Hacker News Reader

Comment by microtonal | Hacker News Reader

I am happy that things are finally moving in the right direction. A person stalks you and they (rightfully) get punished. {Google, Facebook, ad networks} stalk you across the net, recording information about your interests, your fears, and your secrets, without permission. And they get away with a free pass. In fact, we celebrate them as startup success stories and want to work for them.

We should at least have a choice on whether they can track us or not. And when we say 'no thank you', that should be respected.

View on HN

I agree with you, and saying "no thank you" should not even be necessary. Continuing your example, should stalkers be allowed to stalk you up until the point where you deliberately request that they don't?

Your analogy fails because for most people facebook is not a "stranger" as they already have an account with them. In the case of acquaintances there is more of an onus to inform them if you wish to minimize your contact.

Facebook tracks you even without an account.

So if I buy a watch from someone on Craigslist, he's no longer a "stranger" and the onus is now on me to explicitly inform him to not follow me around? Doing business with someone or some business should not imply consent to their monitoring you.

You describe a one-off transaction in which no expectation of future contact is anticipated. Facebook is an account with an on going relationship. Its the difference between seeing someone multiple times and saying hello to a stranger on the train.

I'm not saying they don't take it too far, but certainly someone with an account has invited facebook to do some data collection and tracking.

Facebook also spies on people who have never used the service.

It's one thing to track me on facebook.com where I signed up, another to track me on blogs, newspapers and everywhere else.

Fine, so instead of Craigslist Guy, let's use Home Depot, where I shop often. Just shopping there does not imply my consent to them tracking where else I go and shop throughout my day. Merely having an account somewhere or regularly doing business somewhere should not imply consent to tracking and data collection, to which I must opt out.

ADD: I probably have 100+ accounts at various sites online. Do these guys all get free passes to collect data and track me because I happen to have created an account there?

If you opened a credit account with Home Depot or had their loyalty card you'd be literally consenting to more tracking. That's the difference between an account and a one off transaction.

Facebook certainly operates outside of even this rather liberal framework so I wouldn't defend them wholesale. However I don't like false equivalencies.

> Its the difference between seeing someone multiple times and saying hello to a stranger on the train.

It goes further than that, as it affects other people too.

See also: Eben Moglen's talk about how privacy is ecological, not transactional.

http://snowdenandthefuture.info/PartIII.html

I suspect that most people do not in fact have a Facebook account. Last I checked, world population was over 7 billion and Facebook did not have 3.5 billion accounts. Or did you mean "most people who live near where I live"? But even there, the existence of Facebook shadow accounts means they will stalk you even if you do not have an account.

As a further point of fact, Facebook (and Google; Facebook is not alone here) stalks even people who _can't_ have a Facebook account. For example, children under 13 in the US.

Certainly there is no defense there. I will say though, much like real life one should be careful of the company they keep - in this case websites which partner with these companies. We should be just as pissed or more at the websites enabling this behavior.

Yeah, I really wish websites would just stop embedding Facebook Like buttons. That would already help a lot.

>As a further point of fact, Facebook (and Google; Facebook is not alone here) stalks even people who _can't_ have a Facebook account. For example, children under 13 in the US.

Surely this is illegal, though? One way to get the laws to ban this sort of dragnet commercial surveillance of people would be to appeal to the 'think of the children' argument and ban companies from tracking information about anyone under 13. That would also stop them from tracking information about anyone that hasn't totally confirmed that they're over 13.

> Surely this is illegal, though?

I don't know enough about the law on this to comment.

> would be to appeal to the 'think of the children' argument

Tempting, though I worry about unleashing demons even if you think they're on your side... ;)

Should a sender of a letter have the right to say that the recipient can't put their address into their rolodex?

>> Should a sender of a letter have the right to say that the recipient can't put their address into their rolodex?

How is a global surveillance network and database like a Rolodex?

Google, facebook, etc are pretty horrible surveillance networks if that is what they are, considering you can just choose to not communicate with their services and they aren't surveilling you any more.

That's pretty disingenuous though, given that FB and Google both track you across the net whether you have an account with them or not. Logging out of your account doesn't stop them or increase the difficulty of them tracking you, or associating that trail with you.

How does facebook and google track me if I, say, install ublock or adblock?

That's actively taking steps to block their tracking rather than just not using their service. And while technically, you can use uBlock Origin to block everything from Google, that would result in many webpages being broken.

You're also likely to be using Google's DNS (8.8.8.8) without knowing, because some piece of software decided to hardcode that DNS server.

And your friends have almost certainly already uploaded your data to Google's Android backup service and to WhatsApp's database.

I think the better analogy would be the postal service using return addresses to populate a database.

Doesn't the postal service already scan every piece of mail and put those images in a database?

It's a bit more complicated than that. Is the stalker analogy even a thing? Because if you were to continue to the analogy then you would be hanging out at the stalker's house, eating the stalker's food and then pissed he's collecting data in his house?

I get it when it comes to analytics, beacons, tracking outside of the ecosystem.

No, stalker has a security camera company, and you visited the stalker's house once because of this great party and left when it seemed dead. Stalker now knows you and starts noting every shop you visit through the cloud connected cameras. You had downloaded an app to get into that party and forgot to remove it later. You start getting notifications about the last restaurant you visited.

This metaphor is getting stretched to the point of complete craziness, but all of this is totally possible. But my bigger question is, when does autonomy and agency end when it comes to these "invasions" (quotes only because we all allow it in varying forms, but it's the creepy emotional factor that seems to elicit a response)

I don't associate with this stalker, I've blocked them from my contacts, moved away, told my friends about them, and I still experience moments of anxiety associated with their incessant invasion of my personal space, and the fact that they conspire with other stalkers to build the most complete profile of me possible.

And the police don't seem to care at all, nor do their masters.

Cal Pen Code § 646.9 . Stalking. (2008) (a) Any person who willfully, maliciously, and repeatedly follows or willfully and maliciously harasses another person and who makes a credible threat with the intent to place that person in reasonable fear for his or her safety, or the safety of his or her immediate family is guilty of the crime of stalking...

In California, stalking requires both malice AND a credible threat to safety. Comparing Facebook or Google tracking to stalking is, at least in California, highly inaccurate.

There is actually no crime in following someone around. The crime happens when it's done maliciously and with the intent to create a reasonable fear. Facebook isn't trying to instill fear. That's not their intent at all.

To be clear, I'm not defending Facebook, I'm just calling out the hyperbolic nonsense that gets thrown around in these discussions.

In daily use people (at least here) will also use the word 'stalking' for obsessively following a person physically or online.

Or if you want to stick to definitions:

verb (used with object)

5. to pursue (game, a person, etc.) stealthily.

http://www.dictionary.com/browse/stalking?s=t

People don't get punished for that definition of "stalking", which you specifically referenced in your first post.

I would consider the mental/emotional manipulation of billions of people solely for monetary gain to be malicious. Fear is a cash cow for advertising. Your safety is indeed at stake when so much sensitive personal information is aggregated and centralized by anonymous persons and then sold to other unknown parties.

> Facebook isn't trying to instill fear

Except for when they're running psychological experiments designed to manipulate the emotional state of their users.

I wonder, if a European implementation of the TPP existed and passed, whether Facebook could have sued Belgium('s public coffers) back for lost profits.

"No thank you" is such an archaic term; The cool kids these days are given the option to "Agree later".

I like your analogy. This is classic stalking and I'm glad that something is finally being done about it.

Consumers have a choice of not using the service. It's possible to survive without using Facebook.

True. But we are not the average consumer. We know better and can make an informed decision.

Except for the fact that facebook tracks you even if you do not nor have ever created an account. We can survive without facebook, but it is a leech that cannot survive without our data.

Facebook is tracking everyone including non users. That's what those Like buttons do.

Are facebook 'shadow' profiles not real?

How can Facebook not know your interests, isn’t that the whole point of the Like button? How do you propose having a social network that lets you Like and Reshare stuff and not let them know?

You don't need to save each and every action for ever to build up a profile, you can just use it for the moment and then forget it.

Just like on HN there is no page with 'favorite articles'.

Oh wait ;)

The fact that the favorites list is public is known and explicit. If you want to keep it private you can upvote what interests you.

If Facebook tracks me outside of Facebook's website because that other website has tracking code or a like button (which I didn't click) and I don't have an account on Facebook, I'm not ok with that.

I think that's what GP is referring to.

Aren’t the Like buttons distributed around the Web and used on purpose by publishers? If your reading the New York Times, there’s a like button on the story, if you click it, aren’t you explicitly telling Facebook your interested?

Perhaps you object to the page impression being tracked even if you don’t like it? This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes.

> This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes.

Yes, that's the consequence (well, it does't really have to be an API triggered from the server, it can send the user there). Or a pattern where a user has to click a locally hosted link/button which then loads the Facebook one, and/or records permission to load it with further page visits.

It's not really that much difference from an integration perspective if you include code in your page that loads a facebook iframe, or code that only does that after user interaction.

As far as I know, Like buttons are partially served by Facebook, which then knows I've accessed the site (the NYT in your example). This happens even if I do not click the button, do not hover over it, and do not have a Facebook account.

> Like buttons are partially served by Facebook

Yes, the default configuration has your page include javascript from facebook.net which the browser will request on every page view

https://developers.facebook.com/docs/plugins/like-button

In the case of this the theguardian.com page it looks like they've got a webbug as the last element of the body, which results in a request to https://www.facebook.com/tr?

Having facebook count views of your like button is probably considered a feature to publishers.

Facebook was tracking users even if they didn't click the Like button. This has nothing to do with page view tracking.

And they were tracking even non-Facebook users this way. There's zero consent here no matter how you cut it.

Worse yet, Facebook did this for years, and in the first years it swore it doesn't do that, and when they were caught doing it they said it was "just a bug"...twice.

Facebook has 0% credibility at this point. Just look how they're ruining people's trust in 2FA security, too, now (although if they end-up ruining the trust in SMS 2FA, that wouldn't be too bad of an outcome actually...).

This is a good article (although not complete, and only until 2014) on Facebook's awful, no-good, history of lying and tracking users without their consent:

https://www.propublica.org/article/its-complicated-facebooks...

2FA notif scam was the last straw for me. Just deleted my account. So long and thanks for all the fish!

There's zero consent here no matter how you cut it.

Thats not true. You implicity consent to usage policy of that website which then gave permission to FB. Ofcourse GDPR makes it illegel but until May 25 its not.

Is it possible to even view the usage policy on one of these sites without hitting a page that loads one of these like buttons first?

Loading the like button is enough for facebook to track you and infer your interests. You never have to click it.

> This seems unavoidable unless you mandate publishers host their own copy of the code behind these buttons and use a public API only to record the likes.

If Facebook means no harm, they could make this the encouraged way to include the like button.

Why not blame the other website that added the fb button on their page?

I blame both. I never said I only blame Facebook.

I'm not crazy about the current state of internet privacy, but I think it's a missed opportunity if we don't teach the general public just how much control they have over it. Most tracking being done can be prevented by a few modifications to web browser configuration. At the end of the day, we are sending Facebook our ID to be tracked. This is avoidable for a user with some knowledge and agency.

I don't think the answer is to put the onus on users to be tech savvy. We should be structurally preventing the behaviour.

Why not both?

We can remind people that the internet is still a dangerous place, while also trying to discourage bad behaviour

By structural, you mean regulatory. I agree that data stewardship should be much better-regulated than it is now.

But right now I can install any number of tools on Google's own browser that mitigate most common tracking/privacy concerns. I don't necessarily agree that we need to increase government regulation to address a concern that a Chrome extension is already serving.

While that should be taught, it should also be taught to companies that they should respect people's right to privacy.

the answer to privacy violations cannot just be technological solutions on the consumer end. It's like having people break into your house every week and someone tells you to buy a good pair of boxing gloves.

This warrants a political solution and I'm glad that the EU is moving into the right direction.

If Facebook tracks me outside of Facebook's website because that other website has tracking code or a like button (which I didn't click) and I don't have an account on Facebook, I'm not ok with that.

Then your beef is not with FB but the website which _chose_ to embed FB like button. You should stop using that website if you are not ok.

Yeah, that's like 40% of the internet, including almost all news.

The argument "just don't participate in society if you don't want people tracking every news report you read" doesn't really sit well with me.

Well these are the terms of using the site. You are not entitled to anything.

Can you practically view those terms without loading one of these buttons beforehand?

That's an issue, I agree.

I think you can already block thoses connections, so yes

What if blocking is against the terms of service?

You were not aware before reading thoses terms

The problem is that you are tracked by FB and Google on other websites, they know what you are reading and canalizing it, say they know what politics site you visit, what technology site you are reading, any other pages and then they put you in a bucket for advertising(say rich dude likes expensive tech, car videos, prefers dark color sites, not that smart, prefers this party, has X opinions on y)

Google analytics should not be allowed without me getting a prompt to allow it or not, FB button should be a simple static image without tracking unless I click on it. Also they track users that are not logged in or do not have accounts.

> Google analytics should not be allowed without me getting a prompt to allow it or not

One way to go about it could be to force all these data collectors to show what they know about us, how much they shared and with whom, and allow us to delete that data on request. I'd really like to know everything FB tracks on those like buttons, it's probably an obscene amount of personal data.

Once people see how much data they retain, there would be a righteous outrage. These datasets have been provably used to manipulate elections, subvert democracy and target us with fake news. I'd like a report of what fake news and politically motivated ads I've been served by their recommenders. Maybe if they are forced to come out in the clear about what they do with our personal info, they would change their tactics. We need reverse surveillance on FB and the other tech giants and ad companies.

If you're not in the US or Canada, you can ask for all the data FB is storing about you: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...

> I'd really like to know everything FB tracks on those like buttons, it's probably an obscene amount of personal data.

When you request a page like this guardian article, all they'd have access to would be:

  * The url you requested, along with time and IP            
  * Any facebook.com/facebook.net cookies you have stored      
  * Any other headers your browser sends       
  * Metadata about the page itself that the publisher publishes via "og:" tags

Said og: tags look like this: <meta property="og:title" content="Facebook ordered to stop collecting user data by Belgian court"/>

How does that compare with what you meant by "obscene amount of personal data"?

So at minimum they've got your identity and much of your browser history.

Seems reasonable to call that obscene.

Knowing who you are and what pages you visited in last years it is a lot of data that they mine and tag you and sell it to the advertisers. I think they can do a good profile of you by knowing all the obscure links you visit and how much time you spend there.

The users should have a choice, "Do you want this site to share your data with Fb,Google ?" If you do not accept you can't use it, but it is your choice not to use the website, the users will get informed because now I am sure most of the people don't even know about the tracking.

Reply on news.ycombinator.com