Facebook to ask everyone to accept being tracked so they can keep using it • Hacker News Board

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#51

Post by schiffern » Wed, Apr 18, 2018, 7:32 PM UTC

munk-a wrote: post #10

jmngomes wrote: post #6

Earlier quoted context omitted.

Won't ublock [1] solve that by blocking that kind of scripts from loading? [1] https://www.ublock.org/

There are other ways that facebook can track you, ublock does counter a lot of it but there is a constant stream of innovations and work arounds by tracking companies to keep a hold on you. I think the financial motivation for them to keep tracking you outweighs the effort ublock can put into stopping that. The firefox container is a legitimately novel approach to stopping the problem though I'm certain it will be at…

Strange to disparage uBlock Origin while praising Facebook Container, because the latter is weaker than the former.

uBlock Origin with either "Fanboy's Third Party Social" or "Fanboy's Social Blocking List" selected will block all third-party connections to Facebook servers, period. Of course Facebook can still spy on you via other spy companies, but the "EasyPrivacy" list cuts that down a lot too.

On the other hand, Facebook Container still happily connect to Facebook servers from third-party websites, leaking your IP, useragent, the URL of the webpage you're viewing, headers containing fingerprinting information like fonts , etc. Facebook Container does one thing and one thing only: strip off the Facebook cookie. But this is almost worthless from an information theoretic perspective, because Facebook can trivially de-anonymize you through IP/timestamp/header correlation.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#52

Post by julioneander » Wed, Apr 18, 2018, 7:32 PM UTC

jmngomes wrote: post #6

inetsee wrote: post #3

I just added the "Facebook Container" extension to my Firefox browser. I am hoping it will prevent most of Facebook's tracking, but I do know that it probably won't block all the tracking.

Won't ublock [1] solve that by blocking that kind of scripts from loading? [1] https://www.ublock.org/

I recommend Privacy Badger, sponsored by the EFF, which is supposed to block trackers. I prefer it over Ghostery, which is backed by some company.

uBlock Origin is great for blocking Ads though. If you really need to block scripts, there's NoScript.

I recommend using at least the adblocker and the tracker blocker, even if only to reduce memory usage of the browser and take back a couple of CPU cycles from your computer stolen by pesky ads.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#53

Post by freehunter » Wed, Apr 18, 2018, 7:37 PM UTC

downandout wrote: post #44

Silhouette wrote: post #20

Earlier quoted context omitted.

One of the main points of the GDPR is that this sort of treatment is unlikely to be legal any more, to the extent that it ever was. Processing based on consent is now going to require active consent that can't be opted-in by default or hidden away in legal wording no-one ever reads. It's going to be tough to argue that tracking someone who isn't connected to your business/organisation has any of the acceptable bases…

I'm curious what about that notification is "hidden away in legal wording" or doesn't "require active consent". You have to agree with it to make that go away.

At least the way my multi-national employer is interpreting it, under GDPR you can't get away with "click here if you agree with our privacy policy". You have to explicitly say everything that is tracked, everything that is stored, how long, and why it is required for use. If it's not required for use, you can't ask for it and you can't store it unless the person explicitly says yes. If they say no, you have to let them use it anyway, without the tracking and without the storing.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#54

Post by downandout » Wed, Apr 18, 2018, 7:40 PM UTC

Sir_Substance wrote: post #48

downandout wrote: post #46

Earlier quoted context omitted.

I've always dealt with the cookie notifications by using ublock to simply block that element, I never click "ok". I've never had a website actually stop me from using it when I do this until google changed their search page a few weeks ago. I imagine that you simply won't be able to use websites anymore if you are from the EU and don't give consent. You'll just be told to go away.

It's trickier than that for the website owner. EU citizens accessing websites through VPN's are still protected by GDPR.

In that case, you won't have any reason to believe that they are an EU citizen unless and until they indicate otherwise, and there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens. On my sites that don't get alot of EU traffic anyway, I'm simply blocking EU IPs, and on all registration forms, I've removed EU countries from the country selection for residence, and put a notice that says "You may not register for this website if your country is not listed above".

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#55

Post by freehunter » Wed, Apr 18, 2018, 7:41 PM UTC

downandout wrote: post #49

maximente wrote: post #47

Earlier quoted context omitted.

what you've suggested seems OK technically, but i feel like you're making an assumption that originating source of traffic determines citizenship of the user. it could very well be that an EU citizen in Asia or the US is collected upon given your algorithm. if that's the case, are you not in violation of GDPR? but, at the risk of rabbit-holing, your suggestion would be a pretty fundamental change to how the web works…

but, at the risk of rabbit-holing, your suggestion would be a pretty fundamental change to how the web works. in effect, you'd be moving toward a splintered web, where content is basically region locked. I think you're spot on, but that was the danger of implementing heavy-handed legislation like GDPR all along. I believe that EU citizens are going to find themselves locked out of a whole world of content. But that's…

Hmm. I'm not sure about that. If Apple and Google won't pull out of China even though China makes them do all sorts of business stuff they disagree with, I highly doubt they (web companies) would pull out of the entire EU.

It would be absolutely incredible if Facebook et al "took their ball and went home" throwing away 500 million customers.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#56

Post by gaius » Wed, Apr 18, 2018, 7:44 PM UTC

epiapp wrote: post #27

My adblocker detects approximately 44 trackers on that page, including one from connect.facebook.net.

As an aside I was on EdX earlier and even they are using connect.facebook.net too. Absolutely disgusting.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#57

Post by downandout » Wed, Apr 18, 2018, 7:45 PM UTC

freehunter wrote: post #55

downandout wrote: post #49

Earlier quoted context omitted.

but, at the risk of rabbit-holing, your suggestion would be a pretty fundamental change to how the web works. in effect, you'd be moving toward a splintered web, where content is basically region locked. I think you're spot on, but that was the danger of implementing heavy-handed legislation like GDPR all along. I believe that EU citizens are going to find themselves locked out of a whole world of content. But that's…

Hmm. I'm not sure about that. If Apple and Google won't pull out of China even though China makes them do all sorts of business stuff they disagree with, I highly doubt they (web companies) would pull out of the entire EU. It would be absolutely incredible if Facebook et al "took their ball and went home" throwing away 500 million customers .

Of course not, because Apple, Google, Facebook et al have the resources to spend millions on attorneys to implement the GDPR. My comment comes from the perspective of an operator of several small sites that get a total of a few million visitors per month combined. I'm not spending millions on attorneys, and EU traffic is only incidental to my sites anyway, so I am indeed taking my ball and going home.

This will make a difference for some users on some of the forums I run, as they will be banned with an apology and an invitation to come back if they ever move out of the EU. But it's not worth taking on the liability of potentially millions of dollars in fines for accidental non-compliance with a heavy handed, massively complex law that is up for different interpretations in the courts of no less than 28 unique countries. Unless you're in the EU or are a multi-billion dollar company with a large legal department, accepting EU traffic post-GDPR is an act of insanity.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#58

Post by jlgaddis » Wed, Apr 18, 2018, 7:52 PM UTC

SmellyGeekBoy wrote: post #18

Guest9812398 wrote: post #15

Earlier quoted context omitted.

Why can't we simply choose relevant ad categories that we would prefer to see? Why do the options need to be (i) see random advertisements that are likely irrelevant, or (ii) allow us to track your every move, including your location, each site you visit with the Facebook widget, your message and call history, and your every click. Or non-Facebook related, why can't my smart TV just let me choose PC Gaming, Technolog…

Why can't ads be relevant to the content of the page like they used to be in the good old days? As an example of stupid targeted ads: I bought a Casper mattress a couple of months ago and pretty much every single ad I've seen since then (on devices where I don't have them blocked) has been for mattresses. How many mattresses does the internet think I need? If I'm reading about something on the internet it's generally…

A little over two years ago, I Googled the name of a local Dodge/RAM dealership (on my iPad, thus no ad blocker) so I could browse their selection online before I ventured over there. That afternoon, I bought a new truck (from that dealership).

For almost A YEAR afterwards, I would constantly see ads about RAM trucks and various dealerships in my area (including the one I Googled and bought the truck from) when browsing the web on my iPad. Not every ad, of course, but certainly often enough that I would notice it a couple times a week and just laugh and shake my head at the dealerships who were just throwing their ad dollars away.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#59

Post by x0x0 » Wed, Apr 18, 2018, 7:53 PM UTC

maximente wrote: post #37

downandout wrote: post #14

Earlier quoted context omitted.

You can already see it on many sites. They're basically just a more forceful version of cookie notifications with language about third party tracking thrown in that force you to say "OK" or tell you to leave. Here's an example: http://prntscr.com/j67usw FB, as with all third party trackers, isn't the one actually responsible for notifying you about the use of their pixels etc. on third party sites. The site operator…

this is fundamentally insufficient, though. if there's a hosted image from a facebook domain (e.g. a like button), unless that image is loaded after consent is given, facebook can already associate that users' IP address with having visited that web site by nature of sending the image over. in other words, facebook is tracking pre-consent (unless those images are loaded post-hoc, which is just not happening in today'…

It doesn't matter if you load an image off fb.

per GDPR, without consent, fb cannot legally use that data (for EU residents).

And you don't need to trust that; fb knows they're going to be spending some quality time in front of their privacy regulator.

Re: Facebook to ask everyone to accept being tracked so they can keep using it

#60

Post by Sir_Substance » Wed, Apr 18, 2018, 7:56 PM UTC

downandout wrote: post #54

Sir_Substance wrote: post #48

Earlier quoted context omitted.

It's trickier than that for the website owner. EU citizens accessing websites through VPN's are still protected by GDPR.

In that case, you won't have any reason to believe that they are an EU citizen unless and until they indicate otherwise, and there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens. On my sites that don't get alot of EU traffic anyway, I'm simply blocking EU IPs, and on all registration forms, I've removed EU countries from the country se…

>there are provisions within the GDPR for it not to apply in those cases where you are not intentionally obtaining data from EU citizens.

I read the entire document a few weeks back and recall no such provisions. Could you cite one for me? I'm trying to be as informed on this as possible.

Article 3, "Territorial scope", lays out where GDPR applies, and it contains no derogations for "but I didn't know they were european, honest". It is not, in fact, specifically about european citizens. It covers the processing of data for "natural persons in the Union", which is a bit unclear to me but I interpret it as covering anyone physically located in a country that forms a Supervisory Authority under section 51.

How this will ultimately interact with your websites and/or businesses if you are not based in the EU is unclear at this time.