Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook can track your browsing even after you've logged out, judge says

theguardian.com

Post reply on HN
Print view View original

171–180 of 208 posts

Re: Facebook can track your browsing even after you've logged out, judge says

#171

Post by sillysaurus3 »

problems wrote: post #170
sillysaurus3 wrote: post #149

Earlier quoted context omitted.

Is it really that effective? I admit I assumed it was hard to dodge the global advertisement apparatus, but maybe it's possible. Example: jQuery is sometimes hosted on Google CDNs. You can't block that request without breaking the site, right? But that request sends all your info.

Yes, it's really that effective - blocking the facebook like button doesn't break most websites. And typically a request for something like jquery from a CDN will contain little more than your IP address and cookies. You can even prevent the cookies from being sent if you want. The only way they could get away with more than this would be to modifying the resulting script to grab more info from your machine.

Isn't your IP address plus cookies enough to track you?

Re: Facebook can track your browsing even after you've logged out, judge says

#172

Post by Spivak »

microwavecamera wrote: post #147
j1f4 wrote: post #105

Earlier quoted context omitted.

As a Firefox on Linux user I checked one of those sites that tries to estimate how many bits each public aspect of your setup reveals about you. It turned out available fonts was by far the most unique aspect of my setup.

The only surefire way is to disable javascript, extensions, cookies, etc. https://browserleaks.com has a pretty good breakdown of the different techniques you can use. There's another JS technique that probes the hardware to fingerprint a browser too. http://yinzhicao.org/TrackingFree/crossbrowsertracking_NDSS1... Use Tor Browser even if your not using Tor if you're looking for better privacy. It's modified to mitiga…

But with such a unique browsing situation you're basically identifiable on that basis alone. Your best bet would be to have your browser present itself as a common browser on a common platform, and block tracking and ads.

Re: Facebook can track your browsing even after you've logged out, judge says

#173

Post by deeth_starr_v »

sillysaurus3 wrote: post #142
andrewaylett wrote: post #120

Earlier quoted context omitted.

Privacy Badger is also good for things like this: you can be logged into Facebook, but Privacy Badger will block requests to Facebook from third-party sites. https://www.eff.org/privacybadger

None of these measures protect you against tracking, though. And if they don't, why use them? It's better to be honest with yourself and admit how effective tracking is nowadays. Your user agent plus unique plugin installations plus fonts installed equals a unique fingerprint across IP addresses. The above isn't an exhaustive list, either. There are dozens of tricks to track you.

Only works on desktop browsers. Fingerprinting doesn't work on Safari iOS. Pretty sure stock Android is unreliable too.

Re: Facebook can track your browsing even after you've logged out, judge says

#174

Post by problems »

sillysaurus3 wrote: post #171
problems wrote: post #170

Earlier quoted context omitted.

Yes, it's really that effective - blocking the facebook like button doesn't break most websites. And typically a request for something like jquery from a CDN will contain little more than your IP address and cookies. You can even prevent the cookies from being sent if you want. The only way they could get away with more than this would be to modifying the resulting script to grab more info from your machine.

Isn't your IP address plus cookies enough to track you?

Yes, but they can be trivially blocked or discarded. My main point is that no advanced fingerprinting tactics can be used so the simple means work in the case of most site-breaking things. Privacy Badger eats CDN cookies - that's actually one of its main features, so it will prevent this kind of thing quite nicely without breaking websites.

Re: Facebook can track your browsing even after you've logged out, judge says

#175

Post by totalperspectiv »

dmix wrote: post #165
Karunamon wrote: post #145

Earlier quoted context omitted.

I just wish Privacy Badger didn't force DNT to be enabled. Not only does the entire concept mean trusting the advertising companies implicitly, the header serves to differentiate your traffic.

You're worried about browser fingerprinting? Does any Firefox extension effectively counter that? From my understanding blocking 3rd party JS is largely insufficient for accomplishing this, regardless of DNT settings. You may be right regardless that it's better to appear as much like a stock browser as possible, in terms of privacy settings, so DNT should stay disabled. But in practical terms it might not make of a…

I don't know of any tools to block fingerprinting, but here's a cool tool by the EFF for testing how unique your browser is: https://panopticlick.eff.org

Re: Facebook can track your browsing even after you've logged out, judge says

#176

Post by cpeterso »

_jal wrote: post #86
sametmax wrote: post #75

Earlier quoted context omitted.

We changed that for a reason. No use wants to be logged out that often. Actually most facebook user probably enter their password one time a month. Less if they use the mobile.

Wish it were still an option; I use quite a bit of RAM on multiple instances of browsers for this very reason.

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site. If a.com and b.com both load images from evilcorp.com, Firefox will send evilcorp.com different cookies for requests from a.com and b.com. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work without cookie "crosstalk".

You can test first-party isolation now by flipping the about:config pref "privacy.firstparty.isolate" to true. Beware that there are still bugs that break some sites, which is why the feature is not enabled by default yet. If you find bugs, please report them in Bugzilla! Here is the Firefox bug tracking the integration and known bugs:

https://bugzilla.mozilla.org/show_bug.cgi?id=1299996

Re: Facebook can track your browsing even after you've logged out, judge says

#177

Post by Piccollo »

makecheck wrote: post #154

Sometimes I think people need a little more "Black Mirror" to see how bad this is. One of the episodes has random people basically constantly looking at and filming a woman everywhere; certainly no less than what Facebook does every day, yet somehow it doesn't seem weird to anyone?

I can already tell Season 4 is gonna be awesome

Re: Facebook can track your browsing even after you've logged out, judge says

#178

Post by ddalex »

snakeanus wrote: post #157
andrewaylett wrote: post #120

Earlier quoted context omitted.

Privacy Badger is also good for things like this: you can be logged into Facebook, but Privacy Badger will block requests to Facebook from third-party sites. https://www.eff.org/privacybadger

You can also do that with uMatrix as well as with uBlock Origin.

Or Ghostery. I run it side by side with ublock Origin. It makes the web livable.

Re: Facebook can track your browsing even after you've logged out, judge says

#179

Post by emn13 »

totalperspectiv wrote: post #175
dmix wrote: post #165

Earlier quoted context omitted.

You're worried about browser fingerprinting? Does any Firefox extension effectively counter that? From my understanding blocking 3rd party JS is largely insufficient for accomplishing this, regardless of DNT settings. You may be right regardless that it's better to appear as much like a stock browser as possible, in terms of privacy settings, so DNT should stay disabled. But in practical terms it might not make of a…

I don't know of any tools to block fingerprinting, but here's a cool tool by the EFF for testing how unique your browser is: https://panopticlick.eff.org

Panopticlick is a best guess, only. If you use exactly the same system twice, it should detect that. However, browsers and systems autoupdate frequently, and various other things that are fingerprinted are also not really fixed.

For a single browser session; this should work. Over months, it's harder. A tracker would needs to at least be quite aggressive and collect a lot of information to track you, and then be fairly clever in fuzzily matching that in the future if they want to track you over time.

Which isn't to say that short-to-medium term tracking is just fine, but it's not black and white either.

Re: Facebook can track your browsing even after you've logged out, judge says

#180

Post by vacri »

benevol wrote: post #27
m_eiman wrote: post #15

Firefox has a pretty neat feature I discovered recently: https://wiki.mozilla.org/Security/Contextual_Identity_Projec... It lets you run multiple sessions in one window, where each tab belongs to a specific session with separated cookies and such. I've got a bunch of tabs where I'm logged in to Facebook, another set where I'm logged in to Google and the rest of them where I'm not logged in to either. Of course they c…

Wouldn't opening several "Private Windows" achieve the same situation? What are the differences?

Your browser (FF and Chrome, at least) only has a single private session, regardless of whether you have multiple windows in private mode or not.
Post reply on HN