11–20 of 77 posts
I'd be interested to see how many competing social networks exhibit the same behavior. Specifically, Twitter and Google+ has similar social buttons. Imagine I wanted to do this but not be get caught. What would you improve? Clearly the cookies will need to look different pre and post logout, but how different?
The company says the data is sent because of the way the “Like” button system is set up; any cookies that are associated with Facebook.com will automatically get sent when you view a “Like” button. They have a point. This is going to be the same for any site that has static content served elsewhere with cookies attached to the domain. Hot link to an image on my blog you commented on? OFFLINE DATA GATHERING ZOMG.
They don't really want to.
Their defence doesn't hold much water. But then, I can't imagine any excuse that would satisfy me. They say “The onus is on us is to take all the data and scrub it,” said Arturo Bejar, a Facebook director of engineering. “What really matters is what we say as a company and back it up.”, except their track record on that matter isn't exactly stellar. We know they don't actually delete messages or things you delete on…
I've never written a web app that actually deletes data.
The argument they use it to prevent "spam and phishing attacks" also seems dubious to me. How does that work? And the cookie that's kept contains just your facebook ID, so wouldn't that be trivial for spammers and phishers to work around?
Actually its an attempt to make life easier on users. When you log in from another machine they sometimes use enhanced measures to confirm your identity. By keeping the cookie they get more confirmation that you are you.
I'm not justifying it. There's ways to prevent this that weren't taken. But I can see what they're trying to do.
The company says the data is sent because of the way the “Like” button system is set up; any cookies that are associated with Facebook.com will automatically get sent when you view a “Like” button. They have a point. This is going to be the same for any site that has static content served elsewhere with cookies attached to the domain. Hot link to an image on my blog you commented on? OFFLINE DATA GATHERING ZOMG.
they dont really have a point, cookies are nailed to a specific domain or sub domain. If they really wanted to they could easily associate the like button with a subdomain of facebook if the user isn't logged in, such that the cookies associated with the user login don't get sent. They don't really want to.
(I work at Facebook, but not on this.)
Bejar said Facebook is looking at ways to avoid sending the data altogether but that it will “take a while.” Maybe I'm naive, but why would turning off the gathering of information take a while? This reminds me of unsubscribing to email newsletters, where the final goodbye says something like "you should stop receiving our emails within 6-8 weeks."
Any code changes take a non-trivial amount of time. It sounds like the solution is to delete more of the cookies on logout, but there may be other Facebook services that use them and need to be transitioned away.
Thats a awfully cautions attitude and smells like a huge cop out for the well known fly-by-the-seat-of-your-pants commit to live strategy that facebook has.
Who else does this? Major banks, forum software, etc. It's a common technique. All that matters is what Facebook actually does with the data, and their privacy policy, just like the Engineer stated.
If you're paranoid, either don't use Facebook or clear your cookies after you log out. Don't you just love simple solutions?
They don't need a cookie in place to receive the IP of whoever loads a page with a Facebook 'like' button on it.
They're a big enough company with smart enough people to develop algorithms that can associate an IP address to a user account to at least a 95% confidence interval. They've got all that stuff you type in your profile and all the things you've shared to aid that, and the more you use your account the better they can predict.
To that end I'd be surprised if they don't continue to track 'deactivated' Facebook accounts. Not in anticipation of you going back to it, of course.
I'd be interested to see how many competing social networks exhibit the same behavior. Specifically, Twitter and Google+ has similar social buttons. Imagine I wanted to do this but not be get caught. What would you improve? Clearly the cookies will need to look different pre and post logout, but how different?
Why do the cookies need to exist? If I log out from your service, why do you need to keep a cookie on my computer?
Bejar said Facebook is looking at ways to avoid sending the data altogether but that it will “take a while.” Maybe I'm naive, but why would turning off the gathering of information take a while? This reminds me of unsubscribing to email newsletters, where the final goodbye says something like "you should stop receiving our emails within 6-8 weeks."
I wonder if that involves something like collecting the data and storing it locally on your computer, then only sending the data once you log into facebook...
Wow, has anyone here ever set multiple cookies? People are blowing this up bigtime. Facebook sets multiple cookies, one for an active user session and another token that serves to authenticate a user has previously logged into facebook, so they don't need to enter extra security questions. Who else does this? Major banks, forum software, etc. It's a common technique. All that matters is what Facebook actually does wi…