1043

By now, everyone who follows technology should be aware of the scandals around Facebook's ethics and data privacy. Many users distrust them and are uncomfortable with their data collection practices.

Even Stack Overflow CEO and cofounder Joel Spolsky has quit Faceboook.

Both Twitter and Facebook’s selfish algorithms, optimized solely for increasing the number of hours I spend on their services, are kind of destroying civil society at the same time.

Joel also previously said:

Facebook's fatal flaw is that they think they're smarter than the rest of us, so they always think they can get away with things

Unfortunately, Joel's own company is now letting Facebook "get away with things". Stack Overflow directly links to profile pictures from Facebook. This allows user activity throughout the Stack Exchange network to be tracked by Facebook without consent or notice.

Have a look: when I load a page containing any avatars hot-linked from Facebook, my browser automatically sends a request including a Facebook identifying cookie and the URL of the page I'm viewing on Stack Exchange. They don't just know that I'm visiting the site, they also get to know which topics I'm interested on throughout the network.

Screenshot of Firefox developer tools showing HTTPS request to Facebook for a user profile image, with Referer header identifying the current Stack Exchange URL

Personally, I am protected because I enable Strict Content Blocking in Firefox, but that shouldn't be necessary, and it clutters my page with error icons where the avatars should be.

Related Discussions

11
  • 35
    graph.facebook.com added to ban list. They'll probably wonder why I dropped off the planet.
    – Joshua
    Commented May 11, 2019 at 3:07
  • 52
    I have had graph.facebook.com blocked for a while. Breaks profile pics, but it isn't the worst loss. There's a feature request on MSE from 2013 requesting FB profile pictures to not be loaded directly from the FB CDN. If implemented, it would also fix this bug. Commented May 11, 2019 at 11:08
  • 3
    If you want to prevent this, you can use Firefox developer.mozilla.org/en-US/docs/Mozilla/Firefox/Privacy/…
    – Braiam
    Commented May 12, 2019 at 17:42
  • 3
    Highly recommend Pi-hole in combination with these block-lists
    – leonheess
    Commented May 13, 2019 at 11:26
  • 44
    This isn't just SO but the whole bloody internet and GDPR didn't fix it. You have to block 3rd party cookies in the browser.
    – Lundin
    Commented May 13, 2019 at 13:20
  • 13
    @LightnessRacesinOrbit The corresponding question on MSE has been repeatedly bountied for almost two months now, but no reply there either. I'm genuinely confused: this seems like a trivially easy thing to fix (modulo some caching issues nobody will care about), the community is very upset, and this issue amplifies the privacy concerns that people have about ads. Strategically, it seems like a cheap win of the sort the company could really use right now. Why haven't they done anything? Commented Jul 23, 2019 at 17:44
  • 1
    @Michael Facebook themselves provide a precedent: they happily cache preview images for pages that are linked to, at higher resolution than Stack Overflow's user avatars, without any prior relationship with the copyright owners. Their Platform Policy also says "If you cache data you receive from us, use it to improve your app’s user experience and keep it up to data", and doesn't prohibit anything like this. Commented Jul 23, 2019 at 19:53
  • while they take action, here's the simplest solution that I can think of: superuser.com/questions/220696/…
    – user7401700
    Commented Jul 24, 2019 at 6:51
  • 8
    Removing this from featured; as there are current events that need that second spot; and if the company hasn't been briefed on this by now, I'm not sure holding up one of our two featured spots is the way to make sure they see it (also, I'll reach out on Chat and get confirmation that a company representative has seen this post). --- Edit: I've received confirmation that members of the community team (Shog9 and TimPost) have seen it; I understand they may be formulating a response.
    – George Stocker Mod
    Commented Jul 24, 2019 at 14:30
  • 1
    @DavyM Due to the number of votes and views the question has, the community is well aware of this issue.
    – George Stocker Mod
    Commented Jul 24, 2019 at 16:31
  • 8
    @GeorgeStocker From the perspective of a user who can't see deleted posts it seems like the official response has been retracted and the comment section under this question cleaned up without any other information replacing the response. Has there been information about whether there is a new response coming and why the other one was deleted? Because right now it looks like the issue will simply be ignored by SE, now that there is no more attention to this question after it's been removed from the [featured] part of the community bulletin...
    – Secespitus
    Commented Jul 27, 2019 at 19:40

5 Answers 5

175

Seeing as there's no official answer by the Network, I thought I'd pipe up and write a general answer on how users can protect themselves from this type of tracking and basically what I regard as privacy invasion.

I've done some study/research on this and there's nothing private about the internet. Google and other sites also do this. Many companies have been forced to clean up their ways to an "extent". Most end users are ignorant of what is being done with their data and the risk associated with what these sites view as non-PII (personal identifiable information) and how, in fact, the data can be matched (too long to get into) to reveal specific user details (including PII) without the user being aware.

I manually select which cookies I'll accept on each site I visit. I have third-party cookies blocked and my browser set to remove cookies (with my selected exceptions) when I quit. I go through my cookies whenever I quit my browser and have been on new sites, or sites where I know the cookies are not removed when I quit, and I manually remove them. I can do this many times a day. I also closed all my social media accounts. Beyond this site having my real name, I'm entitled to my privacy and take it seriously. I prefer to have console errors or a page not to render properly than be tracked and harvested for money.

I also use an ad blocker and have for a long time. Some sites won't allow you to view pages with this active. If I'm desperate to see something I'll allow ads on that page. Websites are entitled to raise revenue, but I don't have to visit there.

Fun fact: Google was trying to patent the collection of user data few years back. Seriously! I use Google products, but with full awareness of what they do and regularly clear my usage histories. And as for Twitter et al, they're not better. All these sites are data mined for non-PII and put together and this data is utilised and sold. Sometimes information ends up on the Dark Web for sale. It's one of those things. Live your life so there's nothing you do that you will not be concerned about becoming public. Or do not use the internet.

Fun Fact Two: I live in Australia and not only is our internet appalling, but our government shows a flagrant disrespect for basic human rights, including the right to privacy.

13
  • 18
    Could you tell us more about your browser configuration and extensions you're using to protect your privacy online/handle this ? I personnally use Ghostery, uBlock Origin and AdBlock, but sometimes, I have the feeling that is not enough.
    – Toodoo
    Commented May 13, 2019 at 14:42
  • 1
    @Toodoo I don't know Yvette's setup, but Firefox (with 3rd party cookie blocking) in tandem with uBlock Origin and judicious use of Ghostery (without the data sharing option checked) is probably mostly adequate.
    – TylerH
    Commented May 13, 2019 at 14:53
  • 10
    I also use Privacy Badger to block tracking cookies.
    – SeinopSys
    Commented May 13, 2019 at 14:54
  • 12
    I really appreciate this answer because 1) It gives actionable advice for people who want to care more about their privacy, and 2) It paints a realistic picture about how to reasonably make some changes without giving false hope that they'll make you completely anonymous and untrackable on the internet. Thanks Yvette for taking the time to write this up.
    – Davy M
    Commented May 13, 2019 at 15:10
  • 10
    @Toodoo I use AdBlock Plus. I use chrome on a mac, block third party cookies, have my browser set to remove cookies on quit, but actually manually check the cookies after quitting, as mentioned. This has been enough. The mac is much better than Windows in terms of malware, etc getting silently downloaded onto the machine and then doing damage. Much of the malware will damage a Windows machine, but have no effect on a Mac. I disable background downloading and all automatic downloading, have my camera covered and most settings blocked, with exceptions. ...1
    – user3956566
    Commented May 13, 2019 at 15:10
  • 7
    2... I've tried other browsers, but Chrome is the easiest, as there's some extensions that are really helpful for grabbing citations from peer reviewed papers and will allow me to login to academic sites using my uni login.. it's the devil I know. So I'm conscious and aware of what Google does with our data. I have a keen interest in Social Media and IT security, which is why I wrote an answer. It's hard to condense it, but hopefully it will help some people who weren't the wiser. Many people here already know much of this.
    – user3956566
    Commented May 13, 2019 at 15:12
  • 20
    re "there's nothing private about the internet": Little bit of history with regards to the internet: it wasn't designed to be private. The internet was designed as a method for scientists to share information. No one really foresaw the environment it currently operates in when it was first created.
    – Travis J
    Commented May 13, 2019 at 17:55
  • 2
    @TravisJ so this is one big science experiment? I hope we will learn something from it ...
    – rene
    Commented May 13, 2019 at 18:22
  • @Toodoo I can recommend github.com/Cookie-AutoDelete/Cookie-AutoDelete to remove all not whitelisted cookies from any site when you close the window/tab Commented May 14, 2019 at 2:06
  • Manually combing through cookies? Ain't nobody got time fo dat! I just have UBlock installed. No ads, I'm good. I don't care about companies knowing what sites I visit, if I'm not going to see their ads. That data is useless bloat in their database :D I think the virus argument is a little outdated nowadays. If you have a antivir and take some care in what sites you visit, and what you download, you're good. I haven't had a virus in years, even though I'm no stranger to the buccaneer's cove...
    – Cerbrus
    Commented May 14, 2019 at 7:47
  • 2
    Fun Fact Three: Firefox is going to follow Safari trend by blocking all third-parties cookies by default: theverge.com/2019/6/4/18650363/…
    – Cœur
    Commented Jun 6, 2019 at 2:25
  • I use uMatrix for domain blocking (because it is more pleasant to use than uBlock). Then i use uBlock Origin exclusively for filtering out unwanted content (hint: eg. the :style(...) rule does the trick). For complete removal of elements from the DOM i use Tampermonkey. And when even Tampermonkey fails (eg tweaking CSP meta tags on https sites), then i use mitmproxy. If the site uses HSTS, then i delete that data in the browser settings, see How to clear HSTS settings in Chrome and Firefox.
    – user1658543
    Commented Jul 24, 2019 at 12:46
  • @Cœur AFAIK, it's only known trackers. Yep, in the article says it, only known trackers by disconect.
    – Braiam
    Commented Jul 24, 2019 at 15:16
57

Firefox has an answer in terms of containers, sandboxing a group of URLs so their cookies remain within that group/container.

There is an official extension available that lets you create custom containers, in this case have a unique container for each of the Stack Exchange websites. https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/

3
  • 20
    I'm baffled that this answer has a negative score, but Yvette Colomb's, which is part "here are some vague tips" and part "yeah, the internet sucks", currently has a score of 89.
    – IMSoP
    Commented May 17, 2019 at 15:29
  • 10
    However, in the case of Facebook specifically, there's a different extension worth considering, for explicitly isolating everything-Facebook from everything-not-Facebook: addons.mozilla.org/en-GB/firefox/addon/facebook-container
    – IMSoP
    Commented May 17, 2019 at 15:30
  • 1
    I tried this addon a while back and it was fantastic. However there were serious flaws that led me to not using it anymore. The biggest was that switching between different releases channels of the same browser (ie. from Release to Nightly) would completely screw up the container save data. Now Firefox 67 is set to have different profiles for each release channel so that this sort of data contamination doesn't happen, so this may be resolved. I also wonder forget how this addon works with FF Sync (I think it syncs one container's data). I may switch back to it again.
    – Pluto
    Commented Jun 7, 2019 at 21:29
40

"Stack Overflow directly links to profile pictures from Facebook, which allows Stack Overflow users to be tracked by Facebook - even if we don't have a Facebook account."

First paragraph of the cookie policy:

If you use the Stack Overflow Network, both Stack Overflow and third parties will use cookies to track and monitor some of your activities on and off the Stack Overflow Network, and store and access some data about you, your browsing history, and your usage of the Stack Overflow Network.

They don't just know that I'm visiting the site, they also get to know which topics I'm interested on throughout the network.

Later in the cookie policy:

Customize the ad experience for our users, including tailoring job and display ads to the technologies a person has previously looked at, the communities a person has visited, and the job ads a person has already seen.

Not saying I support the policy, but to answer your question, it doesn't seem like SO is trying to hide this. Unless I'm missing something, the behavior you described seems to be sufficiently covered by the above.

7
  • 57
    The policy you've quoted does discus tracking activity data, but I interpreted that as meaning collection for Stack Overflow's own first-party use, and the User Preferences page seems to support this: "Stack Overflow never sells or shares your activity data with third parties". I don't think they're trying to hide anything, but the risks of hot-linking the avatars from an untrusted service like Facebook may not have been fully considered. Commented May 13, 2019 at 18:21
  • 4
    I'm concerned too, but this whole post drives home the point of "If you're not paying for the product, you are the product". User analytics and what they are interested in at the time as a means to tailor ads is the defacto way money is made for free sites. Commented May 13, 2019 at 19:24
  • 78
    It’s obvious that we are the product for Stack Overflow. We participate in that willingly. That doesn’t mean we want to be the product for every third party site on the Internet, too. @black
    – Cody Gray Mod
    Commented May 13, 2019 at 19:27
  • I have removed the reference to the cookie policy from my post, because it was secondary and more speculative. Commented May 14, 2019 at 1:37
  • 8
    You're misunderstanding the policy. "customize the ad experience" has to mean ads on-site, and AFAIK, SO doesn't get any ads from Facebook - they get them from Google. The FB cookies only exist because of the graph API, and it looks like an unwanted side-effect. There's no full FB trackers on the site itself, meaning the FB cookies aren't used for on-site ads or intentional on-site analytics, therefore falling outside the cookie policy. Commented May 14, 2019 at 7:22
  • 7
    I am paying for the product in time. I've easily had weeks where I've dedicated 10 to 20 hours answering questions. People visit to get answers. It's a joke but maybe SO should give non-tracking credits. Get an answer upvoted or marked as accepted and tracking is turned off for N days since arguably I paid them by giving them more content. Even asking an on topic question is arguably paying in time. Only users who just view the site are not paying.
    – user128511
    Commented Jun 6, 2019 at 3:53
  • 4
    It’s obvious that we are the product for Stack Overflow. We participate in that willingly. We are by creating the content. We shouldn't be exploited for more than that. Let alone in such a hideously hidden way..!
    – TaW
    Commented Jul 24, 2019 at 8:17
22

This is a clear violation of the EUs 'General Data Protection Regulation'. Any EU citizen can sue both SO and Facebook for the privacy breach (even if unintentional). Facebook in response to (GDPR) closed its Ireland datacenter to avoid the regulations, and announced "GDPR for all", which is an opt-out program for its members only. Any non-associated person/non-optout-id is fair game.

16
  • 1
    The implications for SO as far as I know(no EU servers) is almost non-existent, not that the legislation(and pending lawsuits) has no bearing, only that, for the most part, US companies exempt themselves from foreign laws.
    – user10316640
    Commented Jul 24, 2019 at 5:17
  • 2
    No laws are broken, as you basically gave SE your permission the moment you registered an account on this site.
    – Cerbrus
    Commented Jul 24, 2019 at 6:56
  • 12
    No. One can't give permission to break the law. You can't e.g. give permission to a killer to kill you etc.. - The portions of the registration that break a law are nil.
    – TaW
    Commented Jul 24, 2019 at 8:19
  • 9
    @Cerbrus I wouldn't be so quick with that. Recently a regulatory agency here has for instance ruled embedding a standard facebook like button or pixel (which works the same as facebook avatars wrt. tracking) illegal, regardless of any consent. Also I fail to find the part in SO's privacy policy where I agree to have my SO viewing habits monitored and comercially exploited by FB. I don't know the opinion / guidance of the UK regulatory agency which SE seems to fall under but I wouldn't take a catchall "You agree to anything by signing up" for granted in any way.
    – Magisch
    Commented Jul 24, 2019 at 8:50
  • 2
    @TaW: Unless the law specifies that the user can give consent. That'w what this whole GDPR is about: You can't use a person's information unless they explicitly consent. Accepting the site's terms when you sign up is explicit consent, and I'm pretty sure this is covered in there.
    – Cerbrus
    Commented Jul 24, 2019 at 8:55
  • 16
    @Cerbrus Explicit consent means you need to know every party that uses your data or has access to it, you need to know what they use it for, and it needs to be a seperate and required part of reading. You can't simply make a checkbox that says "By signing up you give us consent to share your data with third parties for any reason" and more specifically, Stack's Own privacy policy says they can't do this, or at least, I haven't been able to locate a place where they say they could.
    – Magisch
    Commented Jul 24, 2019 at 9:24
  • 15
    @Storm Clearly SO is doing business in the EU, it has 2 EU subsidiaries, EU employees and EU customers. It is certainly subject to GDPR and it certainly can be brought to court in Europe.
    – Sklivvz
    Commented Jul 24, 2019 at 16:53
  • 3
    I won't say whether or not users consent to SO using their data, @Cerbrus, as I'm not by any means an expert on the relevant laws, or on what does and doesn't constitute consent in this situation. I will say, though, that creating an SO account does not by any means count as explicit consent for Facebook to use your information, except possibly in the case where you register with a Facebook account. Commented Jul 24, 2019 at 19:58
  • Fun fact: When GDPR came into effect SO has posted a blog wholeheartily embracing it.
    – TaW
    Commented Jul 24, 2019 at 21:37
  • 2
    @Cerbrus - no, "Accepting the site's terms when you sign up is explicit consent" is exactly what GDPR prevents. Consent is VERY restrictive under GDPR. It must be OPTIONAL and the user must be able to continue with the service or contract without giving it. Anything in the terms and conditions is irrelevant under GDPR, as is anything the user must tick to continue. By creating an account you give SO the right to process your data to the minimum extent necessary to reasonably operate the service (plus fulfil their own legal obligations etc) and nothing else, no matter what the T&C say. Commented Jul 26, 2019 at 8:47
  • 1
    Thank you for repeating what others already said, @StuartWhitehouse.
    – Cerbrus
    Commented Jul 26, 2019 at 8:48
  • How is everyone so sure that facebook does indeed track you if you access an avatar from its servers? Because 1) I don't think that they are allowed to. And 2) even if they are, we shouldn't just assume that they do, but at least make that assumption explicit. 3) if facebook doesn't track you when you access an avatar image then nothing here is "a clear violation of the GDPR".
    – Michael
    Commented Jul 27, 2019 at 17:51
  • 2
    @Michael, Facebooks entire business model is based on data collection. Let us assume the data collection is GDPR complaint. They are tracking at least IP and HTTP header information on every hit to their website, since this is required to trace attacks. The data is then anonymized, on every conceivable metric to produce statistics, as per Recital 162. These statistics are later correlated together, with an individual consented to tracking method, and voila additional data points on you, based on probability statistics.
    – user10316640
    Commented Jul 29, 2019 at 17:53
  • 1
    Consent in GDPR means, that you need to give explicit separate consent, if the data collection is not a part of the service that clearly cannot be separated. In addition you can retract your consent at any time. The site owner may not make the use of the site depend on consenting to something, that is not neccessary to use the site, i.e. closing a account because the user retracts his consent to being tracked is not allowed. This does apply to any site, that has users in the EU, they do not need to have a subsidiary there (on the other hand: It will be more complicated to sue them then).
    – allo
    Commented Jul 30, 2019 at 8:41
  • 3
    Presented without comment, a potentially relevant recent ruling from the Court of Justice of the European Union: engadget.com/2019/07/29/… Commented Aug 4, 2019 at 16:01
-2

I have a local Squid proxy installed on my laptop, desktop and on a remote server. Browsers are configured to open in incognito mode by default.

I use Firefox focus on my smartphone, which keeps a clean browser. I also refrain from surfing when not connected to a WiFi network (Android only allows proxies in WiFi connections, and Firefox focus has no independent proxy settings).

When my smartphone joins a WiFi, I have Connectbot constantly maintaining a SSH link to my server, tunneling to the Squid proxy.

The Squid proxy just silently drops anything that hasn't been whitelisted explicitly. I created a php page that monitors the Squid log and creates links to whitelist a host in 1-click. This page is opened in Chrome.

This setting is not for everyone but I got used to it. I have been using this for years now, there are 9'000+ hosts whitelisted in my Squid.

It's the only way I found to still visit "collaborating" websites (such as *. stackoverflow.com) with a minimal civil disobedience.

Oh, and yes, browsing is always so much faster on my smartphone/laptop that I'm regularly shocked when I see someone else trying to surf...

8
  • 1
    Good measures. Not everyone would make the effort though, I guess. Commented Jun 14, 2019 at 15:24
  • 17
    Don’t look up the satellites might take a photo Commented Jul 24, 2019 at 0:54
  • 2
    @MattDouhan, there is no need, You have already given away any, and all privacy claims to your self and your likeness.
    – user10316640
    Commented Jul 24, 2019 at 4:02
  • 1
    Cool. Where can I download the whitelist? Commented Jul 24, 2019 at 8:50
  • 3
    Android only allows proxies in WiFi connections - eh, not really. Apps such as Drony wrap proxies into a VPN connection, which can be used on any type of connection. Commented Jul 24, 2019 at 8:59
  • 1
    Say your name, Try to speak as clearly as you can, You know everything gets written down ...
    – CD001
    Commented Jul 24, 2019 at 14:33
  • 1
    Nod your head, just in case they could be watching Commented Jul 24, 2019 at 16:50
  • 6
    @GeorgeRobinson I doubt anyone who cares about his right to privacy would publish years of browsing history online. Commented Jul 24, 2019 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .