes not so much.

343 points by manualwise 12y ago

Reminds me of this post - http://www.gabrielweinberg.com/blog/2010/05/a-fb-ad-targeted-at-one-person-my-wife.html http://www.gabrielweinberg.com/blog/2010/05/a-fb-ad-targeted...

randomwalker 12y ago

The reason that Facebook changed their policy to disallow targeting to a very small audience is because of this paper http://repository.cmu.edu/cgi/viewcontent.cgi?article=1066&context=jpc http://repository.cmu.edu/cgi/viewcontent.cgi?article=1066&c... It studies the same problem as the author here exploited, but goes a lot farther to try and infer things about the targeted individual from the analytics that FB provides to the advertiser. The paper won the Privacy Enhancing Technologies award. That was back in 2010. If the author succeeded anyway, it seems that Facebook was careless in their implementation of the fix.

RexRollman 12y ago
Or they don't really care.
petercooper 12y ago
In this case they used Custom Audience Targeting which is different to what's used in the paper. CAT is advertising based on a list of personally identifiable information about your "targets" that you supply, which can include user IDs, phone numbers, e-mail addresses, etc. I can't confirm but suspect no limit is required for this since you already have their personal data. As an aside, an interesting use of this system I've seen in the Internet marketing world is to buy e-mail or phone number lists from list vendors and use them to create custom audiences in Facebook. You can't e-mail them because that's spam and you'll be busted very quickly, but using them as fodder for custom audiences on platforms like Facebook is a way of laundering the info, in a sense. (I've not tried it myself but thought the idea was clever.)

ecocentrik 12y ago

Nice try facebook...

arjie 12y ago

An incredibly amusing anecdote. Very clever of you!

mjwhansen 12y ago

Worth noting: you can no longer target based on user IDs (unless you obtained it through a Facebook app): https://www.facebook.com/help/community/question/?id=10202543406411671 https://www.facebook.com/help/community/question/?id=1020254...

Uhhrrr 12y ago

Interesting. Could one use this to harass an ex? Because unless these sorts of ads are flaggable, I bet that will happen, whether unintentionally ("Dear Angelina, I miss you and I know you have seen this 53 times") or intentionally ("YOU HORRIBLE DEMON BIRCH %$@#%$!!!").

crazypyro 12y ago
There are hundreds of examples where privacy could be violated and misused. This is why (or at least the negative PR is why) Facebook has attempted to remove the ability. Also are FB ads ever not flaggable/reportable?
LordKano 12y ago
My thought process went down a related path but found a completely different destination. "Your ex is much happier now and hopes that you're happy too but if you're not...Sorry about your luck."

baddox 12y ago

I feel like it stopped being "well played" when his roommate called him out and he just lied about it. At that point, there's nothing clever moving forward, other than the fact that he can apparently lie convincingly to a friend. Maybe that's just my "prank ethics" though.

crazypyro 12y ago
It's a white lie that became apparent to the roommate as soon as the next ad was shown. It added comedy to the joke, in my opinion. Did the lie hurt anyone?
- sejje 12y ago
  Well, it's not for sure, but arguably. The author seems to think he was on the cusp of it, at least: >> I was afraid that if I didn’t end the torture he might need psychiatric treatment.
- baddox 12y ago
  It didn't sound like it became apparent to the roommate shortly thereafter. According to the article, it was at least a week later, after the Snowden news broke and the roommate apparently became paranoid. I'm assuming that the report of paranoia and the sentence "I was afraid that if I didn’t end the torture he might need psychiatric treatment" is comedic hyperbole, but I cease giving any "prank credit" after the roommate explicitly and correctly called the author out as the source of the ads.
- skizm 12y ago
  It isn't about hurting anyone, it is about having some pride as a trickster/troll. You played a good prank, your roommate figured it out. Time to move on. Anyone can lie through their teeth, that's not clever at that point.
- unoti 12y ago
  It may not have hurt anyone. But a good rule to live by is: If you find yourself considering lying, then you have made some poor choices somewhere along the line. Every time you find yourself wanting to lie, think about it, and you may come to realize this is a solid rule to try to live by.

imranq 12y ago

You could use this for birthdays, anniversaries, special events...imagine once facebook takes over the web, we can pay them to make someone's day on the internet special.

gknoy 12y ago
Thank you for coming up with a much less creepy/prankish application. I think it totally would be cool to have my wife's ad feed on our anniversary (or her birthday, etc) be sponsored by me. :)
- deleted 12y ago
  [deleted]

jrochkind1 12y ago

Today I learned that facebook adds can be targetted to a list of specific known individuals, not just demographics. It never occured to me that this would be.

Zikes 12y ago
Sort of makes sense, where some companies might have a list of customers' emails but they want to get around those pesky spam filters.

johnlbevan2 12y ago

To target just one person (in the new rules), rather than listing email addresses and only targeting one gender, couldn’t you upload one genuine and 19 fake email addresses? Or does FB filter your list based on those emails it recognises as users... in which case, is this a security hole where you can test an email against FB to see if that user’s registered by submitting 19 genuine addresses and 1 to-be-verified address to see if it’s accepted or not?

pwnna 12y ago
I assume it has to be real users on facebook. The author of the article suggest uploading 1 user targetted, and then 19 real users that's in a specific group, and exclude that group... Facebook could close this loophole by saying that the group targetted must be >20.. but even then I still think this kind of work will still work.. simply target people who liked Adblock or something + your friend, and your friend may be the only person that sees this.
- gknoy 12y ago
  Or, bombard random people with Really Strange ads as collateral damage along with the pranking of one's friend. There are probably downsides to this, of course.
  - deleted 12y ago
    [deleted]
- PeterisP 12y ago
  Well, there's no way to distinguish real users from "real" users - getting 19 sockpuppet accounts on FB is trivial, so just target them and your mark. As a bonus, if the advertising is per-view and your 19 fake accounts never log in, then the price of advertising to 19+1 is the same as advertising just to the intended target.
jc4p 12y ago
If the list you upload can't be matched to real users you get a generic error message of the form "Unable to match, check your input."

thrush 12y ago

nit: the scrolling on this page is interesting. what is the intent?

Zikes 12y ago

> It began innocently enough with me snagging the email address he had listed on his Facebook profile, adding it into an Excel worksheet, and exporting it as a .CSV file. This reminds me of the days when I'd get sent photos and screenshots embedded in Word documents.

RobotCaleb 12y ago
heh. It seems a CSV containing an email address would be pretty simple. Maybe just a V file.

zuck9 12y ago

wait, can i send zuckerberg whatever messages i want through this? how much would that cost?

flavor8 12y ago
He probably uses adblock.
- zuck9 12y ago
  maybe facebook won't show him ads. no need for adblock

LukeB_UK 12y ago

Is it me or has this site hijacked the scrolling and changed the speed?

meowface 12y ago
It has. More and more sites do this nowadays. Not sure how I feel about it. Sometimes it's executed well, sometimes not so much.