Hacker News Reader

Comment by goenning | Hacker News Reader

I guess FB tracking pixels will no longer work when third-party cookies are removed from browsers. That seems like a massive hit for them if I understand it correctly (and a big W for us)

View on HN

Yes and no. FB's tracking pixel can be both first and third party: https://www.facebook.com/business/help/471978536642445?id=12...

Getting rid of third-party support will mean FB doesn't get anonymous data from random website users - but if you are logged into FB or hit the page from a FB link, it would still be trackable as a first-party cookie.

Don't tracking pixels also work without cookies or Javascript though? If you have an `<img src="example.com/someTrackingPixel.gif">` on your website or app, the server that houses that URL gets a ton of info on you from the HTTP request header data. Less useful without the cookie but still something.

Yeah but if they can't associate that activity with a record reliably then it's just noise.

are we really not that identifiable with all of the fingerprinting techniques and what not? the majority of people do not use VPNs to cover their tracks, and most home ISPs don't rotate their IPs that frequently that my tin foil hat suggests that for the non-techie person attempting to foil the IDing, they're IDing them.

Most browser "fingerprinting" methods have a pretty short half-life. The last assessment I read said something like half of the fingerprints were lost within 24 hours.

There are some companies that advertise device fingerprinting for moderation/anti-abuse services, but I have yet to see it in any martech stack. I assume they give lots of false positives and don't distinguish between different users/devices on the same network.

>Most browser "fingerprinting" methods have a pretty short half-life. The last assessment I read said something like half of the fingerprints were lost within 24 hours.

That's absolutely not my experience. Maybe if you use some weird research-level fingerprinting technique, but most fingerprints are just regular old boring stuff - screen and browser viewport size, installed plugins and fonts, browser UA and settings, hardware/gpu quirks, etc[1]. And it doesn't have to be 100% reliable, just reliable enough to track your activity to show you some ads.

[1] as a privacy conscious individual I'm fully aware just viewport size is enough to almost uniquely fingerprint me. I use my laptop screen, with sidebery extension, browser tab bar hidden by user css and sway in tabbed mode. My second computer is less unique, I "just" use sway and firefox with the minimal tab size (that for some reason is hidden must be unlocked in the about:config so it's very rarely used).

The problem is, if you are running a marketing database of millions and and millions of distinct IDs, you have to get into very esoteric fingerprint factors. Anytime you have a driver update or switch devices, you lose the connection in the data.

https://medium.com/slido-dev-blog/we-collected-500-000-brows...

Can it track you for a bit and show you some ads? A little bit. But compared to a tracking pixel it is not even remotely as reliable.

Doesn't the firefox resistfingerprinting setting fuzz most of these things? I see a lot of misconceptions about it on here when people use amiunique. It will say you are unique but if you look for a historical match there aren't any because you are unique, but also different each time you show up.

This gets lost a lot - just because you can prove uniqueness doesn't mean it's persistent or repeatable. Some of the "uniqueness" factors include things like number of audio devices or battery life.

Unique etags can help with this though

My default for all browsing is to use Private Safari window and never stay logged in for longer than needed.

Btw, there is hidden Safari setting in iOS, under Advanced at the bottom, “Privacy Preserved Ad Measurement” that was on, for some weird reason. And check and purge Website Data periodically.

Oh, and use iCloud Private Relay. A must.

Thanks for the pointer. That was somehow enabled even though I locked it to private mode, and disabled the iOS level ad tracking bullshit.

(CR study co-author here)

The tricky part, though, is that even with your client-side settings and privacy tools set up 100% right, any company that has your info can still send it to Facebook server-to-server, with "Conversions API."

https://themarkup.org/pixel-hunt/2023/08/02/help-us-investig...

I'm in a similar setup for FF on my Mac, but I also have it clear everything on exit. I exit at least every couple of days just to clear things, and sometimes immediately after visiting certain sites just because it makes me feel better while wearing tin foil. It's annoying after every launch causes me to use all of the various 2FAs to log back in, but I just don't trust what all you evil devs have done to the internet.

> annoying after every launch causes me to use all of the various 2FAs

In Mac, KeyChain passw manager can store TOTP secret too, so its just three clicks instead of one/two :)

Why not using Safari? There is Wipr, not uBO but good enough. And you will get Private Relay.

I've been on FF since before Safari. I've never been a Chrome user. FF is like a nice worn in pair of pants. It just fits.

Ha ha! I get it. But today’s FF is slipping to being worse. Lets see if uBO survives Manifest V3. And don't use DoH, I have a bad feeling about it, http cookies inside DoH are undefined thing.

You say so. It does everything I need, and as far as developing, I much prefer FF DevTools to Chrome and Safari. I only turn to Safari if I need dev tools for an iDevice

The camera app on my Android phone pings Facebook every time it starts up despite me not having an account to use any of the Facebook integration. Presumably the lib does the same in many other apps.

That seems like it should be illegal

Clearly you're not using the stock, default camera app then.

There's a server side implementation FB offers developers to circumvent some privacy restrictions now being enforced by browsers which doesn't have all the features of the clientside version but is their current workaround. It will improve privacy slightly, but some websites are still gathering as much information about you as possible over the course of a session to try and build demographic information and remarket to you.

Yes, Facebook Conversions API is server-to-server, so it circumvents the privacy settings and tools on mobile platform or browser.

https://www.facebook.com/business/help/2041148702652965?id=8...

Research using a browser extension or web proxy can't see CAPI tracking.

Reply on news.ycombinator.com