But, as someone who understands that not all people and companies use the same moral set as myself, this is why I've never set up 2fa using a phone.
Why should I give some company my phone number? Increasingly it's become a single point of metadata to uniquely describe myself (just as my email addresses have).
That doesn’t need to be the case though with just a little bit of effort and minimal cost. Use your own domain for email and set your account to be a catchall. Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier.
If facebook was able to design and build this system, you can bet that other companies are doing this too.
9425ca8eb02d022309ec175a7067b1567a5f741ec7010cc1b5034287f9db6e2f
4d1c86b9f418c713e784760fea809e34418c2f13e993d907783572ecc2c9bb6e
I doubt it'd be worth spending the effort to target people with personal domains though, and it would have some negative effects, so your point is well taken.
They use it to match traffic across devices and IP addresses.
> pretty simple to crack unsalted hashes
Go ahead and rainbow table those hashes then. If you do it and are the first one to email me (email address in profile), I’ll pay you $100.
If you use the method described in the grandparent, you use a unique email address for every site (e.g site1@yourdomain.tld, site2@yourdomain.tld, etc). The domain will be the common part, which would be very hard for a company to use because most domains are shared between many separate users.
I do and have done so for over 10 years. It’s been very eye opening to say the least to see how many sites have leaked my email.
It takes a tiny amount of effort: you setup your domain with a wildcard so all you need to do to create a new email address is to use it. You could send mail to barkingcat@real.domain.for.394549.net right now, and it will be delivered to my inbox with no setup required.
It's also great in case you start spamming me. I don't have to struggle with your unsubscribe links, I can just blacklist all mail sent to barkingcat@real.domain.for.394549.net, and be done with it without any collateral damage.
My if my site-specific email giqjtodvdksu@... has been getting spam lately then it is likely that either they sold it or they got hacked.
You mean a very small percentage of FB users do this?
The point being as parent comment said it’s not “a little effort and minimal cost”. Figure a $10-15 overhead cost for the domain and maybe $5/month/e-mail account? Effectively to minimize tracking on Facebook one would have to spend a minimum of $70/year?
It doesn’t seem like a great solution...go with a “free product” like Facebook in exchange allowing them to collect and monetize your data, only to pay to combat their business model? May as well offer a competing service that doesn’t track you, collect/monetize your data and pay say...half the cost of a domain and email.
> May as well offer a competing service that doesn’t track you
I would kill for that. But this day and age it would be hard. Also, even subscription services typically see fit to track you and serve you ads.
unless sites smarten up and realize facebook@johndoe.com is the same person as pizzaplace@johndoe.com, especially when johndoe.com isn't a "common" email domain like hotmail.com
There's a lot more going on than linking email addresses.
(To save you a click, they look like aa_COMPANY+SHORTHASH@mydomain.com, with shorthash being based on COMPANY and a secret)
Downside is the address ends up absurdly long, and I’ve had to manually create some aliases for companies that won’t accept the plus.
I don’t recommend this setup, it’s kind of a pain to maintain, but I wish one of the mainstream providers would implement something similar.
I think I'll extend the latter (and reduce the required Spam score) before it gets sent to my inbox.
Exactis Breach date:June 1, 2018 Compromised accounts:131,577,763
> Compromised data: Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure, Financial investments, Genders, Home ownership statuses, Income levels, IP addresses, Marital statuses, Names, Net worths, Occupations, Personal interests, Phone numbers, Physical addresses, Religions, Spoken languages
The reason I say it's something people should have expected is because if people were more critical of the things asked of them, then things like this would never get off the ground. Instead, because people do not seem inclined to naturally believe that corporations might have ulterior motives, such practice has become common place and on some sites even mandatory.
People worship at the altar of success, and there aren't many relatively new companies as profitable as FB. That's not to say that these companies don't spend significant coin in pushing their inane message of "we're connecting the world" wherever they can. And mass media for the most part go along with it, mostly focusing on the stock price, rarely bothering to examine how FB makes its money and what tradeoffs that comes with.
It is OBVIOUSLY for ad targeting, I think I mentioned it not even two weeks ago: https://news.ycombinator.com/item?id=18020177