[Caerus]

Facebook does the same thing and it's just as creepy.

I closed my "real" account around 2011. A few months back I created a new blank account because I needed access to a couple organization's pages. The only information on that account is my name (a fairly common one) and an email address which is different from the one on my original account. It's possible they have some geographic info linking the two accounts as I closed and opened them from the same city.

90% of the "people you may know" are correct and from dramatically different social groups. Some how it's picked out a girl I did a family stay with in Germany in '04, a fourth cousin I'm only vaguely aware of, current friends from several groups, and high school friends I haven't talked to in 10 years.

[vidarh]

I set up a test Facebook account while doing a Facebook app that uses an e-mail address that has never been used for anything else.

Yet it keeps suggesting people I actually know.

The second account also does not have my full name (if it had my full name it'd be less weird, as my name to my knowledge is globally unique - there's only a few hundred people with my last name worldwide)

The account has not been used for anything related to me. I've never searched for anyone from it. Never given my e-mail address there...

The only thing connecting the two is that the "fake" e-mail address is a "[e-mail]" address, and that I've logged in to them from the same machine.

It took less than a day before that account started getting friend requests from people I know (clearly the "TEST" instead of my surname did nothing to dissuade them)

[nthj]

> The only thing connecting the two is that the "fake" e-mail address is a "[e-mail]" address, and that I've logged in to them from the same machine.

So, to summarize, a simple regular expression matching emails against /\+[^@]+/ and replacing with '' is some 1984-level creepiness?

Come on.

[TallGuyShort]

The technology to do any of those is little more than a few database joins and some fuzzier matching logic like you are suggesting. What's creepy is just the extent to which they match. In the email contacts theory, for example, it's not hard to remember an email address that was in a user's contacts list and then suggest they connect when that email address is used. It's only creepy because you personally had no control over giving them the information that allows them to make that leap.

[jlgreco]

The ability to do that is not creepy. Doing it is.

[StavrosK]

> and that I've logged in to them from the same machine

Wouldn't that be a dead giveaway?

[teraflop]

If you can't log into Facebook from a public/shared computer without them disclosing your relationships to everyone else who uses that computer, they should make that very very clear.

[gertef]

They absolutely use geo-ip correlations, and it is a problem.

[rubinelli]

> the "fake" e-mail address is a "[e-mail]" address

If not the machine, then surely this.

[jrochkind1]

Cookies? From marketting networks?

It's amazing how much the marketting networks can figure out about you, and keep track of you with a cookie.

[corwinstephen]

I'm sure this is the case. They probably keep track of all the accounts that have been logged into from your computer via a cookie, and then suggest friends based on those accounts. Creepy, but understandable.

[stinos]

yup seems more likely (to me at least) than matching on an ip address

[rahoulb]

My guess is that the same machine is a big giveaway. There's a difference between leaving a trace of your presence on a shared computer accessed by many people and a computer accessed by one or two.

However, if people you know found the account, then that's also something that Facebook uses - I've had "do you know X?" suggestions from people with whom I have no traceable connections (not in my address book, don't even know their email addresses) - turns out (when I asked one of them) that he had been looking at my profile (without friend-requesting me) a few days before.

[vijayr]

They're probably using the IP.

What is worse is that 1. There is no way to actually delete the data. From what I can see, they only disable the account if you ask them to delete. 2. Even if you didn't give any of your data to FB, your friends/family etc can - there is simply no way to prevent this (a friend takes a picture of you at a party, tags it with your name etc)

[onemorepassword]

My first Google+ account suggested all kinds of information about me and my social graph that was clearly a two year old info dump from LinkedIn.

[shaggyfrog]

Are you logging in from the same locality, perhaps the same building, perhaps from the same computer and perhaps still using the same IP as you had when you closed your account in 2011? It doesn't take a lot of work to come up with some new-user-matching-old-user algorithm with a decent success rate using geographic/IP data.

[Caerus]

It would have been the same major metro area, but moved about 8 miles in the middle. Same ISP, different IP. Same computer, but there's no way I didn't completely clear the browser a few times in those 2 years.

[scarmig]

Hmmm... could the ISP be exposing your MAC address in some weird way?

Or maybe Facebook is using a real-life https://panopticlick.eff.org/

[dpcx]

You could still be fairly unique. It's not a guarantee, but within some range of certainty.

https://panopticlick.eff.org/

[sk5t]

I suspect LinkedIn remembers people who looked for you but didn't try to connect, or you didn't have an account at the time. It has definitely suggested that I connect with the odd stalker with whom I have no other ties...

[raverbashing]

A similar thing happened to me on Orkut

It pointed to me that I probably knew a profile.

This profile was a "fake profile" of a person I knew, from the description it was clear it was this person, can't tell which email was being used, and if I remember correctly it had no friends as well (or maybe only one unrelated friend)

[datums]

Your ip and browser fingerprint increases the certainty that you maybe be or know the same people

[awj]

Most of that knowledge is likely due to people importing their address books. From there they can link you to other email addresses and combine the identities. Creepy yes, but relatively easy to explain.

[mikescoffield]

It would be interesting to see someone test this on a public, shared computer.