Why staying logged in to your FB/Twitter is dangerous | Hacker News Reader

Why staying logged in to your FB/Twitter is dangerous

finance.yahoo.com

46 pointsfinebanana21 comments

The seemingly harmless "Like" & "Tweet This" button on the websites you visited can be used to track your browsing habit even if you never click on them

Open articleView on HN

This doesn't seem to be the full story. If I log out of FB I still have multiple cookies for the .facebook.com domain (e.g., c_user, which seems to contain my user id).

The like/comment/etc. 'widgets' are served from facebook.com, so presumably they are still tracking me.

Don't know why this article didn't mention Ghostery or http://disconnect.me

You could also use multiple profiles (at least in Firefox), one for browsing around and one for social network sites.

In that case there will be guaranteed no cookie cross-pollution as the sites are completely isolated from each other.

Just logging out is indeed simply ineffective.

My wife is a Google Chrome user and she logs into Facebook and Twitter in an incognito window. Everything else she does in a regular Chrome window (which is set to delete all cookie when the browser is turned off).

Another option would be to install a second browser and use it solely for FB/Twitter.

If only... Facebook uses a Flash LSO, which is of course shared between browsers.

"of course shared between browsers"

Is it? Are saying that the flash crap doesn't distinguish between browsers/profiles?

That's another very bad security problem with flash. For me, it's the final straw. I'm going to wipe flash from all my machines now.

Brian Kennish, who is mentioned in the story, is the author of disconnect. He helped the WSJ do the research, here is the original article:

http://online.wsj.com/article/SB1000142405274870428150457632...

for some reason the Y! version trimmed some parts of the story

It's not really "dangerous", it is just that you give a bit more information to FB/Twitter/$SocialCompany than you thought you would.

While, I usually logout of FB or Twitter, I have a few adblock rules to block them on other webpages. It works fairly well... If I want to like and share, I believe I can do it manually...

One reason it can be dangerous is that not all of them use HTTPS. And hopefully you know what Firesheep is by now.

You could add the EasyPrivacy list ( http://easylist.adblockplus.org/en/ ) to your adblock subscription.

Many thanks, I didn't know about this one.

From what I gathered in the article, logging out doesn't solve the problem. The cookie works if you've logged in anytime in the last month

Also, Facebook uses a Flash LSO. You have to clear that to really be logged out.

I don't have Flash :D

Which is why I said that I used adblockplus rules for this.

They couldn't have published a more obvious story. Anyone with any sense doesn't log into either service and you don't need to be logged into either service for them to track you. It's amazing what freely available information (your IP, the sites you visit, etc) can do to help turn you from an aggregate anonymous identity into a fairly well "guessed" identity. And since webmasters carelessly litter their sites with this third party crap, they can build up a significant database of the places you've visisted and your habits, without knowing much else about you.

The first thing I did when Facebook rolled out all of that garbage was redirect everything facebook related to localhost and then created adblock/element rules to filter out all twitter and facebook buttons, tags, etc. I even filter out the whole "facebook discussions" crap that are attached to seemingly 80% of pages, these days.

Then again, I guess the public lags behind such things. I'm sure there are people out there just today learning what a cookie is, so . . . ~shrug~

Yeah, most people would think that those buttons on the sites they've visited won't do anything unless they click on it. So yes, this is an obvious story to some, but also a "why didn't I think of that!" moment for the rest. just sayin. ;)

I have to agree. A vast majority of people don't know about this, and the one who I have mentioned this to don't seem to even care.

I agree with the other commenters that "common sense is remarkably uncommon." Yes, once you've grasped how web cookies and iframes and other mechanisms can be combined to track you across web sites, it is obvious that Facebook can track you even if you don't click the "like" button.

But most people don't have this level of understanding, and I'd say that Facebook goes out of their way to make this non-obvious. So yes, you're right, but also yes, this type of article is relevant. You probably read something like this once, and it was a revelation for you. Now others are getting their tall, cool, glass of reality.

No idea why you're getting downvotes, unless people equate your comments slightly dismissive tone with being non-contributory. Personally, I've seen far worse, and you have some useful tips embedded in the comments, so as far as I'm concerned your comment is a win. Thanks.

You might want to consider amplifying on your methods of maintaining your privacy, others may find a more detailed set of instructions helpful.

It's obvious to you, dear HN reader. But please step out of this little bubble, and ask random strangers on Main Street (or whatever the equivalent is in your domicile) if they know how the "like" button appears on their web page; if they know what HTTP Referer means; etc.

I'd wager that 95%+ of the users on the 'net wouldn't know the implications of these buttons.

Ironically, the article's header has Facebook "Recommend" and Twitter "Tweet" buttons. The Facebook one has 4,000 "likes" and the Twitter one has 235 Tweets.

Link to original story:

http://online.wsj.com/article/SB1000142405274870428150457632...

Reply on news.ycombinator.com