Hacker News Reader

Comment by HyprMusic | Hacker News Reader

"Facebook's new ad service, launched earlier this month, gets around the traditional third-party advertising cookies by doing the tracking on its own. When a person visits a website selling shoes on a work PC, a piece of Facebook code placed on that site—Facebook's own cookie—recognizes that the person has logged into Facebook using that browser before. The shoe seller can then send the person an ad for the shoe on Facebook's mobile app—even if that person never registered with the shoe seller."

This highlights the dangers of the seemingly harmless social widgets. Anyone who doesn't already, I highly recommend using a plugin such as ghostery[1] to block them.

[1]https://www.ghostery.com/

View on HN

Webmasters can create static sharing "widgets" that are nothing more than an href to a url which encodes the page to be shared. This doesn't use any javascript and can't be used to track anyone (unless they actually share the page, in which case tracking is unavoidable). This can be done programmatically or with a simple web service (e.g. [1]).

[1] http://www.sharelinkgenerator.com/

Heise.de started "two clicks for better privacy" that Bruce Scheiner also uses on his blog. http://www.heise.de/extras/socialshareprivacy/ & https://github.com/panzi/SocialSharePrivacy

This is a great technique, because despite the mood in the echochamber here sometimes (I also have absolutely zero interest in using them), many many users legitimately do want to like things or share things or interact with social widget whatevers at some point on some sites.

Using libraries like this makes that interaction absolutely explicit, with minimal loss of ease of use, which means that nothing is shared until that explicit signal that the user wants to share.

I think you've probably misunderstood.

The mere loading of the widget sends a signal to Facebook that you visited the shoes page. You don't have to interact with the widget for the info to be sent.

Ghostery blocks the widget from loading.

I describe an alternate widget that uses a single link instead of the typical javascript. Loading such a widget sends nothing at all to Facebook, and is untrackable unless clicked by the user.

I prefer "Request Policy", which blocks everything that comes from external domains, and allows you to selectively enable what's needed on a per domain basis, i.e. you can enable googleapis.com on google domains, but it remains off everywhere else.

It's usually obvious to spot the CDNs and avoid the spies.

It breaks a lot of things initially, but after a while, the sites you use often are properly whitelisted, and it isn't a pain anymore.

Seconded. I use this along with NoScript, SelfDestructingCookies, and Adblock Edge (an ABP fork without any "acceptable ads" feature).

A lot of the time it's a big pain to get it working right (say, to watch a video on a news site), but that's simply the price I have to pay in today's web to retain at least a bit of privacy and security.

If anyone wants to make a neat extension, it seems like all these extensions could be combined into one with a slightly better user interface. If you want to make it really spiffy, the black/white listing for these could be shared in a distributed hash table with some sort of voting/trust mechanism.

Is the only difference between Adblock Edge and Adblock Plus that ABE removes the "acceptable ads" checkbox? The ABE site is unclear because it talks about being a fork.

I've been thinking this for a while too! The best comparison would be something akin to "Would you like to allow cnn.com to access XYZ?" that most mobile phones use these days.

It seems that the more locked-down hardware manufacturers may have accidentally stumbled upon a kind of end-user workflow that may actually work for controlling what they want to share with the web!

The edit window is now closed, and I realise I forgot to post a link. To make up for it, I'll give you two for the same price.

https://www.requestpolicy.com/ and https://addons.mozilla.org/en-US/firefox/addon./RequestPolic...

On my personal blog I made a button to disable/enable all the social media plugins. I don't know if anybody uses it (my readership is approximately zero, so no point in tracking clicks or A/B testing), but I figured I'd give users the option out of courtesy.

It does use a cookie to track your preference. The default is to enable them (since most users are not tech savvy enough to know they want them off, and those same users wouldn't easily find a button to turn them on).

Why do you use them at all if you know that they leak your readers' privacy?

Similarly on my current pet project (https://www.photographer.io) I opted to not use the standard sharing buttons at all due to the cookies involved, and I also added an option for users to remove all social buttons from across the site (even though they just use the pop-up share windows now). I've had a few people say they appreciated it, so it's definitely worth giving users that option if possible.

Instead of tracking by default, consider the approach taken by a few sites, where you have "dumb" images with the various social networking logos, that are replaced by the real button when clicked.

How does this even work? Is the shoe seller placing some kind of JavaScript snippet on their website in order to allow Facebook to track users? Is this coming from their "Like" button?

Yes. https://developers.facebook.com/docs/plugins/like-button/

Yes, the "Like" button is used by Facebook to track users across third-party sites. Clicking the button is not necessary for information to be transmitted to Facebook.

More information straight from Facebook: https://www.facebook.com/help/186325668085084

A good example is this privacy vulnerability in IntenseDebate: https://news.ycombinator.com/item?id=6591282.

Ghostery seems like a good thing... but how can you really trust them with your privacy? Isn't installing a browser plugin potentially a lot worse for your privacy than just being tracked with cookies? Hate to spread FUD, but I just don't understand how I'm supposed to trust these guys - I would certainly like to.

Well, you can inspect the entirety of the plugin code yourself. While they could of course update it with something bad, there is nothing inherently hidden from you that I'm aware of.

Really? Where can you find the source code? I never noticed it on their site - seems like they're a typically closed-source company to me. Am I missing something obvious?

Lots of ways! First and easiest would be to simply 'inspect popup' on the icon, and then navigate to the sources tab, though you may not get all of the code this way (perhaps if it was conditionally/dynamically loaded).

Second way, and probably the best, would be to go to its store page, and in the URL will be the extension ID; for Ghostery, it's "mlomiejdfkolichcflejclcbmpeaniij". Now, just find that in your Chrome installation directory, e.g. for Win7 the extension would be located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\.

The last way would be to intercept or otherwise directly down the .crx file (curl, wget, etc.), which is just a compressed zip archive. You can do the same for FF extensions as well, those .xpi files are just zip files.

Man, I don't know. That's not open source - they don't seem to intend for you to easily be able to see and understand the code. There's less peer review that way.

They're also an ad (analytics?) company. I just don't trust them.

isn't ghostery very/very/very slow?

Been a ghostery user for a long time now. Haven't noticed any slowdowns ever.

no.

Reply on news.ycombinator.com