4

I was at CryptoParty this year and I heard that Facebook can track user's web activity even after we are logged out. The speaker didn't gave us a solution for protecting our privacy on that matter, so my question here is how can I prevent that?

  • 1
    Delete your facebook account. Install ublock origin, privacy badger, and noscript;blacklist all URLs with 'facebook' in them. – Shadur Jul 18 '17 at 8:15
  • 1
    How can I prevent what? Facebook sources of information are: your own Facebook page - you should be able to control what is there -, your whatsapp activity - whatsapp belongs Facebook - and any other Facebook page speaking of you. What exactly is your concern here? – Serge Ballesta Jul 18 '17 at 11:40
  • 2
    @SergeBallesta: And also any website you visit which contains the Facebook "Like" button: you don't even have to interact with it, the simple fact it is displayed on the page informs Facebook that you are currently viewing this page. – WhiteWinterWolf Jul 18 '17 at 14:08
  • @WhiteWinterWolf: good point! I had not realized that the simple display on the page loads some javascript and an image from Facebook. Along with the Referer header, it is enough to identify what page is consulted... – Serge Ballesta Jul 18 '17 at 14:27
6

To my knowledge installing the browser add-on called uBlock Origin (or something similar) would suffice, just remember to properly configure it to (also) include anti-tracking lists.

Aside from anti-tracking, this add-on is generally known to block ads. (Ad providers, to my knowledge, also have a hard-on for tracking people.)

I generally also block addresses related to social media as I don't use any myself (this can be done at router level, firewall level, or as custom rules to uBlock Origin).

It's probably also a good idea to clear cookies after installation to ensure you got rid of tracking cookies (note that this will log you out of pretty much all sites).

1

I don't use facebook, but this can happen with other services also I guess. My method is to use two different userids. If that's not easy in your OS, use two different browsers. I use one for all my "authenticated" browsing (basically anything I need to put in a userid/password for), and a different one for all the casual browsing.

The important thing is this: even if someone sends me a link on gmail or google+, I copy-paste it to the other browser and open it. I do NOT open that link in the "authenticated sessions only" browser.

And yes I know this is cumbersome, and to be honest I don't know anyone else daft enough to go this far, but I just wanted to throw that out as a possibility.

Additional details:

Both browsers also frequently get "Ctrl-Shift-Deleted" (clear all history, cookies, form data, etc etc etc -- everything, for all time).

I also have an ad blocker; I'm not saying that's not needed. This is just an extra layer.

1

It's a very difficult problem. It's you vs. a gigantic corporation whose business model relies on collecting the richest dossier on you that it possibly can. You're better off in certain areas outside the U.S. (e.g., EU) due to better privacy laws; the U.S. has extremely weak legal privacy protections for individuals.

The other answers provide a solid first step: install a tracker blocker such as uBlock Origin, Disconnect, or Privacy Badger. You could also block all Facebook-related domains, servers, and/or IP addresses in your hosts file, router/firewall, or via DNS. But this isn't enough.

Set your browser to reject all but 1st-party cookies on the current site, and make sure you clear cookies and other stored state after every logged-in session and also regularly for routine browsing. Private or incognito browsing is one way to do this, or there are add-ons that you can use to automate cookie/stored-state management. You want to separate your logged-in browsing from your other browsing as much as possible. Going a little further, you can use a different browser for logged-in sessions than you use for other browsing. Even so, you'll still have the same IP address, platform, and other detectable characteristics in common.

Device fingerprinting and cross-device tracking are very hard to detect, very hard to prevent, and allow servers to bypass traditional cookies and other stored state to correlate your activities across the internet. The most extreme solution is to dedicate a device (or a virtual machine) to Facebook use, and use a VPN or some other way to get a distinct IP address for those sessions.

If you log into Facebook from multiple devices, you compound the problem and give Facebook richer data about your devices and behaviors.

In case you get email from Facebook (or others that can track you), make sure you block images and other downloadable content within your email client. This prevents a timestamped read receipt and other device characteristics from going to the email sender and/or their 3rd-party data services. You can always manually load important content later, or view equivalent content in a browser. Avoid clicking any links in email, as these typically go through 1st- or 3rd-paty tracking links or trackable URL shorteners.

Also keep in mind that your social graph on Facebook, and the content of your posts. likes, page follows, and other interactions tell Facebook a lot about you.

Another step to take is to do as much of your routine browsing as possible using Tor browser, but don't use it for logged-in sessions and switch Tor identities often.

But even with these steps, Facebook will still buy data about you from external data brokers who may have rich information about your online and offline behaviors.

1

As it was already noted, main sources of information about you for FB are:

  • your FB page and activity with regard to likes etc
  • FB pages of your FB "friends", who mark you on photos, send you links or whatever they send to you
  • messengers (FB Messenger and WhatsApp)

Obviously, you cannot use messengers if not logged in and you cannot control your FB "friends". To block FB "like" button tracking (and other similar ways to spy) you can use a range of techniques.

The simplest is to use uBlock Origin or similar plugin. The main advantages are that it has pretty good defaults and is relatively easy to tweak to your needs. The drawback for me is that it operates with hostnames, and some FB servers have hostnames that are not easy to associate with "Facebook".

The hardest I've seen (and use on my Linux machine) is to block access to all IP addresses belonging to FB (both IPv4 and IPv6) except for a separate virtual machine/account. This means that when I surf with my "normal" browser no connection can be made to any FB server, neither when I try to open a link to FB page nor indirectly (from a "like" button or something similar). The advantage is that this method blocks any connections to FB, no matter how they are initiated (accidentally, by a button, script or whatever). The drawbacks are complexity of implementation and some inconvenience, when some page tries to load resources from FB and "hangs" for a while.

I'm sure there are some options between these two.

Note also that in US Facebook is able to get data on you from several data aggregation companies, which sometimes use offline information collection. I have not heard of this way to collect information in Europe though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.