Hacker News Reader

Comment by bjt2n3904 | Hacker News Reader

I think there's a much simpler answer than some sort of "deep browser fingerprinting" or other scary voodoo.

1) User requests account deletion. Facebook does not delete it, keeps track of his phone number via shadow profiles. (Mike is still mike@gmail.com, 800-555-1234)

2) User creates a new Proton Mail address. (Fakey@protonmail.com)

3) One of his friends adds that email address to his contact. (Mike, mike@gmail.com, fakey@protonmail.com, 800-555-1234). This user is on Instagram, Facebook, or has some mobile app that uses their analytics.

4) Facebook makes the association after scraping his friends contact list.

Essentially, his friends betrayed him, likely unintentionally.

View on HN

This is 99% likely the case. Everyone thinks that we need technical voodoo to figure out who a user is.

No, people are just far worse at separating their “new” identities from their old ones than they think.

You don’t even need a shadow profile tracking previous info to do this. Just infer PYMK via a few friends he adds on the new account.

From the comments it sounds like the real answer is cookies: https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a...

My one and only facebook profile was a complete fake and yet it managed to recommend I follow many of my real family and some of my social circle. My guess this was simply based on my location because the people it recommended were also family/friends of people who had used facebook from my house.

IP address, ever heard of that nearly impossible to anonymize thing?

Facebook can also build a profile based on loads of their logo image using the IP... Including rough geolocation if it is shared.

Hence my guess that it was likely based on location.

In the Reddit thread someone brought this up, and OP explicitly stated the protonmail address was brand new, and created solely for this purpose

Hi, I'm the original poster on Reddit.

It's a great theory -- and I can see how this could easily happen to someone - but it was not the case in this scenario. In fact, doing so would completely defeat what I was trying to achieve. The email address I used for Facebook was unique, not used for anything else, and not shared with anyone else. It was completely isolated.

So...cookies? https://www.reddit.com/r/privacy/comments/am1hi0/a_created_a... (suggested below by eridius)

And riverdan points you you didn't seem to clear browser cookies since you last used you old personal FB account?

Yeah, that's what the running theory is. Kind of angry with myself if that's the case. However, as I point out in my second update, the whole endeavor seems to be awfully tricky. One misstep and privacy leaks.

Maybe recreate it, but take out all the associations that people are suggesting here?

Spin up a new Windows VPS and create all activity over there and see if FB still connects you?

Yep, IIRC it was confirmed that FB crosses people's contact lists to match profiles to people.

This shows how just trying to protect your privacy alone doesn't work. Facebook relies on the unintentional betrayal of your friends and associates.

You might not have put your phone number into facebook, but someone you know put your number in with your full name and the facebook app harvested it. Facebook now has your phone number in your shadow profile.

Everyone less privacy savvy than you will inadvertently permit a corporation to harvest your personal information to profit from.

Facebook also matches people by who searches for whom. If one of his friends searched for him under the new name, then it can make the connection that way.

> One of his friends adds that email address to his contact.

And what a user creates a fake account without adding his real or current/old friends to it?

Reply on news.ycombinator.com