Hacker News Reader

Hacker News

Comment by jannes | Hacker News Reader

Full thread

jannes

My off-facebook activity was empty. That's encouraging, because it looks like my countermeasures have been working:

- Fingerprinting resistance in Firefox (privacy.resistFingerprinting = true)

- First-party isolation in Firefox (privacy.firstparty.isolate = true)

- Blocking third-party cookies in Firefox (network.cookie.cookieBehavior = 1)

- Firefox container when I need to login to ad/tracking companies (Facebook, Google)

- uBlock Origin

- Cookie AutoDelete

- PiHole on my home network

View on HN

How do you cope with constant reCAPTCHA prompts? I get prompted by Google when using search, because it thinks I'm a bot if I'm anonymous enough.

Have you tried using another search engine like DuckDuckGo?

There should be an extension to automatically filter the reCAPTCHA-using sites out of the results of the search engines.

I think GP is saying that Google itself is presenting the captchas, not the Google results they click. I've had it happen a couple of times when using VPNs before.

reCAPTCHA is a Google product, but the owner site needs to actually integrate it, so it's a conscientious decision

I might not have been clear; sometimes when using a VPN, you can't even load Google search results until you submit a captcha. If you go to "google.com", it will make you enter a captcha before you can search anything.

Ah that's fair, Google captchas VPN users, but I don't think it's recaptcha, it doesn't look exactly the same.

Having done this in a previous life, they do this because they fight against scrapping their search results.

You learn to derive some satisfaction from feeding it inaccurate labels.

Out of all activities you listed, just 3rd party Cookie blocking and using any "login with Facebook" buttons would give the same result for Web. I don't think any of the activities you listed would prevent the data collected through apps though.

If you have a domain, you can give every service it’s own email address, ${service}@${domain}. They can try reporting that to Facebook, but unless someone understands that the entire domain is one account they won’t be able to correlate them.

I don't think they will tell you the whole truth.

It's just like with Google history you can "delete".

They have the data stored for the authorities anyway.

They are required to do it by law (Patriot Act etc.)

> I don't think they will tell you the whole truth.

This is true:

>We receive more details and activity than what appears in your off-Facebook activity. For technical and accuracy reasons, we don’t show all the activity we’ve received. This includes things like information we’ve received when you’re not logged into Facebook, or when we can’t confirm that you’ve previously used Facebook on that device. We also don’t show details like the item you’ve added to your shopping cart.

https://www.facebook.com/help/2207256696182627

Thanks for that link. Looks like the infamous "ghost profiles" are officially confirmed now.

I wish they would show the ghost profiles as well, but since it's not linked with 100% confidence they are probably not allowing it because it could be a privacy violation if it turns out that the link was incorrect (i.e. they showed a ghost profile to the wrong user).

I'm not sure how ghost profiles are legal within the EU.

They can’t be I think. No way to opt in. Or even to inform the person.

I had exactly one item, and it's a store I never shop at, so assuming they are actually showing all the information they "have" on me, I also feel encouraged that my opsec is sufficient.

I guess the only thing better would be 50 stores I never shop at. I might experiment in the future with finding ways to deliberately poison companies' data wells with incorrect information...

Thanks for sharing

BTW, how does PiHole help in regards to anonymity?

> how does PiHole help in regards to anonymity?

By blocking many advertisers tracking cookies (by blocking all access to those hosts via point the DNS result elsewhere) it reduces how far your information immediately spreads.

Far from massively effective because it does nothing to stop 1st party tracking and those 1st parties sharing further, or 3rd party cookies for new hosts not in the blocklists yet, but it can still help.

My use of PiHole isn't really an anonymity/tracking avoidance thing, my priorities in using it are avoiding ad network related annoyances like drive-by install attempts from less reputable (and/or hacked) networks, auto-playing audio, pop-ups/-unders, bandwidth waste (particularly from auto-playing video clips), occasional attempts to access microphone and/or camera, etc.

Block requests to all of FB's domains in the hope that it can't load FB's scripts or buttons or "like" buttons; literally anything from FB as far as humanly possible.

It allows you to block the domains of known third-party tracking companies. However, this measure is going to become less effective over time with the increasing usage of first-party tracking.

Thank you for this.

Reply on news.ycombinator.com