221–230 of 478 posts
As a security engineer, I cannot overstate just how horrible this is. Phone numbers might not be an ideal 2nd factor for authentication, but to punish users for setting up 2FA by using the provided phone number for ad targetting is incredibly unethical.
It is OBVIOUSLY for ad targeting, I think I mentioned it not even two weeks ago: https://news.ycombinator.com/item?id=18020177
This kind of thing has been going on forever, and I've told people this. 99% of people don't actually care, though.
Earlier quoted context omitted.
You can do it with Gmail to some extent already. E.g. instead of using myemail@gmail.com I would use myemail+facebook@gmail.com. Gmail ignores anything after the plus. As someone mentioned, marketing companies usually share just the hash of email. The trick is not too popular and I didn't experience a company handling it yet.
A vast majority of companies either don't accept the plus because they are too lazy to implement proper email validation, or they strip the pluses from gmail addresses because they're strictly useless to them.
People of multiple platforms dislike me for discrediting facebook. Simply talking about facts and what they could expect. They think they know it all. Some corps are good some are evil. People tend to forget that an evil person could also be your most trusted and reliable one. I work as a cyber security engineer and the things i have see flying by are crazy. The fact that information is sold without you4 knowledge is…
What can we do about it? I realize this is probably not answerable in this thread but I find myself asking this question more frequently lately and I still cannot answer it. would be happy to see this discussion split into an Ask HN: or other, I think this topic should be debated quite a bit more than it is with the goal of attaining real results on fixing these issues.
Earlier quoted context omitted.
Isn't this it though, the engineers designing the ad targeting system at Facebook is linking the random emails you use as "catch all" to your main identity so you can be targeted specifically even though neither party has full knowledge of the linkage between your catchall email and your main identity email. This is facilitated by information that is not under your control. If facebook was able to design and build th…
Check the TOS and/or implementations for many of the tracking providers and you’ll see they use hashed emails. Show me a way to extract the common domain name from the below: 9425ca8eb02d022309ec175a7067b1567a5f741ec7010cc1b5034287f9db6e2f 4d1c86b9f418c713e784760fea809e34418c2f13e993d907783572ecc2c9bb6e
I doubt it'd be worth spending the effort to target people with personal domains though, and it would have some negative effects, so your point is well taken.
Earlier quoted context omitted.
I'm sure it's possible to advertise without tracking. We did it for years.
I'd whitelist a true advertiser who ditches tracking entirely and focuses more on advertising content relevant to the page it's going on instead. Chances are if I'm looking at some Python programming page or server setup tutorial I'd be more inclined to click on ads relevant to the page as opposed to a creepy ad of something vague as heck that I looked up on Amazon 5 years ago that Amazon really wants to sell, or wha…
Another personal observation. I have an Instagram account that I thought was fully incognito. I never connected it to any other social account, I used a separate email for authentication etc. Just days after the Instagram founders left Facebook I started receiving friend suggestion on my IG that were very very relevant. Those were people I knew in real life and mostly connected via Facebook but not only. I shouldn't…
This is a perfect example of the need for physical comparmentation. Separate devices never connected through the same internet service. As far as devices go, to think you have separated “anything” on only one device, you’re living in fantasyland.
With a single device, it's fairly reliable to use a vpn or multiple vpn providers and only log in to each account when connected to a given vpn.
Earlier quoted context omitted.
I think that if it's possible to define a way of operating businesses in a way that doesn't harvest data in a way that's nonessential to the services, then there should be a law requiring this option: to pay out of your pocket directly the amount of revenue the company would have expected to make, in exchange for the company not doing this data collection. But it seems difficult to get to such a definition. I think t…
Indirectly GDPR does this. All data collection must be either opt in, or necessary to provide the service.
Earlier quoted context omitted.
I agree with your sentiment. But, as someone who understands that not all people and companies use the same moral set as myself, this is why I've never set up 2fa using a phone. Why should I give some company my phone number? Increasingly it's become a single point of metadata to uniquely describe myself (just as my email addresses have).
> just as my email addresses have That doesn’t need to be the case though with just a little bit of effort and minimal cost. Use your own domain for email and set your account to be a catchall. Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier.
That’s their business model, it’s what they do. If you use it, treat all data as public. Otherwise, don’t.