Live data from Hacker News

Created a fake account and Facebook still figured out who I am. How?

reddit.com

71–80 of 99 posts

Re: Created a fake account and Facebook still figured out who I am. How?

#71

Earlier quoted context omitted.

Attendant Google'd name of the patient -> clicked on LinkedIn profile. That would be enough to get them suggested to you.

On the drive to my location... makes sense.

You said you saw it a week later. He could've looked at your profile any time in that week to establish a viable connection between you two.

Re: Created a fake account and Facebook still figured out who I am. How?

#72

Earlier quoted context omitted.

Attendant Google'd name of the patient -> clicked on LinkedIn profile. That would be enough to get them suggested to you.

On the drive to my location... makes sense.

Why would it have to happen on the drive?

Re: Created a fake account and Facebook still figured out who I am. How?

#73

I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo. 1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234) 2) User creates a new Proton Mail address. (Fakey@protonmail.com) 3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com…

This shows how just trying to protect your privacy alone doesn't work. Facebook relies on the unintentional betrayal of your friends and associates.

You might not have put your phone number into facebook, but someone you know put your number in with your full name and the facebook app harvested it. Facebook now has your phone number in your shadow profile.

Everyone less privacy savvy than you will inadvertently permit a corporation to harvest your personal information to profit from.

Re: Created a fake account and Facebook still figured out who I am. How?

#74

Earlier quoted context omitted.

Could you provide the JavaScript code that would allow a modal button to access these items?

You should look at what microsoft did to sneak its way into a win10 install, you should also look at what google does to snarf permissions with a button by another name. the breadcrumbs can start here. https://apenwarr.ca/log/20190201 your smart kid figure it out youll learn more that way versus being spoon fed. BTW im sure that posting such code here would be a criminal activity that dang and others would frown upon…

Original:

Link?

Edit: >You should look at what microsoft did to sneak its way into a win10 install, you should also look at what google does to snarf permissions with a button by another name. the breadcrumbs can start here.

>https://apenwarr.ca/log/20190201

> your smart kid figure it out youll learn more that way versus being spoon fed.

That has zero technical information, just a lot of vague hand-waving. Give me something technical here.

New Edit:

> BTW im sure that posting such code here would be a criminal activity that dang and others would frown upon profusely.

You're claiming this can be done in JavaScript. If it can be done in JavaScript, it's not going to be illegal.

Re: Created a fake account and Facebook still figured out who I am. How?

#75

after reading through this thread, i find some very concerning things. The use of the word nontrivial is one thing. Calling something nontrivial does not mean you have expertise, there are a number of analytic tools that are being called non trivial or too complex, and that means it is non trivial to the caller. The rest of us who use these techniques as often as breathing find them trivial to say the least. The lack…

>after reading through this thread, i find some very concerning things. The use of the word nontrivial is one thing. Calling something nontrivial does not mean you have expertise, there are a number of analytic tools that are being called non trivial or too complex, and that means it is non trivial to the caller. The rest of us who use these techniques as often as breathing find them trivial to say the least. The lack of knowldege regarding just how extensively big data reaches into our platform is another. lets look at google, the practice of asking permission for something mundane like sorting pictures according to location can be accomplished by scraping exif data, but google uses this for an opportunity to turn on location tracking in the background. Facebook most definately does not refrain from background permission jacking. The tools and API's laying around in the open for any one to take advantage of is another. win10 telemetry provides an intimate snapshot of a win10 instance, and any one can use that telemetry to fingerprint your hardware. Even encrypted telemetry is a highly individual number that doesnt need to be decrypted to indicate an individual machine across the internet. >The title of this forum "hackernews" is concerning, there seem to be no hackers here at all. All of the "non trivial" actions here are non trivial to those that know very little about CS in general, or have an extremely antiquated perspective on the nature and extent of system penetration as it stands today. A "normie" is not likely to know anything about lockpicking, but even an apprentice locksmith finds it extremely trivial, its just a matter of perfecting dexterity over a couple of months to be quick and slick about it.

>Facebook is one of the biggest threats to national security we have in our back yard, and the lackadaisical attitudes displayed here regarding security, only set that threat in stone and perpetuity.

I see meetuu, zucksablackhat, and ohWARisme all posting in succession in the same places - are you all the same user? edit: Threw in parents post in case of deletion.

Re: Created a fake account and Facebook still figured out who I am. How?

#76

Earlier quoted context omitted.

> javascript has a lot of power, and it acesses more than the browser, and none of this is remotely too complicated While you can finger print a browser relatively well with javascript, it does not have access to a number of the things you list, like MAC, router MAC, CPU serial number, etc.

when you click a modal button are you sure it does what is assumed? recall win10 upgrade scandal? (the X)

>when you click a modal button are you sure it does what is assumed? recall win10 upgrade scandal? (the X)

Hijacking a button to do something different is a matter of attaching a different event to it - which is exactly what you can do with windows forms for things like "do you want to save?" To access information that's not actually available is a whole other level. Why would you consider those two are equivalent?

edit: To include parent's question and clarify why it's trivial.

Re: Created a fake account and Facebook still figured out who I am. How?

#77
post #5

cameradust, browser fingerprinting, graphic/sound card canvas, memory canvas mouse usage, keyboard usage, cpu serial number, MAC, router MAC, system logs, telemetry

@mod team/dang, can you take a look at the origin of accounts ohWARisme, meetuu, and zucksablackhat? Highly suspect they're just alt accounts, and they're spamming this thread with... questionable quality discussion/FUD.

Re: Created a fake account and Facebook still figured out who I am. How?

#78
post #25
post #7

OP was probably not a very technical user, else he/she would've understood that 1. They should've deleted _all_ relevant cookies (in the browser, as well as in the browsers cookie database) 2. There are many 3rd party companies that sell data packs that derive residential IPs from VPN IPs (we use some at work). A trusted/good VPN is a must 3. They probably came via the same User Agent (didn't mention changing browser…

What is a trusted/good VPN to use?

Take all advice on this with a grain of salt please. And never directly trust someone who says "use this specific VPN because it is good". Their threat model may not match yours, so good for them may not be good for you.

If you would like to learn a good VPN using the data yourself, consider using these tools:

This site has a detailed list of all VPN providers and properties of their services.

https://thatoneprivacysite.net/vpn-section/

And this site talks about some of the concerns you may want to have when picking a VPN service.

https://www.privacytools.io/#vpn

Re: Created a fake account and Facebook still figured out who I am. How?

#79
post #77
post #5

cameradust, browser fingerprinting, graphic/sound card canvas, memory canvas mouse usage, keyboard usage, cpu serial number, MAC, router MAC, system logs, telemetry

@mod team/dang, can you take a look at the origin of accounts ohWARisme, meetuu, and zucksablackhat? Highly suspect they're just alt accounts, and they're spamming this thread with... questionable quality discussion/FUD.

The best way to get the mods' attention for matters like this is to email them directly via the Contact link in the footer.

Re: Created a fake account and Facebook still figured out who I am. How?

#80

after reading through this thread, i find some very concerning things. The use of the word nontrivial is one thing. Calling something nontrivial does not mean you have expertise, there are a number of analytic tools that are being called non trivial or too complex, and that means it is non trivial to the caller. The rest of us who use these techniques as often as breathing find them trivial to say the least. The lack…

>after reading through this thread, i find some very concerning things. The use of the word nontrivial is one thing. Calling something nontrivial does not mean you have expertise, there are a number of analytic tools that are being called non trivial or too complex, and that means it is non trivial to the caller. The rest of us who use these techniques as often as breathing find them trivial to say the least. The lac…

...and you win the prize for realizing something that is trivially obvious, you sir are a cut above the rest, now continue to use the gift of a brain given too you and do some good in this world, there are major problems that people like you should work to resolve. A++ for you.
Post reply on HN