How about if browsers implemented this cookie system: Each time a cookie is set, you could have the ability to mandate when that cookie is sent out. For example with a Facebook cookie you could tell the browser to only send that cookie when your address bar reads facebook.com. Problem solved?
Facebook Defends Getting Data From Logged-Out Users
21–30 of 77 posts
Re: Facebook Defends Getting Data From Logged-Out Users
#22Earlier quoted context omitted.
they dont really have a point, cookies are nailed to a specific domain or sub domain. If they really wanted to they could easily associate the like button with a subdomain of facebook if the user isn't logged in, such that the cookies associated with the user login don't get sent. They don't really want to.
How would whatever system that does this discover that the user is or is not logged into Facebook? The javascript portion doesn't have access to cross-domain cookies, so that won't work. Anything else requires connecting to a domain such that cookies are passed on so that it could discover whether the user is logged in or out before passing it to a subdomain. (I work at Facebook, but not on this.)
hmm? without pretty specific knowledge of the problem set facebook is trying to solve with its current set of code I am clearly unable to offer a solution that will resolve them all.
However, if one of the problems that they wanted to solve was 'we dont want to track user data unless they are logged in', they would have solved it by now.
The fact that they haven't means either (a) they just haven't thought about it or (b) they have thought about it, but do not want to solve it.
Re: Facebook Defends Getting Data From Logged-Out Users
#23I'd be interested to see how many competing social networks exhibit the same behavior. Specifically, Twitter and Google+ has similar social buttons. Imagine I wanted to do this but not be get caught. What would you improve? Clearly the cookies will need to look different pre and post logout, but how different?
I would remain suspicious if there was any identifying or unique information in cookies after logout. Ideally, logout should delete all cookies.
I already pointed out that HN leaves a cookie behind in another comment, so here's a different tack: is there a site on the first page of http://www.alexa.com/topsites that actually leaves no cookies behind when you logout?
A major faux pas like leaving your uid in the clear in the cookie after logout certainly seems to bother us, but I don't think users (even savvy users) care about leaving some cookies behind. For the record, I've installed various opt-out browser extensions in the past (only to switch computers/browsers and forget to bring them along)--I don't think my views are pro-cookie or even moderate.
Re: Facebook Defends Getting Data From Logged-Out Users
#24Earlier quoted context omitted.
I wonder if that involves something like collecting the data and storing it locally on your computer, then only sending the data once you log into facebook...
Not how cookies work. Visit any page with loads the facebook like widget iframe/img/script -> make a request to facebook with your cookie.
I was thinking more along the lines of a local store, but then you'd need a little script embedded into every page to handle the storage.
Essentially, instead of FB like widget -> request to facebook I would think FB like widget -> add to local datastore.
Then FB could do an optimised/aggragated query on the local database. The only thing would be that it would introduce large latency in the resulting data if its sent back only on FB login.
Re: Facebook Defends Getting Data From Logged-Out Users
#25Their defence doesn't hold much water. But then, I can't imagine any excuse that would satisfy me. They say “The onus is on us is to take all the data and scrub it,” said Arturo Bejar, a Facebook director of engineering. “What really matters is what we say as a company and back it up.”, except their track record on that matter isn't exactly stellar. We know they don't actually delete messages or things you delete on…
We know they don't actually delete messages or things you delete on FB, they just mark them "deleted". With that attitude to "deleting" things, what does it even matter? I've never written a web app that actually deletes data. The argument they use it to prevent "spam and phishing attacks" also seems dubious to me. How does that work? And the cookie that's kept contains just your facebook ID, so wouldn't that be triv…
I've never written a web app that actually deletes data.
Sure, but that's just a business decision, right?
Re: Facebook Defends Getting Data From Logged-Out Users
#26This is a great example of the inherent conflict of interest when your users are not your customers, in fact they're your product.
http://johnstanderfer.com/2011/09/26/facebooks-most-importan...
Re: Facebook Defends Getting Data From Logged-Out Users
#27Earlier quoted context omitted.
How would whatever system that does this discover that the user is or is not logged into Facebook? The javascript portion doesn't have access to cross-domain cookies, so that won't work. Anything else requires connecting to a domain such that cookies are passed on so that it could discover whether the user is logged in or out before passing it to a subdomain. (I work at Facebook, but not on this.)
hmm? without pretty specific knowledge of the problem set facebook is trying to solve with its current set of code I am clearly unable to offer a solution that will resolve them all. However, if one of the problems that they wanted to solve was 'we dont want to track user data unless they are logged in', they would have solved it by now. The fact that they haven't means either (a) they just haven't thought about it o…
The purpose of the social plugins is to provide social context - telling you which of your friends has liked something, or that you are the first.
To do this, it needs to know who you are if you are a Facebook user that has not logged out. To do that, it needs to check the cookie that the Facebook web site sets when you are logged in.
Unfortunately, the web as it stands doesn't allow this interaction without divulging some information (time/date, browser, IP address, &c.) when the only interesting thing is who you are if you happen to be logged in.
This is the same problem that web analytics, certain comment systems, other social buttons, and other embedded functionality systems face.
About the best that can be done is explain what happens with that data when it is received - and that is explained at https://www.facebook.com/help/?faq=186325668085084
Re: Facebook Defends Getting Data From Logged-Out Users
#28Their defence doesn't hold much water. But then, I can't imagine any excuse that would satisfy me. They say “The onus is on us is to take all the data and scrub it,” said Arturo Bejar, a Facebook director of engineering. “What really matters is what we say as a company and back it up.”, except their track record on that matter isn't exactly stellar. We know they don't actually delete messages or things you delete on…
What if you delete your account entirely? Do they delete your data then?
Re: Facebook Defends Getting Data From Logged-Out Users
#29Earlier quoted context omitted.
We know they don't actually delete messages or things you delete on FB, they just mark them "deleted". With that attitude to "deleting" things, what does it even matter? I've never written a web app that actually deletes data. The argument they use it to prevent "spam and phishing attacks" also seems dubious to me. How does that work? And the cookie that's kept contains just your facebook ID, so wouldn't that be triv…
I've never written a web app that actually deletes data. Sure, but that's just a business decision, right?
It's often a performance, scalability, and safety decision as well. The optimal way for a web app to truly delete data is during an asynchronous garbage collection process. It's a lot easier to just mark the object as deleted.
Re: Facebook Defends Getting Data From Logged-Out Users
#30The company says the data is sent because of the way the “Like” button system is set up; any cookies that are associated with Facebook.com will automatically get sent when you view a “Like” button. They have a point. This is going to be the same for any site that has static content served elsewhere with cookies attached to the domain. Hot link to an image on my blog you commented on? OFFLINE DATA GATHERING ZOMG.
Hotlink an image? That's now how the Like button works. It's more like linking to an IFRAME with its own javascript. Slight diff.