top | item 3033385

Facebook is scaring me

553 points| moses1400 | 14 years ago |scripting.com | reply

270 comments

order
[+] Terretta|14 years ago|reply
I recommend Ghostery: http://www.ghostery.com/

Quoting:

Ghostery is your window into the invisible web – tags, web bugs, pixels and beacons that are included on web pages in order to get an idea of your online behavior.

Ghostery tracks the trackers and gives you a roll-call of the ad networks, behavioral data providers, web publishers, and other companies interested in your activity.

Choose to block - or not. You get control at a company level - are there some marketers you trust, but others you'd rather turn away? Ghostery lets you open the valve of your web behavior as wide or as narrow as you'd prefer.

[+] LogEx|14 years ago|reply
Ghostery and Disconnect are essential privacy tools in Firefox, Safari, or Chrome. Also try ShareNot on Firefox, which is experimental, but has somewhat more extensive blocking coverage than Disconnect.

But more fundamental: don't log in unless you have to, log in only in private browsing windows or separate browsers from your other surfing, and also clear your cookies often to keep your not-logged-in browsing cleaner from a privacy perspective.

[+] dotmanish|14 years ago|reply
I just tried it and browsed to TechCrunch.

wow.

[+] betageek|14 years ago|reply
Came across Ghostery professionally earlier this month, seems to be quite primitive in it's detection which surprised me. A site I knew to have tracking on didn't get picked up due, as far as I could see, a change in the filename of the tracking .js file. I was expecting it to track domains in a similar way to AdBlock.
[+] BrandonM|14 years ago|reply
I use Ghostery as well, but few people seem to be aware that you can also use AdBlock for this. Subscribing to the Fanboy (or EasyList) "Tracking/Stats Blocking" filter will block cross-site requests to sites like Google Analytics and Facebook just like Ghostery will.
[+] joelhaasnoot|14 years ago|reply
Another option I have installed as a Chrome extension is Disconnect.me
[+] newoffer|14 years ago|reply
How does this compare with addons like Adblock and Noscript?
[+] Cmccann7|14 years ago|reply
thanks for posting this, just installed Ghostery and it's the best thing I've done. very eye opening into what some sites are doing
[+] patangay|14 years ago|reply
I'm an engineer at facebook. I want to clear up a few things that you guys are talking about.

For starters, it's true that a visit to a news story or watching a video will trigger a feed story. The point that most people seem to be missing is that this requires you to knowingly allow a social application. For example, in my case, I installed the social plugin for rdio (rdio.com). When I listen to a song on rdio, it publishes it to my friends ticker feeds. (Ticker is the bar on the side where likes, listens, reads, etc go). There are a couple websites that are doing read social browsing, for example the Washington Post's social reader (https://apps.facebook.com/wpsocialreader/). Again, just by visiting this page you will not trigger anything unless you have already allowed the application access.

In the past I've setup my music player on the laptop to publish the songs I'd been listening to, to my IM client (as away messages) - Adium let's me do this out of the box. It's kind of the same idea, instead this is just built in to the website you visit or music you listen to.

You can also disable any application you previously installed by going to Privacy Settings and clicking on Apps and Websites. It should all be there. You don't have to log out of facebook or close your account. Just delete all your social apps. (https://www.facebook.com/settings/?tab=privacy)

[+] BrandonM|14 years ago|reply
How narcissistic must we be these days to think that our friends actually care about every little thing we do? It has apparently reached the point that we just want to share everything we're doing without applying any kind of personal filter to the stream of data we are sending out. This is silly. We're going to be swimming in a tide of noise and get sick of this whole social thing if someone doesn't slow down and consider what it is that we actually care to know about our friends.
[+] paulsmith|14 years ago|reply
Is it retroactive to apps that you've installed previously? For example, I signed in with my Facebook account on 3rd party site X and accepted the permissions, and at the time it didn't auto-publish to my feed (or "ticker" or whatever), but now suddenly it will be publishing automatically without my explicit say-so?
[+] rsl7|14 years ago|reply
I'm sure you're still storing all of that data, whether we opt-in or not. Because why throw away such valuable data?

And that means it will be made public some day, by accident or by design.

[+] 3pt14159|14 years ago|reply
So let me get this straight, only white listed websites (not apps, websites) will have content shared from them?

If that is the case this whole thing is overblown. We were all thinking that BuddyApp would be able to publish your generalized browsing. Which is terrifying for a whole host of reasons.

[+] orijing|14 years ago|reply
I am a software engineer at Facebook. Bear with me because I don't have any PR-quality answer to give you. I am not on the platform team, but I have built apps before in the wild-west days.

The app requires explicit permission from the user in order to post activities automatically. The idea, if you watched Mark's presentation, is called "frictionless sharing." A lot of people don't share because it's another step, but if they could install an app like the Washington Post Reader (a great app--even Mark has it installed), they are happy with sharing articles they've read with their friends.

I understand you might be concerned, for example if you added that app without realizing that it will post content. If you are concerned about the privacy implications, you can always change individual permissions for an app by going to your account settings, then selecting the 'app' tab on the left, or by going to https://www.facebook.com/settings?tab=applications. If you are concerned about spamming your friends' news feeds, that's why we built ticker, for the light-weight activities like "watched a movie" or "listened to a song" or "read an article".

If I remember correctly, the exact wording of the app permission request was alarming enough to get my full attention ("I, the application, can post as you" or something like that), so I'm worried less about a user missing that part. In my known experiences, the app was installed with the knowledge that it will share your experiences--because the idea is you want to share your activities with your friends. As soon as I read an article, my first action is to either send the link to specific people who are interested, or post it on my wall if I think everyone is interested.

We operate under the assumption that users will not do what they don't want to do, as long as we make it explicit what might happen. And if they make a mistake, they can always go change their settings. So I'm not so worried about users who sign up for the Washington Post Reader app, which is marketed as a social reading experiment, and subsequently complain that it shares your read articles.

You might still be concerned, in which case, please let me know why (users being misinformed?), and I'll try to pass it onto the platform folks, who were really heads-down the past few months.

[+] X-Istence|14 years ago|reply
The reason why this bothers me is that there is no longer any EXPLICIT confirmation that I want to post something. Not sure who said it but I read it in a TechCrunch article, "Just hit play in Spotify and it will share with your friends".

No, any sharing I do HAS to REQUIRE an EXPLICIT action on my part. I have to be in full control. Visiting a web site does not mean that I believe it will be interesting to my friends NOR do I want that information shared with people on Facebook.

A like button that shares, much like the Google+ 1+ button is perfectly fine, I have to hover over it, and choose my circles to share with, and then share. It is not automatic once I visit the site.

I don't want articles automatically being linked just because I visited a page, or clicked play in Spotify, or put the toilet seat up.

It is not just privacy concerns, it is the image I try to convey while using social media sites where it is common place to be friends with your boss and or co-workers. I don't need them knowing I like the Bloodhound Gang or that I read articles about atheism in the NYT but have never read a single article about religion.

Eventually all this collected data will be used against me. What if I do a simple Google search for cancer and I end up reading an article about it, that is now shared publicly, my insurance company a few years later gets a claim for cancer they claim it was a pre-existing condition and deny me coverage.

These are all scenarios going through my head. I am all for the interconnected web, and making it easier for me to introduce my friends to new content across it, however it has to be done on my terms, it has to require explicit authorisation and must never do something automatically without my consent. If I like the content enough I am extremely likely to copy and paste the URL into my social networking sites, I don't mind that extra step. Create a bookmarklet that fills in some of the forms ahead of time for me (I have a reddit bookmarklet that fills out title, URL and the sub-reddit to post in (personal one for me to share links with friends)). I am more than happy to continue using the platform, but this frictionless sharing scares the crap out of me, and will see me closing my account sooner rather than later if it continues down the path that it looks to be going down.

[+] gfodor|14 years ago|reply
This is bogus, and a slight of hand meant to further erode privacy while giving Facebook an argument to fall back on other than "it's in our interest to post everything you do into our stream."

The bottom line is that what is actually going to happen here in the real world is that people are going to connect their Facebook account to these web sites, not realize or forget (yes, people forget these things) that this web site has been given the keys to the castle to post whatever it wants on their behalf, and a ton of shit is going to get posted to the internet that was beyond the intent of the user originally clicking buttons just to get past an annoying confirmation dialog.

That said, the people fighting against this are fighting a losing battle. Facebook is basically going to control the world unless someone comes in and tries to beat them at their own game and impose their own vision of how and when information like this should be shared.

[+] damoncali|14 years ago|reply
We operate under the assumption that users will not do what they don't want to do, as long as we make it explicit what might happen. And if they make a mistake, they can always go change their settings.

This breaks down with the deluge of snippets of information, voluminous and arcane privacy settings, and the increasingly complex and cluttered UI. It's simply impossible for a normal user to keep up with.

Frankly, it's this assumption that makes Facebook untrustworthy. Perhaps you should assume that your users value their privacy. Asking for forgiveness rather than permission works for startups, but facebook is not a startup any more. Facebook has the users. They should start acting like they want to keep them.

[+] mapgrep|14 years ago|reply
What ever made you think anyone would want this functionality, other than the sleazier, spammier publishers?

Why would any person _ever_ want to automatically broadcast on Facebook the URL of every web page they read on a particular site? What is the benefit, to them? "How do I publicize a big chunk of my browser history" is not a problem any real person has.

The problem with this feature has nothing to do with disclosure or opting out. It's that it seems designed SOLELY for the benefit of publishers, who get more clicks and promotion, and of Facebook, which gets more social content.

[+] paulsmith|14 years ago|reply
> And if they make a mistake, they can always go change their settings.

That is a really bizarre response. If a user makes a "mistake" and unwittingly publishes something embarrassing or damaging to their feed because Facebook made that transaction possible, the damage is done.

[+] esrauch|14 years ago|reply
I really have 2 quarrels with this; the larger one is that it shouldn't be acceptable for the behavior to change so radically without reauthorizing these apps. There should have been a separate permission for "automatically post without my action" which was turned on, and then let people enable it if they want.

The second quarrel concerns the design of the page that you linked to. I just checked the link that you sent, and I had about 50 entries, about half of which I don't remember adding and absolutely all of them were "more than 6 months ago" (in reality, some of them were more than 4 years ago).

Using your link, it was multiple clicks with a ~5s delay in the middle to remove a single entry. If you click a second X without waiting for the first response to pop up and click ok, it doesn't visually remove the original thing you X'd meaning you can't just go through and click all the X's.

No way to remove multiple entries at once. To remove all of the entries that I don't want took me something like 5 minutes, which is completely absurd. I have always been in general opposed to facebook apps so the average recent college grad could easily have something on the order of several hundred of these entries.

For anyone who knows anything about UX, it is fairly obvious that the page was explicitly designed to prevent people from removing apps. It is depending on a "laziness" factor to get people to do things that they actively don't want to do, which is horrible. It appears to be deliberately only removing the entry when you click ok on a delayed dialog even when the client side is 100% is sure that the entry is removed (click X, click another X without waiting for the dialog, the first item X'd will stay in the list since you didn't wait for the confirmation). Either a huge UI bug or a deliberate and unethical UX decision.

My issue with facebook is not at all what features they have or what privacy settings they have. The issue is that they deliberately use underhanded tactics to get their users to do what they want them to do. In the past they would change your privacy settings without telling you, and in this case they are using a privacy setting that meant one thing in 2007 to mean something very much different in 2011.

People who aren't as technical as you and I won't even think to look for the page that you linked to to begin with. In fact, people who aren't as technical as you likely won't even realize that the reason that these stream posts are showing up is because they clicked some facebook button on a website 4 years ago.

[+] Angostura|14 years ago|reply
One of my Facebook friends posted a link to a story from The Guardian yesterday, I thought that was interesting so I clicked to read.

The Guardian pretty much demanded that I installed their app. In the end, clicking 'cancel' turned out to be the non-intuitive way to actually read the article.

Yes 'cancel' let me continue with the action that I had been attempting.

[+] techiferous|14 years ago|reply
I'm curious, was there any user testing done? It seems odd to me that someone would actually want something shared automatically that they simply read. I understand wanting to make user interfaces more streamlined, but reading something and sharing something with your friends are distinctly different activities.
[+] Retric|14 years ago|reply
Thanks for posting that, I have often wondered how Facebook could make such horrible usability decisions but it really seems like you guys have little understanding of why someone would want to use your service. 'You' had a relative spam free replacement for email and wasted that huge opportunity by letting random apps spam the channel. I don't want to share that type of crap not because I care about privacy, but because I don't want to waste the time of people reading my activity feed.

PS: I understand a huge part of FB's appeal and page views is the stalker aspect, but just think of all the people that would love to be able to flag all farmvill traffic as spam or simply ignore all posts by apps.

[+] brandnewlow|14 years ago|reply
It's a problem because you guys keep trying to push us closer to sharing being opt OUT.
[+] Vaotix|14 years ago|reply
Interesting post.

While I have nothing against making it easier for people to share their lives or interesting things they come across, I want these things to be opt-in, not opt-out. Facebook has a history not really giving a crap about user privacy. And honestly, Facebook isn't a company I want to trust very personal information to. That's why my FB profile is pretty much only bare bones stuff and a few pictures.

I prefer Google's approach with G+ - your information is only shared with those who you explicitly allow sharing to. And they never automatically share something. You're in full control. If you're making an online identity, that's the way it should be. There shouldn't be opportunity for things to get out of your control. And I fear that the general public won't realize this is an issue until it's too late.

I'd like to point to another article that was posted here earlier: http://public.numair.com/2011_fbfool.html

Now, you can just dismiss the guy as bitter or whatever, but he does have a point. Facebook isn't the company you'd want managing your online identity. I have no problem with competition, but I have issue when one of those competitors acts sketchy and doesn't have the users' best interests at heart. It's even worse when the people either don't care or don't realize it.

[+] gorm|14 years ago|reply
> If I remember correctly, the exact wording of the app permission request was alarming enough to get my full attention ("I, the application, can post as you" or something like that), so I'm worried less about a user missing that part.

Users don't read such messages, they press confirm buttons. Even if they read them most users will not understand the implications. It would be interesting to hear if you have done any user surveys related to this.

[+] edoloughlin|14 years ago|reply
A lot of people don't share because it's another step, but if they could install an app like the Washington Post Reader (a great app--even Mark has it installed), they are happy with sharing articles they've read with their friends

I can't see the logic in this. I don't know if I want to share something until I've read at least some of it. I don't want it shared as soon as I open it in my browser. There should be another step...

[+] frankdenbow|14 years ago|reply
Others have brought up the privacy concerns but for me the other issue is this: a share is an endorsement and if I havent had a chance to evaluate the content, I am endorsing it blindly. I may read an article and think it sucks so I wouldnt share it.
[+] charlieok|14 years ago|reply
My criticism applies to users of the feature as well as developers of the feature. You wrote:

"As soon as I read an article, my first action is to either send the link to specific people who are interested, or post it on my wall if I think everyone is interested."

In such cases, you are deliberately being selective in your sharing. I think this is as it should be.

Everyone is overloaded with information now, and one of the best ways to deal with that is to be good filters for our connections. This implies being selective in what you send, rather than broadcasting a high volume, low signal-to-noise ratio because doing so is "frictionless".

The more people act as good filters/routers of information, the better signal-to-noise ratio we'll all get.

[+] zb|14 years ago|reply
As soon as I read an article, my first action is to either send the link to specific people who are interested, or post it on my wall if I think everyone is interested.

Really? You've never read an article that you didn't feel compelled to share with somebody? Ever?

[+] paul9290|14 years ago|reply
Ok... i'm miffed, as Facebook has embarrassed me twice this week!

First when I created a new list called "Hotties I still want to X." I thought only I would know what friends were going to be added to this list. Unfortunately, that isn't the case, as Facebook sent a notification to each person on that list. That was very embarrassing, thanks a lot Facebook!

Second is when I downloaded Spotify. The ease of use of installing and starting to enjoy music was great. So much so that when I chose to play my first track I forgot Facebook was notifying my friends what song I was listening to(one i want to keep private due to ex-girlfriends)!

Thanks again Facebook! You have embarrassed me twice in one week! ERRGGGghhhhh!!!!

[+] badclient|14 years ago|reply
I recently decided to RSVP for a meetup on meetup.com. It was a meetup I don't, in fact, want most folks I know to know about. I made sure to use my junk email account that doesn't have my name tied to it.

So I was scared shitless when after RSVP'ing I see faces of all my facebook friends and an offer to invite them. I always thought you had to do the whole facebook connect crap before websites could just splash your fb friends list at you? Then I thought about all the billion different ways facebook has to integrate them into your site and figured this must be one of the ways.

[+] Bo102010|14 years ago|reply
I ditched Facebook this morning when I realized my carefully-constructed "Don't show this part of my profile" list was wiped out in the last redesign.

I've always thought the complaints people make after each redesign were simply resistance to change, but this time it doesn't seem worth it to continue.

[+] nextparadigms|14 years ago|reply
If people think Zuckerberg had "vision" doing this, I suppose I agree. But his vision wasn't "how can I help people have better online connections and experiences?" or anything like that. His vision was "how can I get people to share everything about their life, so Facebook can make more money?"

They are not one and the same thing, because in the latter, the priority is put on optimizing the experience for Facebook, not for the user.

Zuckerberg actually believes that there should be no privacy - at all. This is where he's leading Facebook. I believe that's a flawed vision, but he's probably sticking to it, because the less privacy you have, the more it helps the company.

[+] codeup|14 years ago|reply
The apologetic posts by Facebook engineers give deep insights.

Of course they can argue well on what are, for average users, technical details. On that level, it is possible to get entangled in endless discussions.

The real problem is that these posters seem to totally lack (or ignore) an understanding of the bigger picture of what they are contributing to.

[+] codecaine|14 years ago|reply
I think Ghostery deserves some promotion here : http://www.ghostery.com/ available for all major browsers. It blocks near to all webbugs including the facebook social plugins.
[+] suprgeek|14 years ago|reply
A good time to point out the Ghostery Browser extension. Use this at the most paranoid setting so that when FB and others pull stunts like these you have at least some measure of protection.
[+] sneak|14 years ago|reply
Logging out doesn't necessarily disable the tracking, though, as the cookies are still there. You could delete them, but I bet the like buttons reset new ones, which correlates your history to you the next time you log back in.

Much better is to just nullroute their netblocks at your router. That's what I do.

[+] zerostar07|14 years ago|reply
As always Winer is worried, rightfully so, but people aren't going to log out of facebook. It seems Zuck really wants to get back at people for making him pull "Beacon" back then, so he reintroduced it. Of course it's a privacy concern, but i think people no longer have illusions about their privacy on facebook.
[+] stfu|14 years ago|reply
Oh, so Facebook already sent their minions to HN? That was fast! Lately the negative stories are gaining a bit of a momentum. Very much like that development.
[+] kragen|14 years ago|reply
I've been logging in to Facebook and Google+ only in a Chrome Incognito window for this reason for a while now. I recommend the practice to everyone.

However, yesterday Facebook locked my account because I was browsing "from an unknown device" (the netbook I've been using for years, on the IP address of PyCon Argentina). I unlocked it by identifying five of my Friends from 15 photos. So it's not without its drawbacks.

[+] random42|14 years ago|reply
One of the good way to make general users/facebook realize the privacy concerns of auto-sharing, if popular Porn websites install the FB like buttons.
[+] molecularbutter|14 years ago|reply
LOL at all the facebook employees who are chiming into this thread (and others) to defend the latest creepery from their professionally invasive advertising company. I know you're just waiting for the IPO to cash in, but come on, how can you defend this nonsense?
[+] nikcub|14 years ago|reply
Logging out of Facebook does not do enough. It still retains cookies that specify your account ID even after you logout.

You need to delete all of the Facebook cookies. Here is what cookies are retained, but you can test it for yourself to see.

While logged in:

   datr, lu, openid_p, c_user, sct, xs and act 
act is your account number. now a new, fresh request after hitting logout still sends the following cookies:

   datr, openid_p, act, L, locale, lu, lsd, reg_fb_gate, reg_fb_ref
If you do not delete cookies Facebook know and can track every user that has ever logged in at your computer.
[+] wedesoft|14 years ago|reply
I can recommend Fanboy's "Annoyance Block List". It will block requests to Twitter, Facebook, ... unless you are opening one of their sites directly.

(*) http://www.fanboy.co.nz/adblock/

[+] mike-cardwell|14 years ago|reply
RequestPolicy users are protected against this entire class of problem. When I'm looking at a webpage, I know it isn't pulling in content from any other site, including Facebook, unless I specifically allow it to.
[+] dasil003|14 years ago|reply
This is the wild west and Facebook is doing a land grab.