Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Created a fake account and Facebook still figured out who I am. How?

reddit.com

Post reply on HN
Print view View original

31–40 of 99 posts

Re: Created a fake account and Facebook still figured out who I am. How?

#31

Post by gruez »

decebalus1 wrote: post #11
rayvy wrote: post #7

OP was probably not a very technical user, else he/she would've understood that 1. They should've deleted _all_ relevant cookies (in the browser, as well as in the browsers cookie database) 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must 3. They probably came via the same User Agent (didn't mention changing browser…

> 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must Are you implying that ProtonVPN is not trusted/good? I'm seriously interested in what you know about this particular VPN provider as this is the one OP mentions he's was using.

I suspect that the VPN provider has nothing to do with it (ie. they're not getting the data from VPN providers ratting you out). Rather, they're linking your ips using third party cookies.

Re: Created a fake account and Facebook still figured out who I am. How?

#32

Post by rmorey »

bjt2n3904 wrote: post #23

I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…

In the Reddit thread someone brought this up, and OP explicitly stated the protonmail address was brand new, and created solely for this purpose

Re: Created a fake account and Facebook still figured out who I am. How?

#33

Post by sllabres »

rayvy wrote: post #7

OP was probably not a very technical user, else he/she would've understood that 1. They should've deleted _all_ relevant cookies (in the browser, as well as in the browsers cookie database) 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must 3. They probably came via the same User Agent (didn't mention changing browser…

There are many more identifying characteristics

https://panopticlick.eff.org

Re: Created a fake account and Facebook still figured out who I am. How?

#34

Post by rbinv »

meetuu wrote: post #16
megous wrote: post #10

Earlier quoted context omitted.

Sounds too complicated, and half of that is not even accessible from the browser. He used just the browser.

javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated, it happens on a daily basis. your browser does a lot more than you think. FB most definately does not stay in your browser when it gets its hooks on you. BTW modal dialog buttons do more than the label says, the old meme "what button do i push to hack someone" can be written to "what button do i click to…

Too much "1337 h4x0r" stuff.

It's public knowledge (or even open source code) what browsers expose, and system logs or CPU serial numbers are certainly not part of that.

Re: Created a fake account and Facebook still figured out who I am. How?

#35

Post by rbinv »

albeebe1 wrote: post #19
meetuu wrote: post #5

cameradust, browser fingerprinting, graphic/sound card canvas, memory canvas mouse usage, keyboard usage, cpu serial number, MAC, router MAC, system logs, telemetry

cameradust? that's clever if it means what i think it means, aka looking at artifacts in a photo caused by "gunk" on your lens.

They do have a patent filing: http://patft.uspto.gov/netacgi/nph-Parser?Sect2=PTO1&Sect2=H...

Re: Created a fake account and Facebook still figured out who I am. How?

#37

Post by ChrisSD »

bjt2n3904 wrote: post #23

I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…

My one and only facebook profile was a complete fake and yet it managed to recommend I follow many of my real family and some of my social circle. My guess this was simply based on my location because the people it recommended were also family/friends of people who had used facebook from my house.

Re: Created a fake account and Facebook still figured out who I am. How?

#38

Post by timbit42 »

jdhn wrote: post #25
rayvy wrote: post #7

OP was probably not a very technical user, else he/she would've understood that 1. They should've deleted _all_ relevant cookies (in the browser, as well as in the browsers cookie database) 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must 3. They probably came via the same User Agent (didn't mention changing browser…

What is a trusted/good VPN to use?

NordVPN

Re: Created a fake account and Facebook still figured out who I am. How?

#39

Post by zucksablackhat »

bjt2n3904 wrote: post #23

I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…

the average user is quite naive regarding what thier systems give away. first off zuck is a blackhat straight up. browser space has its meathooks on your system, things such as canvasing and fingerprinting are not "deep" there is a constantly evolving threat regarding what is deep fingerprinting. The popup dialogs dont stick to doing what the buttons say they do, microsoft and the redefinition of the topright X is a raging example. ALL of the techniques mentioned here so far are in play, from "deleted" data retention, to actually hacking to pwn sytem permissions, this is a very big reason a windows user should not cruise the web logged in to an administrator account.
Post reply on HN