Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sexual abuse tip-off site could be sharing data with Facebook

sverigesradio.se

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Sexual abuse tip-off site could be sharing data with Facebook

#21

Post by gcr »

austinpena wrote: post #19
throwaway173738 wrote: post #16

Earlier quoted context omitted.

If facebook had the clear or hashed data anywhere else you’re still leaking it just with extra steps. Hashes don’t by themselves anonymize. If you have access to the original data it’s trivial to recompute the hash and build your association that way. You could assume the data is salted but that’s not always a safe assumption.

I am not here to defend Meta, only clarify how data is transmitted. Data is not salted as far as I can tell, it's normalized and hashed via SHA256. They publish SDKs for serverside integrations so you can see how the code is set up. https://developers.facebook.com/docs/marketing-api/conversio...

Facebook knows the nine billion most common human names.

On my Mac, sha256() takes 288ns, so running nine billion of them to find the collision would take about 43 CPU-minutes.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#22

Post by mschuster91 »

Ekaros wrote: post #17
mschuster91 wrote: post #4

Earlier quoted context omitted.

They probably embedded tracking pixels because PR teams wanted to have data on how many people viewed the page vs how many people actually filed a report.

Why do I get feeling time and time again that developers pick the easy solutions. Not the sensible ones. Some type of page download counter should not be impossible, and number of reports should also be easy metric. Why do they even think they need to get someone like Facebook involved...

In almost all organizations outside of IT, IT is at the bottom of the social ladder. They gotta do what management wants.

And that won't change until enough large organizations get hit hard by fines that everyone else follows suit and hires actually capable CTOs with veto power over everyone else.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#23

Post by chimeracoder »

gcr wrote: post #18
rbanffy wrote: post #14

If you have a website where privacy is absolutely essential, you should NEVER include any third party content. I find it unfathomable someone needs to say that.

Case study: I help run a site that has resources for trans and LGBT people. With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting. - The only JavaScript is that which is necessary to run the site; - The site only lis…

Do you have a link to this website?

Re: Sexual abuse tip-off site could be sharing data with Facebook

#24

Post by throwaway50603 »

aboringusername wrote: post #20
gcr wrote: post #18

Earlier quoted context omitted.

Case study: I help run a site that has resources for trans and LGBT people. With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting. - The only JavaScript is that which is necessary to run the site; - The site only lis…

> The only JavaScript is that which is necessary to run the site No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple. Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.

You have no idea what site is it. Perhaps it's an interactive game or a questionnaire. POSTing that data to a server is much worse than running some clientside code. Your post is not productive at all.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#25

Post by mkmk »

gcr wrote: post #21
austinpena wrote: post #19

Earlier quoted context omitted.

I am not here to defend Meta, only clarify how data is transmitted. Data is not salted as far as I can tell, it's normalized and hashed via SHA256. They publish SDKs for serverside integrations so you can see how the code is set up. https://developers.facebook.com/docs/marketing-api/conversio...

Facebook knows the nine billion most common human names. On my Mac, sha256() takes 288ns, so running nine billion of them to find the collision would take about 43 CPU-minutes.

The whole point of sending the hash to FB is so that they can look it up against the hashes of people to whom they have served an ad.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#26

Post by eat_veggies »

aboringusername wrote: post #20
gcr wrote: post #18

Earlier quoted context omitted.

Case study: I help run a site that has resources for trans and LGBT people. With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting. - The only JavaScript is that which is necessary to run the site; - The site only lis…

> The only JavaScript is that which is necessary to run the site No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple. Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.

If it's something like a resource locator or questionnaire, then doing the processing locally in JS is in fact better for privacy than sending personal data over the network. It's nice when websites work without JS but you are a deeply unserious engineer if you think that there are no tradeoffs involved.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#27

Post by npteljes »

aboringusername wrote: post #20
gcr wrote: post #18

Earlier quoted context omitted.

Case study: I help run a site that has resources for trans and LGBT people. With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting. - The only JavaScript is that which is necessary to run the site; - The site only lis…

> The only JavaScript is that which is necessary to run the site No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple. Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.

They don't say that they run JS to run the site - they say that JS runs only to run the site. As in, they promise to use JS to only run the site.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#28

Post by birdyrooster »

eat_veggies wrote: post #26
aboringusername wrote: post #20

Earlier quoted context omitted.

> The only JavaScript is that which is necessary to run the site No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple. Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.

If it's something like a resource locator or questionnaire, then doing the processing locally in JS is in fact better for privacy than sending personal data over the network. It's nice when websites work without JS but you are a deeply unserious engineer if you think that there are no tradeoffs involved.

Asceticism isn’t supposed to necessarily make sense to those outside the bubble.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#29

Post by CoastalCoder »

titzer wrote: post #11
Tepix wrote: post #7

[flagged]

All those pitiful ignoramuses, who have no idea how to walk three times around the block to avoid the Staasi - they need to be protected from the secret police, pshaw!

I can't figure out how you intend this comment to be understood.

It seems like you're insulting the victims, but you're also proposing a very reasonable (IMHO) law.

Re: Sexual abuse tip-off site could be sharing data with Facebook

#30

Post by suddenclarity »

They (Swedish Radio) have done a few stories on Facebook pixel during the last year.

A year ago it was the state-owned pharmacy Apoteket that leaked customer information and their orders to Facebook. Once it was revealed that multiple pharmacies did it, an investigation into three of them was started. Last month SR extended their search and found 100 pharmacies in Europe doing the same thing. Leaking information to Facebook.

I'm sure this is a really common issue because it's so convenient and useful when doing the marketing and analysis. People don't think about the consequences or the fact that it's against the rules of Facebook.

Post reply on HN