Facebook fixes logout issue

http://nikcub.appspot.com/facebook-fixes-logout-issue-explains-cookies?re=1

by nikcub • 15 years ago

71 48 15 years ago

nikcub.appspot.com

altrego99• 15 years ago

> There is a bug where a_user was not cleared on logout.

Yeah, right! Sure it was a bug.

code_duck4• 15 years ago

So, do the remaining cookies truly not contain data which can identify a specific user to Facebook?

nikcub• 15 years ago

Facebook say they do not

I would prefer they deleted all cookies, since the user/browser can still be uniquely identified

sp3323• 15 years ago

You can use this page to see how "unique" your browser is. https://panopticlick.eff.org/ It doesn't use cookies.

anonymoushn• 15 years ago

Your browser fingerprint appears to be unique among the 1,777,057 tested so far

That is a bit unsettling.

keithpeter• 15 years ago

I got the same number as anonymous below me. The biggest cause of uniqueness was the installed fonts reported by the browser. I'm on Linux and we have some weird ones....

cousin_it• 15 years ago

Most interesting link I've seen today, thanks!

So as long as you log in to Facebook often enough (more often than you install new browser plugins or fonts or whatever), they can cookieless-track you perfectly when you're logged out, by remembering the browser fingerprint you had when you were logged in. And even if the fingerprint changes a little bit, they could use something like Levenshtein distance, combined with statistics of frequently visited sites, to have a good chance of identifying you anyway. In the hypothetical world where Facebook was an evil monster of surveillance, of course. I'm not talking about the real world here ;-)

So what can you do when faced by a hypothetical monster like that? Disabling third-party cookies is only the first step. Is there any reasonable way to anonymize your browser fingerprint?

y0ghur7_xxx5• 15 years ago

They don't need the cookie to track you anyway. Cookie-less tracking is no problem. Not deleting the cookie was making the tracking just a little bit easier, but I am sure they track users anyway, as long as they download the like widgets that webmasters put on their pages.

lbrandy3• 15 years ago

> I am sure they track users anyway

Just so we are clear: we don't cookieless "track users anyway".

I suppose you guys can line up to say I'm lying like you did to the other engineers who posted yesterday, and it is quite obviously impossible for me to prove otherwise. But suffice to say our policies are rather clear on the issue.

sp3323• 15 years ago

If I am logged out, and I just visit a page with a "Like" button, what info does Facebook get about me?

tiles2• 15 years ago

While it's unfortunate you're being thrown under the bus for this issue (I cannot prove Facebook is tracking me via my browser headers or not, it's simply dependent on how much trust I give to your company), this is a really healthy and important development that people are coming to. Facebook isn't the -only- company which has the potential to track you across the web; it's incredibly easy to do with ads, Digg buttons, Tweet buttons, and whatever new social network hits the stage. Some of these organizations may not have had such high profile cases as Facebook, which for all of its mishaps has at least responded to user's concerns.

We need to enter into an awareness about how identifiable we are just browsing the internet. Average users need to know this. It's not like Facebook can force browsers to not send identifiable content and its refusing to--web browsing has been designed to allow third party content just like that. So we need to start exploring the ways in which this amount of trust to third party content isn't so implicit.

y0ghur7_xxx5• 15 years ago

So you don't track users with the "like" widgets? Even when they don't click on them? That would contraddict everything I read from FB until now.

> I suppose you guys can line up to say I'm lying

I never sad you lied. I just sad what you explicitly state on your privacy policy:

"We receive data whenever you visit a game, application, or website that uses Facebook Platform or visit a site with a Facebook feature (such as a social plugin). This may include the date and time you visit the site; the web address, or URL, you're on; technical information about the IP address, browser and the operating system you use; and, if you are logged in to Facebook, your User ID."

http://www.facebook.com/about/privacy/your-info#inforeceived

If that's not "tracking" I don't know what is...

wnight• 15 years ago

But you do track users, and did track users in ways you've quickly stopped, so it's obviously not a moral issue. It's an issue of dodging blame for this or that specific tactic.

> you guys can line up to say I'm lying

You say that as if people should be ashamed for presuming the modern American corporation is lying to them. I've been directly and obviously lied to by representatives of many companies and they've all played the victim like you are.

If this is official have Zuckerberg say something legally binding.

> it is quite obviously impossible for me to prove otherwise.

Not at all. As a corporation, allow independent auditors to monitor certain key filtering systems to make sure you couldn't be receiving data you say you don't intend to log.

As an engineer you could leak the policy memos. And I mean leak, not get permission to post some redacted version.

eli• 15 years ago

It makes the tracking a lot easier, actually. Without cookies it's downright difficult.

mingyeow• 15 years ago

"There is a bug where a_user was not cleared on logout. We will be fixing that today."

PR speak. This seems much less like a bug to me, more like a poorly contemplated decision.

What seems more likely is that they were contemplating what they should do, and given the general direction Facebook is headed, they probably thought little of just leaving it in.

I love the facebook guys, but calling it a bug as opposed to a non-malicious decision is just PR speak

yuliyp• 15 years ago

The fact that it could be removed overnight should give you a hint about how much it was actually used.

Slimy• 15 years ago

A Facebook engineer has made a statement saying there was not tracking involved in the "Update" section of this article: http://www.zdnet.com/blog/facebook/facebook-fixes-cookie-beh...

newchimedes2• 15 years ago

Wasn't there a FB engineer yesterday who said that this "problem" would take a long time to fix? Apparently it didn't take that long.

newchimedes2• 15 years ago

Here's the article I mentioned: http://blogs.wsj.com/digits/2011/09/26/facebook-defends-gett...

RexRollman2• 15 years ago

As anyone who frequents HN would notice, I do not care for Facebook. I don't like it as a company and I do not care for its founder. But with that said, I am glad to see that Facebook addressed this issue.

And thanks to Nik for bringing this to the light.

code_duck4• 15 years ago

Facebook created this issue... now we're supposed to thank them for addressing it after it was revealed in public?

RexRollman2• 15 years ago

I am willing to thank someone who listens and then fixes something. To do otherwise is just rude.

mjs2• 15 years ago

"The other 'a' cookie, a_xs, is now also deleted on logout. a_xs is used to prevent cross-site request forgery."

Does anyone know how this cookie is used to prevent CSRF?

epochwolf2• 15 years ago

Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default.

This functionality is referenced in the security guide.

http://guides.rubyonrails.org/security.html#csrf-countermeas...

mjs2• 15 years ago

From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.

shithead• 15 years ago

Q. How do you know that Mark Zuckerberg is lying?

A. His lips are moving.

Facebook fixes logout issue

Related Stories