Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Defends Getting Data From Logged-Out Users

blogs.wsj.com

Post reply on HN
Print view View original

51–60 of 77 posts

Re: Facebook Defends Getting Data From Logged-Out Users

#51

Post by tedunangst »

pyrmont wrote: post #11
rwolf wrote: post #2

I'd be interested to see how many competing social networks exhibit the same behavior. Specifically, Twitter and Google+ has similar social buttons. Imagine I wanted to do this but not be get caught. What would you improve? Clearly the cookies will need to look different pre and post logout, but how different?

Why do the cookies need to exist? If I log out from your service, why do you need to keep a cookie on my computer?

As stated in the article, so when you login again from the same computer, they don't have to do the whole two factor "I've never seen this computer before" text message handshake with you.

Re: Facebook Defends Getting Data From Logged-Out Users

#52

Post by pilif »

rhizome wrote: post #25
mikeryan wrote: post #13

Earlier quoted context omitted.

We know they don't actually delete messages or things you delete on FB, they just mark them "deleted". With that attitude to "deleting" things, what does it even matter? I've never written a web app that actually deletes data. The argument they use it to prevent "spam and phishing attacks" also seems dubious to me. How does that work? And the cookie that's kept contains just your facebook ID, so wouldn't that be triv…

I've never written a web app that actually deletes data. Sure, but that's just a business decision, right?

The big webapp I'm working on moved from deleting data to adding delete flags over the 7 years of its existence. There are two reasons for this, none of it involves tracking users.

For one, a lot of the data is synchronized to offline applications.

If you just delete the data on the server, it's gone and it becomes impossible to tell clients that they have to remove their copy. In this case, I could keep a second list of deleted items around and synch only that of course, but that would mean additional work and it wouldn't help for the other case:

Many times, end users wanted us to restore some data for them that they accidentally deleted. Back in the days that meant restoring the backup, and merging the backup with the current live data. A risky, complicated and thus expensive process.

Nowadays, I just set the delete flag to false and the problem is solved.

On the other hand, the data we are dealing with isn't nearly as sensitive as Facebooks and it's never shared between users.

Re: Facebook Defends Getting Data From Logged-Out Users

#53

Post by altrego99 »

rationalbeats wrote: post #47
CGamesPlay wrote: post #46

Earlier quoted context omitted.

Facebook does delete all data associated with an account after it is deleted. An account is deleted after you indicate that you want to delete it (via a form in your account settings), and 2 weeks passes without you trying to reactivate the account (by logging into it). And yes, I do mean the permanent, irreversible kind of deleting. (I work at Facebook.)

I honestly don't believe that. (How could you or Facebook prove that?) I deleted my account a few months ago. However I have no way of verifying if all that data is gone for good, overwritten with some new persons data to sell to marketers. But the reason I deleted my Facebook account is because I just don't trust Facebook.

One way to 'prove' that would be if Facebook can support such claims in legal documents or terms and conditions. Well technically it's not really a proof, but I will accept it.

Re: Facebook Defends Getting Data From Logged-Out Users

#55

Post by bandushrew »

nbm wrote: post #27
bandushrew wrote: post #22

Earlier quoted context omitted.

hmm? without pretty specific knowledge of the problem set facebook is trying to solve with its current set of code I am clearly unable to offer a solution that will resolve them all. However, if one of the problems that they wanted to solve was 'we dont want to track user data unless they are logged in', they would have solved it by now. The fact that they haven't means either (a) they just haven't thought about it o…

The purpose of the social plugins is to provide social context - telling you which of your friends has liked something, or that you are the first. To do this, it needs to know who you are if you are a Facebook user that has not logged out. To do that, it needs to check the cookie that the Facebook web site sets when you are logged in. Unfortunately, the web as it stands doesn't allow this interaction without divulgin…

Dude, if I am a facebook user who has not logged out, they can send cookies as much as they like.

The browser manages this - if they are logged in, set a cookie that will be sent to the hypothetical 'like' subdomain of facebook, if they are logged out, remove the cookie.

This kind of functionality is really not rocket science, there are dozens of ways to implement it and I feel kind of stupid talking about it.

There are reasons for facebook not doing this, but they are not technical ones.

Re: Facebook Defends Getting Data From Logged-Out Users

#56

Post by alastairpat »

DougWebb wrote: post #50
alastairpat wrote: post #48

Earlier quoted context omitted.

Tracking by IP is a ridiculous idea. My mobile phone provider uses transparent proxying for its mobile Internet - I must share the same external IP as thousands of other people when I browse the web via my phone. Not to mention that households using NAT will have three plus accounts from the one IP, let alone businesses with hundreds. Internet-facing IP simply isn't unique enough for these purposes.

My inclination is to agree with you; the IP is hardly a unique identifier. But they don't need perfection. Think about it: most people, most of the time, will send requests to FB from just a few IPs and maybe one ISP proxy network (which FB can recognize as a proxy.) They know that your account is associated with these IPs based on tracking cookies. So, when they see a request from one of these IPs without the cookie…

It's an interesting idea in theory, but I honestly think that the number of people who care enough about privacy to want to log out (or otherwise stop the cookies from being sent to Facebook) would be so low that it wouldn't be cost-effective. My guess is that it would probably be confined to HN's demographic.

The sort of zeroing-in on individuals based on traits/information, however, does kind of remind me of this: http://adage.com/article/digitalnext/target-a-facebook-ad-a-... - not really relevant, but still kind of cool.

Re: Facebook Defends Getting Data From Logged-Out Users

#57

Post by cpeterso »

FuzzyDunlop wrote: post #17

The cookies are somewhat a red-herring when you consider how insignificant they are compared to other methods of tracking. They don't need a cookie in place to receive the IP of whoever loads a page with a Facebook 'like' button on it. They're a big enough company with smart enough people to develop algorithms that can associate an IP address to a user account to at least a 95% confidence interval. They've got all th…

Beyond IP tracking, the EFF's Panopticlick website demonstrates how much uniquely identifying is exposed from a browser's User-Agent and system configuration values accessible from JavaScript and Flash (such as screen size, locale, and installed fonts). For example, my browser's fingerprint is unique among the 1.7M browsers the EFF has tested to date.

https://panopticlick.eff.org/index.php?action=log&js=yes

Re: Facebook Defends Getting Data From Logged-Out Users

#59

Post by cpeterso »

pork wrote: post #32
cbs wrote: post #15

Earlier quoted context omitted.

>Any code changes take a non-trivial amount of time Thats a awfully cautions attitude and smells like a huge cop out for the well known fly-by-the-seat-of-your-pants commit to live strategy that facebook has.

Whatever you've read, Facebook likely has a non-trivial push strategy, just like everyone else. Nobody at their HQ is committing directly to the live site.

Facebook's Release Engineering blog says a code change can go from commit to live in less than 60 minutes. Admittedly, they don't say how often they deploy.

https://www.facebook.com/note.php?note_id=59150988919

Re: Facebook Defends Getting Data From Logged-Out Users

#60

Post by 0x12 »

mnutt wrote: post #42
cbs wrote: post #15

Earlier quoted context omitted.

>Any code changes take a non-trivial amount of time Thats a awfully cautions attitude and smells like a huge cop out for the well known fly-by-the-seat-of-your-pants commit to live strategy that facebook has.

I don't work there, but where I work we deploy 10-20 times a day and if somebody asked me to change the way we store data in cookies, it would probably take a bit of time to roll out. I'm only defending them because it annoys me when people who aren't familiar with the software internals tell me "this is a minor change, it should take you less than an hour".

To be fair though, not doing something is a lot easier to implement than to add new functionality. As a minimal implementation they could err on the safe side and stop tracking everybody for a bit until they've corrected their error.
Post reply on HN