41–50 of 99 posts
People suggesting outlandish, complex fingerprinting methods should read through the post comments. OP admitted they didn't clear browser cookies since they last used their old personal FB account. Mystery solved.
Earlier quoted context omitted.
javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated, it happens on a daily basis. your browser does a lot more than you think. FB most definately does not stay in your browser when it gets its hooks on you. BTW modal dialog buttons do more than the label says, the old meme "what button do i push to hack someone" can be written to "what button do i click to…
> javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated While you can finger print a browser relatively well with javascript, it does not have access to a number of the things you list, like MAC, router MAC, CPU serial number, etc.
Earlier quoted context omitted.
yes it does, there is also acoustic analysis of keyboard noise, quite a lot and this all happens at the time of account creation and early account use until the FB AI thinks it knows who you are, there is no need for constant listening or watching,
Do you have a source for this? I've done a reasonable amount of work on weaponizing these sorts of attacks and it's definitely nontrivial. I'd be shocked to find out that Facebook had successfully deployed them at scale.
I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…
the average user is quite naive regarding what thier systems give away. first off zuck is a blackhat straight up. browser space has its meathooks on your system, things such as canvasing and fingerprinting are not "deep" there is a constantly evolving threat regarding what is deep fingerprinting. The popup dialogs dont stick to doing what the buttons say they do, microsoft and the redefinition of the topright X is a…
Earlier quoted context omitted.
javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated, it happens on a daily basis. your browser does a lot more than you think. FB most definately does not stay in your browser when it gets its hooks on you. BTW modal dialog buttons do more than the label says, the old meme "what button do i push to hack someone" can be written to "what button do i click to…
Too much "1337 h4x0r" stuff. It's public knowledge (or even open source code) what browsers expose, and system logs or CPU serial numbers are certainly not part of that.
Earlier quoted context omitted.
Too much "1337 h4x0r" stuff. It's public knowledge (or even open source code) what browsers expose, and system logs or CPU serial numbers are certainly not part of that.
if you give permission from an admin login, it is trivial to take carte blanche of a machine, its trivial to convince someone to give you full access
I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…
OP was probably not a very technical user, else he/she would've understood that 1. They should've deleted _all_ relevant cookies (in the browser, as well as in the browsers cookie database) 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must 3. They probably came via the same User Agent (didn't mention changing browser…
> 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must Are you implying that ProtonVPN is not trusted/good? I'm seriously interested in what you know about this particular VPN provider as this is the one OP mentions he's was using.
Recently I wanted to have a look at a few ex coworker profiles (who are not my friends on FB). I didn't want to use my personal account because then it suggests me to them (something I wanted to avoid, as I'd not been in touch with them for almost a decade).
1. I created a VM (Ubuntu 18.04 + Firefox + uBlock -> enabled everything in uBlock).
2. Tried to create an Fb account -> asks for phone number. I didn't want to be identified so I could not continue.
3. Tried another way to create a new account -> success.
4. Fb obviously tried to figure out who I am -> was unable to do so at that point -> Forced me to post a picture of myself (and suspended my account until I did and they verified it).
5. Posted a made up picture and got past the first hurdle
6. Fb asked me for a phone number -> Logged out and used another means to log in.
7. Fb locked my account and asked for another picture (did similar in Step 5 once again)
8. Looked up my ex co-workers.
9. Until now, I've not been identified, I looked up a friend's profile (this friend is also my personal friend on Fb). FB immediately identified me and showed up my entire friends list as suggested friends).
10. I immediately tried to delete that profile (took 30+ days and they asked for Govt ID).
I've had multiple fake FB accounts, and FB's fingerprinting and data sharing is insanely crazy - I recently logged out of one my fake accounts on iOS via Safari Incognito (no FB app, Safari is always used as incognito) - it showed my personal phone number in the log in field.