Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Created a fake account and Facebook still figured out who I am. How?

reddit.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Created a fake account and Facebook still figured out who I am. How?

#51

Post by groovylick »

throwawayosiu1 wrote: post #50

While the user might have issues (like cookies and other features) - I can guarantee you Facebook does all kinds of creepy stuff to identify who you are. Worse yet, once they think they've successfully identified you - they share your details with who they think you are. Personal example: Recently I wanted to have a look at a few ex coworker profiles (who are not my friends on FB). I didn't want to use my personal ac…

You'll need to change your IP as well. Something you have never logged in as to create the account. Sock puppet accounts can be associated by IP and social graph searches.

Re: Created a fake account and Facebook still figured out who I am. How?

#52

Post by rayvy »

sllabres wrote: post #33
rayvy wrote: post #7

OP was probably not a very technical user, else he/she would've understood that 1. They should've deleted _all_ relevant cookies (in the browser, as well as in the browsers cookie database) 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must 3. They probably came via the same User Agent (didn't mention changing browser…

There are many more identifying characteristics https://panopticlick.eff.org

Great resource, thanks

Re: Created a fake account and Facebook still figured out who I am. How?

#53

Post by throwawayosiu1 »

groovylick wrote: post #51
throwawayosiu1 wrote: post #50

While the user might have issues (like cookies and other features) - I can guarantee you Facebook does all kinds of creepy stuff to identify who you are. Worse yet, once they think they've successfully identified you - they share your details with who they think you are. Personal example: Recently I wanted to have a look at a few ex coworker profiles (who are not my friends on FB). I didn't want to use my personal ac…

You'll need to change your IP as well. Something you have never logged in as to create the account. Sock puppet accounts can be associated by IP and social graph searches.

I used VPNs. But FB keeps a track of a lot of public VPN & Cloud providers and then throws a ton more "captchas" your way - asking for your picture, govt id, phone number verification etc.

As for searches - I've searched a lot of random stuff totally unrelated to my personal account JUST to throw FB off while acting like a real user (liking, reading, scrolling etc.).

Re: Created a fake account and Facebook still figured out who I am. How?

#54

Post by SketchySeaBeast »

meetuu wrote: post #16
megous wrote: post #10

Earlier quoted context omitted.

Sounds too complicated, and half of that is not even accessible from the browser. He used just the browser.

javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated, it happens on a daily basis. your browser does a lot more than you think. FB most definately does not stay in your browser when it gets its hooks on you. BTW modal dialog buttons do more than the label says, the old meme "what button do i push to hack someone" can be written to "what button do i click to…

Could you provide the JavaScript code that would allow a modal button to access these items?

Re: Created a fake account and Facebook still figured out who I am. How?

#55

Post by debatem1 »

zucksablackhat wrote: post #43
debatem1 wrote: post #29

Earlier quoted context omitted.

Do you have a source for this? I've done a reasonable amount of work on weaponizing these sorts of attacks and it's definitely nontrivial. I'd be shocked to find out that Facebook had successfully deployed them at scale.

nontrivial is in the eyes of the beholder. FB does a lot of things quite shocking, and uses zero days, and soc eng like jack the bear, dont forget zucks roots, he did this stuff from day one. BTW im not abou to distribute hack source on HN, pearls among swine goes nowhere here.

Let's please not hypothesize exotic attack capability without evidence. It makes it difficult to get people to pay attention when we really need them to be concerned about sophisticated adversaries.

Re: Created a fake account and Facebook still figured out who I am. How?

#56

Post by aboutruby »

throwawayosiu1 wrote: post #50

While the user might have issues (like cookies and other features) - I can guarantee you Facebook does all kinds of creepy stuff to identify who you are. Worse yet, once they think they've successfully identified you - they share your details with who they think you are. Personal example: Recently I wanted to have a look at a few ex coworker profiles (who are not my friends on FB). I didn't want to use my personal ac…

You can use disposable phone numbers to receive text messages

Re: Created a fake account and Facebook still figured out who I am. How?

#57

Post by 11thEarlOfMar »

Here's another, this time with LinkedIn.

I took an ambulance ride. The attendant in the back talked with me during the ride to monitor whether I was remaining lucid. Did not know him, never met him before, never saw him since.

A week later, I was scrolling through LinkedIn recommended connections and saw a face I recognized, but could not place.... until I saw that they worked for the ambulance company that I had ridden with.

Did LinkedIn track both of our locations and figure out that we rode in the same vehicle at the same time? This is absolutely possible. Did LinkedIn use voice prints to confirm that his voice came through my phone and mine through his and therefore we had a conversation? Can do.

Did they?

Color me freaked out.

Re: Created a fake account and Facebook still figured out who I am. How?

#58

Post by throwawayosiu1 »

aboutruby wrote: post #56
throwawayosiu1 wrote: post #50

While the user might have issues (like cookies and other features) - I can guarantee you Facebook does all kinds of creepy stuff to identify who you are. Worse yet, once they think they've successfully identified you - they share your details with who they think you are. Personal example: Recently I wanted to have a look at a few ex coworker profiles (who are not my friends on FB). I didn't want to use my personal ac…

You can use disposable phone numbers to receive text messages

FB blocks those numbers, I've tried those in the past. Almost all major services that use phone verification ignore those numbers out right or act like they accept it but either:

1. don't bother sending texts

2. shadowban you

Re: Created a fake account and Facebook still figured out who I am. How?

#59

Post by dzhiurgis »

11thEarlOfMar wrote: post #57

Here's another, this time with LinkedIn. I took an ambulance ride. The attendant in the back talked with me during the ride to monitor whether I was remaining lucid. Did not know him, never met him before, never saw him since. A week later, I was scrolling through LinkedIn recommended connections and saw a face I recognized, but could not place.... until I saw that they worked for the ambulance company that I had rid…

Whats the population of your town?

Re: Created a fake account and Facebook still figured out who I am. How?

#60

Post by eridius »

bjt2n3904 wrote: post #23

I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…

From the comments it sounds like the real answer is cookies: https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a...
Post reply on HN