Hacker News new | ask | show | jobs
by throwawayosiu1 2695 days ago
While the user might have issues (like cookies and other features) - I can guarantee you Facebook does all kinds of creepy stuff to identify who you are. Worse yet, once they think they've successfully identified you - they share your details with who they think you are. Personal example:

Recently I wanted to have a look at a few ex coworker profiles (who are not my friends on FB). I didn't want to use my personal account because then it suggests me to them (something I wanted to avoid, as I'd not been in touch with them for almost a decade).

1. I created a VM (Ubuntu 18.04 + Firefox + uBlock -> enabled everything in uBlock).

2. Tried to create an Fb account -> asks for phone number. I didn't want to be identified so I could not continue.

3. Tried another way to create a new account -> success.

4. Fb obviously tried to figure out who I am -> was unable to do so at that point -> Forced me to post a picture of myself (and suspended my account until I did and they verified it).

5. Posted a made up picture and got past the first hurdle

6. Fb asked me for a phone number -> Logged out and used another means to log in.

7. Fb locked my account and asked for another picture (did similar in Step 5 once again)

8. Looked up my ex co-workers.

9. Until now, I've not been identified, I looked up a friend's profile (this friend is also my personal friend on Fb). FB immediately identified me and showed up my entire friends list as suggested friends).

10. I immediately tried to delete that profile (took 30+ days and they asked for Govt ID).

I've had multiple fake FB accounts, and FB's fingerprinting and data sharing is insanely crazy - I recently logged out of one my fake accounts on iOS via Safari Incognito (no FB app, Safari is always used as incognito) - it showed my personal phone number in the log in field.

2 comments

You'll need to change your IP as well. Something you have never logged in as to create the account. Sock puppet accounts can be associated by IP and social graph searches.
I used VPNs. But FB keeps a track of a lot of public VPN & Cloud providers and then throws a ton more "captchas" your way - asking for your picture, govt id, phone number verification etc.

As for searches - I've searched a lot of random stuff totally unrelated to my personal account JUST to throw FB off while acting like a real user (liking, reading, scrolling etc.).

It only takes one to five high probability data points to link you to the original identity near flawlessly. Something rare. Clicking on a nonpublic person is one of those.
You can use disposable phone numbers to receive text messages
FB blocks those numbers, I've tried those in the past. Almost all major services that use phone verification ignore those numbers out right or act like they accept it but either:

1. don't bother sending texts

2. shadowban you

I've had some iffy experiences doing that with FB, Google and Azure.

Azure wouldn't even let me use my actual main number because it happens to be a google voice number and they actively block voip numbers (seems they look up the CLEC info somehow).