Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Defends Getting Data From Logged-Out Users

blogs.wsj.com

Post reply on HN
Print view View original

61–70 of 77 posts

Re: Facebook Defends Getting Data From Logged-Out Users

#61

Post by yason »

lpolovets wrote: post #3

Bejar said Facebook is looking at ways to avoid sending the data altogether but that it will “take a while.” Maybe I'm naive, but why would turning off the gathering of information take a while? This reminds me of unsubscribing to email newsletters, where the final goodbye says something like "you should stop receiving our emails within 6-8 weeks."

Well, he didn't say not only turning it off would take while. He said looking at ways to do it would take while. Speaking in such weaselese I'm not entirely positive they would ever get close to the actual turning off phase.

Re: Facebook Defends Getting Data From Logged-Out Users

#62

Post by [deleted] »

0x12 wrote: post #60
mnutt wrote: post #42

Earlier quoted context omitted.

I don't work there, but where I work we deploy 10-20 times a day and if somebody asked me to change the way we store data in cookies, it would probably take a bit of time to roll out. I'm only defending them because it annoys me when people who aren't familiar with the software internals tell me "this is a minor change, it should take you less than an hour".

To be fair though, not doing something is a lot easier to implement than to add new functionality. As a minimal implementation they could err on the safe side and stop tracking everybody for a bit until they've corrected their error.

[deleted]

Re: Facebook Defends Getting Data From Logged-Out Users

#63

Post by lbrandy »

cpeterso wrote: post #59
pork wrote: post #32

Earlier quoted context omitted.

Whatever you've read, Facebook likely has a non-trivial push strategy, just like everyone else. Nobody at their HQ is committing directly to the live site.

Facebook's Release Engineering blog says a code change can go from commit to live in less than 60 minutes. Admittedly, they don't say how often they deploy. https://www.facebook.com/note.php?note_id=59150988919

Code changes are easy at facebook. Messing with domains/cookies/security/static-resources/etc is more than a code change.

Re: Facebook Defends Getting Data From Logged-Out Users

#64

Post by wnight »

rwolf wrote: post #23
elehack wrote: post #10

Earlier quoted context omitted.

I would remain suspicious if there was any identifying or unique information in cookies after logout. Ideally, logout should delete all cookies.

I already pointed out that HN leaves a cookie behind in another comment, so here's a different tack: is there a site on the first page of http://www.alexa.com/topsites that actually leaves no cookies behind when you logout? A major faux pas like leaving your uid in the clear in the cookie after logout certainly seems to bother us, but I don't think users (even savvy users) care about leaving some cookies behind. For…

> I don't think users (even savvy users) care about leaving some cookies behind.

In most contexts, that is true. A Slashdot cookie is just a line in a text file until you visit Slashdot. But a Facebook cookie is sent home every time you visit a page with any FB spam on it.

The mysql.com malware is trivial. Hitting Facebook would get most everyone, users and not.

Re: Facebook Defends Getting Data From Logged-Out Users

#66

Post by GeneralMaximus »

CGamesPlay wrote: post #46
fl3tch wrote: post #28

Earlier quoted context omitted.

What if you delete your account entirely? Do they delete your data then?

Facebook does delete all data associated with an account after it is deleted. An account is deleted after you indicate that you want to delete it (via a form in your account settings), and 2 weeks passes without you trying to reactivate the account (by logging into it). And yes, I do mean the permanent, irreversible kind of deleting. (I work at Facebook.)

I'd like to believe you. I really would, but I'm sorry to say that I can't.

About an year ago I deleted my Facebook account permanently. I even got a confirmation email after 14 days telling me I had deleted it. However, three or four months later I was forced to sign up for an account again[1]. After I logged in, Facebook showed me a list of "suggested friends". Note that I had zero friends at this point. Guess what, every single person I had added as a friend in my previous account was in that suggested friends list. How is that possible if Facebook is not retaining information about me? You guys are obviously associating something with my name and email address. That, or you're telepathic.

So no, I don't believe you. I don't believe Facebook deletes any information at all.

---

[1] The info for every event I wanted to attend was on FB. Classmates talked about college and swapped notes on FB. People planned meetups and reunions on FB. It's scary how much happens on FB instead of face-to-face/phone/email now.

Re: Facebook Defends Getting Data From Logged-Out Users

#67

Post by danparsonson »

polemic wrote: post #5

The company says the data is sent because of the way the “Like” button system is set up; any cookies that are associated with Facebook.com will automatically get sent when you view a “Like” button. They have a point. This is going to be the same for any site that has static content served elsewhere with cookies attached to the domain. Hot link to an image on my blog you commented on? OFFLINE DATA GATHERING ZOMG.

If they deleted the relevant cookies on logout then the problem would go away - I believe that's the crux of the issue, certainly for me anyway. Besides which, your hot-linking analogy, while technically correct, falls down when you consider just how many sites have a 'Like' button on them, compared with how many sites are hot-linking you - and more importantly how many visitors those sites get. It's hardly an equivalent scenario.

Re: Facebook Defends Getting Data From Logged-Out Users

#68

Post by revorad »

GeneralMaximus wrote: post #66
CGamesPlay wrote: post #46

Earlier quoted context omitted.

Facebook does delete all data associated with an account after it is deleted. An account is deleted after you indicate that you want to delete it (via a form in your account settings), and 2 weeks passes without you trying to reactivate the account (by logging into it). And yes, I do mean the permanent, irreversible kind of deleting. (I work at Facebook.)

I'd like to believe you. I really would, but I'm sorry to say that I can't. About an year ago I deleted my Facebook account permanently. I even got a confirmation email after 14 days telling me I had deleted it. However, three or four months later I was forced to sign up for an account again[1]. After I logged in, Facebook showed me a list of "suggested friends". Note that I had zero friends at this point. Guess what…

I've had similar experiences as well. I don't believe a word of Facebook's stated policies. Their employees defending them here is even more laughable. We've sold our souls to the devil. How did we ever get in this mess?

Re: Facebook Defends Getting Data From Logged-Out Users

#69

Post by djeikyb »

GeneralMaximus wrote: post #66
CGamesPlay wrote: post #46

Earlier quoted context omitted.

Facebook does delete all data associated with an account after it is deleted. An account is deleted after you indicate that you want to delete it (via a form in your account settings), and 2 weeks passes without you trying to reactivate the account (by logging into it). And yes, I do mean the permanent, irreversible kind of deleting. (I work at Facebook.)

I'd like to believe you. I really would, but I'm sorry to say that I can't. About an year ago I deleted my Facebook account permanently. I even got a confirmation email after 14 days telling me I had deleted it. However, three or four months later I was forced to sign up for an account again[1]. After I logged in, Facebook showed me a list of "suggested friends". Note that I had zero friends at this point. Guess what…

Facebook could have stored your email address as part of your friend's account, eg "an email address this person is friendly with". Your account, posts and friends and all, are gone, but you leave traces of yourself with your friends. These traces could be reconstructed.

Re: Facebook Defends Getting Data From Logged-Out Users

#70

Post by revorad »

mnutt wrote: post #8
lpolovets wrote: post #3

Bejar said Facebook is looking at ways to avoid sending the data altogether but that it will “take a while.” Maybe I'm naive, but why would turning off the gathering of information take a while? This reminds me of unsubscribing to email newsletters, where the final goodbye says something like "you should stop receiving our emails within 6-8 weeks."

Any code changes take a non-trivial amount of time. It sounds like the solution is to delete more of the cookies on logout, but there may be other Facebook services that use them and need to be transitioned away.

Clearly, "Move fast and break things" doesn't apply when it benefits anyone other than the corporation.
Post reply on HN