Live data from Hacker News

Facebooks crawls every page recorded by its tracking pixel

news.ycombinator.com

41–50 of 75 posts

Re: Facebooks crawls every page recorded by its tracking pixel

#41
post #13
post #3

Shocking! Abuse of power and shady tracking techniques by Facebook? Unheard of! Seriously, this cannot be surprising after learning that the Messenger app listens to everything you do, all the time. That's just off the top of my head. They are doing this and much more.

I've heard a lot of anecdotal reports of the messenger app listening to what you do. So much so that I've uninstalled the app. However, I've never seen a non-anecdotal source or even a source that gathers all anecdotes and gives a decent meta-analysis. Would you happen to have one?

The reply all podcast did a decent discussion of the topic.

The messenger app probably doesn’t listen to you, but it’s abusive in other ways and shouldn’t be uninstalled. The main creepy feature of Facebook apps is that they continuously track your location. That’s a source of much of the creepy targeting that people notice.

Also, Facebook’s weasel-worded response to the issue implies that they do not use pervasive audio targeting, but buy data from people who do. The Wired article that claimed that using audio was impractical is nonsense.

Re: Facebooks crawls every page recorded by its tracking pixel

#42

It is the fucking internet, if you put something on there you should expect someone to find it, be it a crawler or an attacker. > 1. they are crawling potentially sensitive information granted by links with tokens If tokens in GET params are your security concept: please leave the entire field. 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links So you built somethin…

Everything you said was technically correct yet the message will probably be lost due to the manner in which you decided to delivered it.

Re: Facebooks crawls every page recorded by its tracking pixel

#43
post #3

Shocking! Abuse of power and shady tracking techniques by Facebook? Unheard of! Seriously, this cannot be surprising after learning that the Messenger app listens to everything you do, all the time. That's just off the top of my head. They are doing this and much more.

How is this instance an abuse of power or shady?

I would be surprised if service wouldn't index my site after I put one of their pixels on my site.

Re: Facebooks crawls every page recorded by its tracking pixel

#44

It is the fucking internet, if you put something on there you should expect someone to find it, be it a crawler or an attacker. > 1. they are crawling potentially sensitive information granted by links with tokens If tokens in GET params are your security concept: please leave the entire field. 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links So you built somethin…

Stuff like this currently exists in the real world. Therefore, I can understand the complains of the OP.

Re: Facebooks crawls every page recorded by its tracking pixel

#45
post #32
post #9

This is borderline criminal. Practically CSRF attack.

This sounds a little extreme at first, but I actually totally agree. It's in murky waters when it comes to GDPR, for starters. Where do they draw the line? Why not run a keylogger through embedded like buttons and widgets? That sounds worse, but isn't all that much worse.

> It's in murky waters when it comes to GDPR, for starters.

I'm not sure about from facebook's side, but from the point of view of how GDPR applies to the side being crawled if they, as custodians of PII and other sensitive data, are handing it out to unauthenticated requests, they might be liable for punishment for lack of due diligence.

Re: Facebooks crawls every page recorded by its tracking pixel

#46

It is the fucking internet, if you put something on there you should expect someone to find it, be it a crawler or an attacker. > 1. they are crawling potentially sensitive information granted by links with tokens If tokens in GET params are your security concept: please leave the entire field. 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links So you built somethin…

You're correct, but there's no need to be a dick about it

Re: Facebooks crawls every page recorded by its tracking pixel

#47

It is the fucking internet, if you put something on there you should expect someone to find it, be it a crawler or an attacker. > 1. they are crawling potentially sensitive information granted by links with tokens If tokens in GET params are your security concept: please leave the entire field. 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links So you built somethin…

Everything you said was technically correct yet the message will probably be lost due to the manner in which you decided to delivered it.

Yes, we need more PC culture. Sugar coat even if at the cost of clarity / accuracy.

Re: Facebooks crawls every page recorded by its tracking pixel

#48

It is the fucking internet, if you put something on there you should expect someone to find it, be it a crawler or an attacker. > 1. they are crawling potentially sensitive information granted by links with tokens If tokens in GET params are your security concept: please leave the entire field. 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links So you built somethin…

While I certainly don't disagree with what you said. I think you need to look at his arguments as a way to protect user data. Not all users that use your "mediocre" technical solution are aware of how "mediocre" it is. And if tokens are sent with GET requests or whatever stupid thing.

Re: Facebooks crawls every page recorded by its tracking pixel

#50
post #12

I don't mind Facebook crawling pages as long as it respects robots.txt, but for the last few weeks we've been hammered by requests from Facebook-owned IP addresses (millions of hits daily, 50+ for the same URL at times). They don't even set the User-Agent header. There's a bug report regarding the missing header here: https://developers.facebook.com/bugs/1654459311255613/ Unfortunately it seems impossible to get in t…

what site do you own (if you can tell)?
Post reply on HN