Facebook ruined Christmas?

[Jazzylee77]

I just heard a Clark Howard bulletin about a discontinued Facebook feature (maybe a widget?) where friends would be notified of friends purchases. Duh! Not such a great idea to let friends and family know what you are buying around Christmas! Clark said it is now an "opt in" thing. Just wondering, since he doesn't always get the technical details right.

[zodiac01]

haha

"omg look at all the killer stuff they are buying i hope that one is mine!"

<flip to xmas>
socks? frickin socks? who the hell did you buy a 360 for? wheres all the other stuff? wtf!

lol

[Cyclops]

That was quite big news a couple of weeks ago, even saw it on the tv news here in Australia.
It just shows how far much our privacy has been taken from us. Theres not much that can't be found if you know how to use search.

Facebook's Beacon More Intrusive Than Previously Thought
A Computer Associates security researcher says that Facebook's controversial Beacon online ad system goes much further than expected in tracking people's Web activities.
Juan Carlos Perez
Friday, November 30, 2007 4:10 PM PST

A Computer Associates security researcher is sounding the alarm that Facebook's controversial Beacon online ad system goes much further than anyone has imagined in tracking people's Web activities outside the popular social networking site.

Beacon will report back to Facebook on members' activities on third-party sites that participate in Beacon even if the users are logged off from Facebook and have declined having their activities broadcast to their Facebook friends.

That's the finding published on Friday by Stefan Berteau, senior research engineer at CA's Threat Research Group in a note summarizing tests he conducted.

Of particular concern is that users aren't informed that data on their activities at these sites is flowing back to Facebook, nor given the option to block that information from being transmitted, Berteau said in an interview.

"It can happen completely without their knowledge, unless they are examining their network traffic at a very low level," Berteau said.

The CA news comes after Facebook scrambled on Thursday night to tweak Beacon in order to calm complaints from privacy groups and Facebook users that the ad system is too intrusive and too confusing to opt out of.

Beacon is a major part of the Facebook Ads platform that Facebook introduced with much fanfare several weeks ago. Beacon tracks certain activities of Facebook users on more than 40 participating Web sites, including those of Blockbuster and Fandango, and reports those activities to the users' set of Facebook friends, unless told not to do so.

Off-Facebook activities that can be broadcast to one's Facebook friends include purchasing a product, signing up for a service and including an item on a wish list.

The program has been blasted by groups such as MoveOn.org and by individual users who have unwittingly broadcast information about recent purchases and other Web activities to their Facebook friends. This has led to some embarrassing situations, such as blowing the surprise of holiday presents.

On Thursday night, Facebook tweaked Beacon to make its workings more explicit to Facebook users and to make it easier to nix a broadcast message and opt out of having activities tracked on specific Web sites. Facebook didn't go all the way to providing a general opt-out option for the entire Beacon program, as some had hoped.

But Berteau's investigation reveals that Beacon is more intrusive and stealthy than anyone had imagined.

In his note, titled "Facebook's Misrepresentation of Beacon's Threat to Privacy: Tracking users who opt out or are not logged in," he explains that he created an account on Conde Nast's food site Epicurious.com, a site participating in Beacon, and saved three recipes as favorites.

He saved the first recipe while logged in to Facebook, and he opted out of having it broadcast to his friends on Facebook. He saved the second recipe after closing the Facebook window, but without logging off from Epicurious or ending the browser session, and again declined broadcasting it to his friends. Then he logged out of Facebook and saved the third recipe. This time, no Facebook alert appeared asking if he wanted the information displayed to his friends.

After checking his network traffic logs, Berteau saw that in all three cases, information about his activities was reported back to Facebook, although not to his friends. That information included where he was on Epicurious, the action he had just taken and his Facebook account name.

"The first two cases involve the transmission of user data despite 'No thanks' having been selected on the opt-out dialog, and are causes for deep concern. They pale, however, in comparison to the third case, where Facebook was receiving data about my online habits while I was not logged in, and was doing so silently, without even alerting me to the cross-site communication," he wrote in the research note.

If a user has ever checked the option for Facebook to "remember me" -- which saves the user from having to log on to the site upon every return to it -- Facebook can tie his activities on third-party Beacon sites directly to him, even if he's logged off and has opted out of the broadcast. If he has never chosen this option, the information still flows back to Facebook, although without it being tied to his Facebook ID, according to Berteau.

Berteau wasn't able to determine where this data flows to in Facebook. "That's part of the concern here," he said in the interview. He repeated the Epicurious experiment with Kongregate.com, another Beacon-affiliated site, and got similar results.

In e-mail correspondence with Facebook's privacy department, Berteau was told, among other things, that "as long as you are logged out of Facebook, no actions you have taken on other websites can be sent to Facebook."

A similar statement was made by a high-ranking Facebook official on Thursday. In an interview with The New York Times, Chamath Palihapitiya, vice president of product marketing and operations at Facebook, was asked whether Facebook would receive information about a user's purchase if the user declined to broadcast the purchase to his Facebook friends.

His answer: "Absolutely not. One of the things we are still trying to do is dispel a lot of misinformation that is being propagated unnecessarily."

Facebook didn't immediately reply to requests for comment from IDG News Service.

[Jazzylee77]

Holy crap! I don't visit facebook often, but I bet I have remember me checked. But there is no general opt out? No matter what if you are on face book you are sharing some info?

Security is so boring to me, I hate having to figure this stuff out. And yet I'm the one in the family that gets called when someones computer has slowed to a grind with hijackers and trojans.

This really sounds like a stupid way to lose users.

From Jay Goldman (http://www.radiantcore.com/blog/archives/23/11/2007/deconstructingfacebookbeaconjavascript#10000)

Beacon from 10,000 Feet

That basically wraps up our tour of how Beacon does what it does. It's a fairly long explanation, so here's a quick summary:

1. The partner site page includes the beacon.js file, sets a <meta> tag with a name, and then calls Facebook.publish_action.
2. Facebook.publish_action builds a query_params object and then passes it to Facebook._send_request.
3. Facebook._send_request dynamically generates an <iframe>which loads the URL http://www.facebook.com/beacon/auth_iframe.php and passes the query_params. At this point, Facebook now knows about the news feed item whether you choose to publish it or not.
4. The <iframe> loads a facebook_helper.html file, which lives on the partner site, and which contains a call to facebook.process_message_from_helper.
5. Facebook.process_message_from_helper parses a call to Facebook._perform_action from its own query_string and calls it.
6. Facebook._perform_action dynamically creates the toast pop-up and displays it in the bottom right corner of the window.
7. The user is given the choice of cancelling the publication (i.e.: opting-out), which will cause the item not to appear in their news feed.
And there you go! A very clever series of steps to allow for a very simple integration by partners and a neat side-step of the Cross-site Scripting security features in modern browsers.

What the hell are they thinking? I'm sure some think it's cool, but most people like their privacy.

[Jazzylee77]

one way to fix

install theFirefox BlockSite add-on
add www.facebook.com/beacon/* and facebook.com/beacon/* to the list

[minnseoelite]

good thing i dont use facebook then

[Jazzylee77]

Looks to me like, if you visit one of their partner sites, they get the info regardless... they just don't put it in a feed. We are probably all tracked in a hundred similar ways.

[rescreatu]

That was quite big news a couple of weeks ago, even saw it on the tv news here in Australia.
It just shows how far much our privacy has been taken from us. Theres not much that can't be found if you know how to use search
That's why myspace is better. :)

[almir]

Well, I have read in my local news that this issue has been fixed, and that Facebook has cancelled this feature

[Jazzylee77]

yeah, I bet your local news reporter really has a grip on cross site exploits... I trust very little tech or science reporting from the media.

[Enigmacsg]

That's why myspace is better. :)

Exactly. Facebook sucks.

[Greg-J]

To this day I have never created a facebook account or signed in using someone else's.

[Sergio]

Don't even. I won't bash it but the reasons are obvious. ;)

[Kyle]

Pretty bold. I know if I was starting a social network I would be taking a look at the fastest rising one to see what they are doing right. Facebook's technology is up there.

There is even a class at Stanford called "facebook"