[flagged]
All those pitiful ignoramuses, who have no idea how to walk three times around the block to avoid the Staasi - they need to be protected from the secret police, pshaw!
Sexual abuse tip-off site could be sharing data with Facebook
11–20 of 62 posts
Re: Sexual abuse tip-off site could be sharing data with Facebook
#12[flagged]
There are dar too many ways to track you, I doubt you can block all
Re: Sexual abuse tip-off site could be sharing data with Facebook
#13Earlier quoted context omitted.
100% this, the marketing team wants to have Google Tag Manager to inject random marketing scripts all across the page and management backs them up and then the development team has no insight to or no say in what actual scripts are run on a specific page. That said: This is a GDPR nightmare and so is Google Tag Manager
Subresource Integrity fixes that: "hmm, must be a bug at Google's end"
It really doesn’t fix it, since the whole point of GTM is to allow arbitrary code execution on any page by marketing teams. (Yes, this is as bad of an idea as it sounds)
Re: Sexual abuse tip-off site could be sharing data with Facebook
#14If you have a website where privacy is absolutely essential, you should NEVER include any third party content.
I find it unfathomable someone needs to say that.
Re: Sexual abuse tip-off site could be sharing data with Facebook
#15„Swedish Radio News reporters have tested the tip-form on ECPAT's website and found that their name, email and telephone numbers were shared with Facebook.“ How the hell does this just happen? Have people forgotten how to build simple forms and just use Facebook?
Something is off here. When PII data is shared with Facebook, it gets hashed before it gets sent. In fact, Facebook warns you if you are “leaking” PII in places like URL parameters that get picked up by their tracking pixel.
If they discover pageview events with PII in them, they throw them out.
I’m not justifying that hashed data is okay… but clear text data is not received or stored by Facebook via a Facebook Pixel, or their conversions API.
Re: Sexual abuse tip-off site could be sharing data with Facebook
#16„Swedish Radio News reporters have tested the tip-form on ECPAT's website and found that their name, email and telephone numbers were shared with Facebook.“ How the hell does this just happen? Have people forgotten how to build simple forms and just use Facebook?
Something is off here. When PII data is shared with Facebook, it gets hashed before it gets sent. In fact, Facebook warns you if you are “leaking” PII in places like URL parameters that get picked up by their tracking pixel. If they discover pageview events with PII in them, they throw them out. I’m not justifying that hashed data is okay… but clear text data is not received or stored by Facebook via a Facebook Pixel…
If facebook had the clear or hashed data anywhere else you’re still leaking it just with extra steps. Hashes don’t by themselves anonymize. If you have access to the original data it’s trivial to recompute the hash and build your association that way. You could assume the data is salted but that’s not always a safe assumption.
Re: Sexual abuse tip-off site could be sharing data with Facebook
#17„Swedish Radio News reporters have tested the tip-form on ECPAT's website and found that their name, email and telephone numbers were shared with Facebook.“ How the hell does this just happen? Have people forgotten how to build simple forms and just use Facebook?
They probably embedded tracking pixels because PR teams wanted to have data on how many people viewed the page vs how many people actually filed a report.
Why do I get feeling time and time again that developers pick the easy solutions. Not the sensible ones.
Some type of page download counter should not be impossible, and number of reports should also be easy metric. Why do they even think they need to get someone like Facebook involved...
Re: Sexual abuse tip-off site could be sharing data with Facebook
#18If you have a website where privacy is absolutely essential, you should NEVER include any third party content. I find it unfathomable someone needs to say that.
Case study: I help run a site that has resources for trans and LGBT people.
With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting.
- The only JavaScript is that which is necessary to run the site;
- The site only listens on HTTPS;
- There are no cookies;
- I explicitly opt users out of FLoC to prevent other sites targeting ads to my users based on my site’s content;
- I use a third-party hosting provider that only supplies aggregate passive server logs for a 30-day rolling window, which only shows me the domain name of the Referer, so I can’t know exactly where my users came from.
Re: Sexual abuse tip-off site could be sharing data with Facebook
#19Earlier quoted context omitted.
Something is off here. When PII data is shared with Facebook, it gets hashed before it gets sent. In fact, Facebook warns you if you are “leaking” PII in places like URL parameters that get picked up by their tracking pixel. If they discover pageview events with PII in them, they throw them out. I’m not justifying that hashed data is okay… but clear text data is not received or stored by Facebook via a Facebook Pixel…
If facebook had the clear or hashed data anywhere else you’re still leaking it just with extra steps. Hashes don’t by themselves anonymize. If you have access to the original data it’s trivial to recompute the hash and build your association that way. You could assume the data is salted but that’s not always a safe assumption.
I am not here to defend Meta, only clarify how data is transmitted.
Data is not salted as far as I can tell, it's normalized and hashed via SHA256. They publish SDKs for serverside integrations so you can see how the code is set up.
https://developers.facebook.com/docs/marketing-api/conversio...
Re: Sexual abuse tip-off site could be sharing data with Facebook
#20If you have a website where privacy is absolutely essential, you should NEVER include any third party content. I find it unfathomable someone needs to say that.
Case study: I help run a site that has resources for trans and LGBT people. With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting. - The only JavaScript is that which is necessary to run the site; - The site only lis…
> The only JavaScript is that which is necessary to run the site
No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple.
Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.