Hacker News Reader

Comment by mojuba | Hacker News Reader

Another personal observation. I have an Instagram account that I thought was fully incognito. I never connected it to any other social account, I used a separate email for authentication etc. Just days after the Instagram founders left Facebook I started receiving friend suggestion on my IG that were very very relevant. Those were people I knew in real life and mostly connected via Facebook but not only. I shouldn't be surprized as being connected to the Internet by itself is an end to your privacy but still, this was probably the spookiest invasion into my privacy so far. Bye-bye Instagram.

View on HN

This happened to me after Facebook acquired Instagram. I had my mobile no in Instagram profile. Instagram cross-referenced my mobile with my Whatsapp contact list(I haven't given Instagram access to my iPhone contacts). I suddenly got suggestions to follow my colleagues on Insta. Colleagues with whom I interact only on Whatsapp. Since then my trust level in Instagram,Facebook & Whatsapp has gone into negative.

When I was in another country on a business trip I bought a temporary local SIM, originally valid for two weeks but I've kept it active as I travel there often.

I used that foreign number to create my Instagram account and I've gotten the benefit of only being shown suggested accounts from locals from that country (zero people I know). Same goes for ads as well. Currently I keep it on roaming and actually use it to verify other online services that may stubbornly require SMS.

Might be worth a try for those of you looking to pseudo-opt-out of phone number tracking & recommendations on social media services that do this, if you can get your hands on one.

Just as a warning to anyone who might try this, it won't work. (At least not without a massive amount of opsec effort expended on your side.)

I'll give you an example of why it might not work. Since your phone has roaming, you happen to have it with you at work, or at a party, or at the library, or anywhere really. If even a single acquaintance of yours is "nearby", the information is leaked. If acquaintances seem to always be "nearby", children, wives, husbands, siblings, your info is DEFINITELY leaked.

If anyone is going to try to use this strategy for anything which might result in the loss of your livelihood, (eg - porn), please realize there are many, many, many more precautions you will have to take than are listed in oedfmarap's comment. If you just do what you see in that comment, you could find yourself without a job somewhere down the line.

While one would think that this is only important for things you're doing that you don't want the government to know about (see [1] page 52 for details on how not to mess this up -- basically don't have them turned on together, don't turn one off and turn the other on in the same place, or log in to the same sites or store the same numbers on both phones), it's also important for Facebook and other private tracking. If you have Facebook on your burner phone and your friends have Facebook on their phones with location enabled, it's over [2].

[1] https://www.defcon.org/images/defcon-22/dc-22-presentations/...

[2] https://splinternews.com/facebook-is-using-your-phones-locat...

I've seen this, and concluded that friend suggestions must use GPS to see who I am near on a regular basis.

This is absolutely true, when I moved to London a few years ago, I rented a room in a house with 3 other housemates I had never met.

Within 1-2 days, Facebook recommended one of them as a friend - bear in mind I hadn't added any of them to Fb, so all it could have used was our location...

I believe they used Wifi BSSID tracking for that, GPS would be too battery heavy. If you're connected to the same Wifi networks it can reasonably assume you're in the same vicinity.

It's possible Facebook uses location data for this, but I've got an alternate theories.

This happens to me often too, with much briefer encounters: mainly dates and meetups. Since I've shared similar amounts of time at the same restaurant with hundreds or thousands people with whom I had no interaction, many of who's arrival and departure times would happen by chance to line up with mine, they must be using something else. I also share a duplex-house and an office building with people who've never been inexplicably recommended on Facebook.

From these observations, I've come to think that location data has to play a very small role in Facebook's recommendation system.

Here's my best (but untested) theory to explain this: Your house-mate searched for you on Facebook, which triggered Facebook to think you might be friends.

I’ve seen this happen with YouTube, specifically this video: https://youtu.be/bKgf5PaBzyg

I had watched it many many years ago, and I suddenly remembered about it while at my friends apartment, (which is in the same building). Now I searched it up on my friends computer which was logged into his gmail account. We watched it and laughed. However, an hour later, I was on my iPhone at home when it appeared in my related videos.

http://i.imgur.com/u31ZuWM.jpg

I refreshed and it was gone...

Definitely location tracking of some sort. IP, location data from the browser (if allowed), and scraping photo metadata can all lead to them associating people.

Are you sure you didn't access it from the same IP address? There are so many fingerprints you are willingly sending to the public.

‘Willingly’? I think unwittingly is more likely.

It's your computer which store cookie and localStroage data to the local storage. It' your computer which execute JavaScript program to retrieve that data.

It's your choice to use the same IP address.

It's your will.

I did of course, how could I not access both from the same IP. The bottom line is: a property owner is a property owner even if it comes to separate domain names.

A VPN would be one way

Haven't you used the same web browser for both, Facebook and Instagram? They might just be sharing cookies.

Well, Instagram and FB being 2 separate domains , they shouldn't (in theory at least) be able to access each others cookies in browser. The tracking is most likley still server side based.

Based on what the OP is writing, the unique identifier foe the user can even be the IP address...

They shouldn't be able to access each other's cookies at the browser's level, but instagram.com might include third-party javascript code from facebook.com, which connects the two accounts in the system.

This is a perfect example of the need for physical comparmentation. Separate devices never connected through the same internet service. As far as devices go, to think you have separated “anything” on only one device, you’re living in fantasyland.

If the app can look at your wireless, even that is not enough. It can just make a map of the SSID/BSSID around you.

Statements like this make me want to learn phone OS development just so I can have a better understanding on what information an app can get from the OS. Honest question, why would an app ever need to know the SSID of a wireless network? The app should only care if there is a valid network connection, and then use it. I can see being able to know if it is wifi vs cellular so they can have the option to limit large downloads to wifi only. However, the SSID would not be necessary information for the app.

An example would be an app for associating a device without a screen on to a wireless network. Think IoT devices or Alexa. Saves the user from having to type in the SSID which is a pain.

IP address commonality is probably a major part of this, so using separate devices only helps if they are on different carriers and you never use wifi AND you don't allow location services or practically any other permissions.

With a single device, it's fairly reliable to use a vpn or multiple vpn providers and only log in to each account when connected to a given vpn.

Qubes OS disagrees with you here.

Agreed. From my POV, unless you’re really needing anonymity, I don’t include TOR as a practical solution for day to day needs.

Reply on news.ycombinator.com