Stack Overflow lets Facebook track users across their sites

https://meta.stackoverflow.com/questions/384864/stack-overflow-lets-facebook-track-us-across-their-sites?cb=1

by Thorondor • 7 years ago

384 49 7 years ago

meta.stackoverflow.com

I believe that one day boycott will help them reconsider these practices.

xellisx• 7 years ago

"One day boycott" reads as if the boycott lasts one day and that's it, you are back to normal, using the site, getting tracked. So I don't think I would be too scared if I were a business.

c0vfefe• 7 years ago

Pretty sure they meant "one day a boycott."

eveningcoffee2• 7 years ago

Yes, it does not work if it is not coordinated but if significant number of users stops the service at the same time then it will leave sizable tent in the revenue.

cwbrandsma• 7 years ago

are you talking about boycotting Stackoverflow or Facebook? I could reasonably boycott Facebook, sure. But the day Stackoverflow gets boycotted is the day no code gets written. /s

Nextgrid2• 7 years ago

I know this is sarcasm but I’d like to add something anyway: I don’t know if it’s just experience or if the quality of non-Stackoverflow resources has increased but I find myself needing it less and less in the past couple years.

robertAngst• 7 years ago

I see this as 2 options-

If you don't like Facebook, get rid of it. I have. And I still have friends.
Let Facebook advertise really specific to you. Weirdly specific, it might be useful. *

*might get blackmailed later if you were doing socially unacceptable things.

But you could not participate in Facebook, the same company you are trying to avoid.

JohnFen• 7 years ago

But you could not participate in Facebook

That doesn't stop Facebook from tracking you, though. It only makes the tracking a bit coarser.

Someone1234• 7 years ago

I have a Facebook account, this creates limitations when it comes to blocking (e.g. I cannot use a DNS block/piHole).

What I found works for me is to use Multi-Account Containers with Facebook being forced-open in a specific container (that's only for Facebook) and then using Firefox's built in Content Blocking to block trackers in other containers (Content Blocking -> Custom -> In All Windows).

This allows you to use Facebook but makes it significantly harder for them to track you across other sites (via shadow accounts or your actual profile).

For example this works for Stackoverflow where I see:

The resource at “https://graph.facebook.com/[xxxx]/picture?type=large” was blocked because content blocking is enabled.

On mobile I simply don't install Facebook's apps and use the mobile web browser and still receive notifications via that.

snthd• 7 years ago

Alternatively there's https://facebookcorewwwi.onion

Caligatio2• 7 years ago

I'm a huge fan of Firefox's first party isolation (FPI) and using Containers to control Google. FPI kills trackers and Containers allow me to stay logged into certain Google services without having things like my search history tracked.

gdulli• 7 years ago

I was a huge fan too. I had a lot of containers set up on three different machines and they all got wiped out last week. I haven't put in all the work to rebuild them yet and I'm losing the wherewithal to keep putting up with Firefox.

smacktoward• 7 years ago

And if setting up Multi-Account Containers just for the one scenario of sandboxing Facebook sounds too complicated, Mozilla have put together a Firefox extension that does all the setup for you: https://addons.mozilla.org/en-US/firefox/addon/facebook-cont...

(Which, don't get me wrong, I think MAC is a great feature and use it myself for all sorts of sites. But it can be complicated to get your head wrapped around, particularly if you're not a professional nerd. Which is why this kind of set-it-and-forget-it alternative has some value.)

beagle3• 7 years ago

On mobile I simply don't install Facebook's apps and use the mobile web browser and still receive notifications via that.

And you're also tracked across (basically) all websites, because they all have this "helpful" Like button embedded.

hi5eyes• 7 years ago

one browser for botnet shit like fb/socials

firefox focus for somewhat botnet-free browsing

HenryBemis• 7 years ago

On Android, on Firefox you can add NoScript, PrivacyBadger, AdblockPlus (plenty of lists here [1]), and if you go all the way and root it, you can replace the hosts file [2]. I personally use zero FB products, and use NoRoot Firewall with global rule to block 31.13.x.x and a couple of other FB IP ranges. That also means that I exclude myself from WhatsApp and Instagram.

[1] https://filterlists.com/

[2] https://someonewhocares.org/hosts/

oldjokes• 7 years ago

I love how browsing the web now is like gearing up for war. Need our anti tank and our anti air of course.

markovbot• 7 years ago

It's kind of terrifying how one sided it is. The only browser that matters for standard setting, the one used by the vast majority of users, is built for and by one of the largest advertising and data collection firm.

int_19h• 7 years ago

I have a Facebook account, this creates limitations when it comes to blocking (e.g. I cannot use a DNS block/piHole).

Why not? I have an actively used Facebook account, and also run all my traffic through PiHole.

propogandist• 7 years ago

This alone won't be sufficient. I have a fake FB account which I haven't used in ages, which has only been accessed from my laptop. Somehow they managed to tie the fake account to my mobile device. I suspect they are using the apps that are constantly pinging graph.facebook.com to build a comprehensive profile of devices and accounts.

When I was visiting a foreign country I began receiving emails from facebook to try and get me to login, with FB marketplace results customized for the region I was in... this was very concerning and shows they are not only collecting vast amounts of data, but they have a good mechanism in place for persistent tracking of devices & users all over the planet

Skyywalker• 7 years ago

Won't the privacy filterlists in uBlock Origin fix this?

m463• 7 years ago

You might like umatrix (same guy afaik). Change settings to load only first-party sites then unblock other sites as necessary.

klyrs• 7 years ago

Yeah I love umatrix. Sometimes it's awful and it takes an extra few minutes to figure out the magic combination of things to allow. Sometimes it breaks a page altogether and I use an un-Matrix'd Chrome as a last resort (which I wipe after use). But I think it's worth the hassle.

ldavison• 7 years ago

They should. I use the Fanboy Anti-Facebook list (https://www.fanboy.co.nz/) and the avatars from FB on SO don't load for me.

lucb1e• 7 years ago

I like self hosted avatars. From the title I thought SO purposefully lets Facebook track us, perhaps through a like button, but instead the complaint is that they don't have a domain blacklist on user avatars, which sounds silly to me.

I care about privacy but there are bigger fish to fry. This is not structural and hosting your own stuff (like your avatar) is a part of the old Internet I miss.

dylan604• 7 years ago

Is there a significant bandwidth advantage by allowing users to host their avatar image on 3rd party site rather than self-hosting it? I too am a believer in self-hosted content, but I don't have any site that gets any kind of traffic to worry about costs so I have no insight on if avatars add up to make this a thing.

pdjstone• 7 years ago

Seems like it would be a good idea to add crossorigin="anonymous" referrerpolicy="origin" attributes to user-provided images. This would prevent any 3rd party tracking or referrer leaking.

amluto• 7 years ago

One might reasonably argue that this should be the default.

sneak• 7 years ago

The most popular browser is made by an ad targeting company.

It would be foolish of them to enable this by default.

neilv• 7 years ago

Of course, most all Web sites add in third-party tracking through HTTP requests, in one way or another. Offhand, HN is the only site that comes to mind as not doing that. (I've been working on anti-tracking for a long time, and my current hand-edited ruleset has over 10k rules, which I usually have to look at multiple times each day.)

0xmohit• 7 years ago

Stack Overflow does not honor Do Not Track [0] and in response to a question [1] indicated that they don't intend to do that either.

Tracking (including third-party tracking) seems like a feature.

[0] https://en.wikipedia.org/wiki/Do_Not_Track

[1] https://meta.stackexchange.com/questions/237062/does-stack-e...

EpicEng• 7 years ago

Almost no one does.

variable11• 7 years ago

Maybe an EU law will require sites to honor do not track or face stiff fines.

emptysea• 7 years ago

Safari has even removed Do Not Track because it can be used for fingerprinting.

https://developer.apple.com/documentation/safari_release_not...

icebraining• 7 years ago

including third-party tracking

I don't see how this follows. What does SO have to gain by allowing FB to track SO users? Just seems like laziness to me.

lone_haxx0r• 7 years ago

Install Privacy Badger.

"Privacy Badger automatically learns to block invisible trackers." https://www.eff.org/privacybadger

drinane• 7 years ago

Just start saying really inappropriate things into the microphones that are not there... LOL

pixelrevision• 7 years ago

Firefox’s containers really should be a standard browser feature at this point.

baroffoos• 7 years ago

I noticed this last week in my umatrix blocked domains. Its pretty terrible. Hopefully this gets reverted and doesn't signify the downfall of stack exchange because its a super important resource on the internet.

fulldecent2• 7 years ago

What options does a Safari user have to prepare for war on the web?

Nextgrid2• 7 years ago

While Safari lacks in certain features, it’s a reasonably mainstream browser which is a very good thing against browser fingerprinting. I use Safari combined with AdGuard to block cancer. It’s not perfect but I think it’s better than let’s say Firefox (you’d get more “blocking” power thanks to better extensions like uBlock Origin, but you get fingerprinted very easily by trackers that slip through the blocking).

neutrinoguy• 7 years ago

Collection of tools to protect privacy online.

https://www.privacytools.io

Buetol• 7 years ago

That may be the "Microsoft buys GitHub" moment of StackOveflow: people realizing the power we gave to this private company and migrating to non-profit-managed website instead (like https://framagit.org)

But I do not see a good alternative to StackOverflow available now.

Stack Overflow lets Facebook track users across their sites

Related Stories