Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in.

For example, if you go to hide.me's torrent page, it will tell you what logins of yours were detected, even though you never (explicitly) approved this website to access your account.

I know that switching to "private browsing" and/or using extensions such as Ghostery help in some ways, but is there a more straighforward way to block this?

  • 4
    I'm skeptical of their ability to detect logins. I only see Google+, but I'm definitely logged into facebook, twitter, linkedin, and quite a few other websites. This is a bit off topic though; I see the point you were making. – Seiyria Feb 7 '15 at 22:04
up vote 15 down vote accepted

I think what you are noticing is a client-side acknowledgement of your sessions with Facebook, Gmail, etc. If a sharing script originates from facebook.com and you have an active session with that hostname, they will present a streamlined share button (for example) for your account. The website linking you to the script on Facebook cannot see who you are according to Facebook, or according to any hostnames that they do not control, if you do not explicitly authorize them to access that information.

In other words: if your browser currently holds a session cookie for facebook.com, then you will be able to use account-specific features of that script. It's meant as a matter of convenience, although it would give Facebook a pretty good ledger of where you've been and what you're up to (but no more than Google's tracking cookies). You can at least go incognito in Chrome or Firefox if you want to avoid leaks like that while working through a secure proxy.

Edit:

In the case of hide.me, they are doing about the most a host in their position possibly can in order to scare prospective customers into thinking they know more than they do. For instance, here's how they determine whether or not you are logged in to Facebook and Google+. In the case of Google+, they just add a new img element to the DOM and listen on a "loaded" event from the element—that is, they are literally just checking whether or not your browser is able to load an image that isn't available to non-users.

  • Can't the client side acknowledgement somehow notify the website that's executing the script what accounts I use? – Sparkler Feb 7 '15 at 19:47
  • 2
    That would have to be prompted by code executed within the scope of Facebook's script (in this case), and it would make for interesting press if Facebook ever rolled that out—they would have to tell interested services that a new feature has released to enable inordinate and unauthorized disclosure of their own users' personal information. It won't occur. – AJAr Feb 7 '15 at 19:57
  • 2
    Personally I find it quite amusing that the "Oh, there you are!" map is off by just about the entire width of the country, and I'm not even using a VPN! Also, they apparently can't detect my browser even though it's bog-standard IE11... XD – Niet the Dark Absol Feb 8 '15 at 14:01

In the case of Facebook, their SDK allows a website to determine whether a user is logged in:

FB.getLoginStatus() allows you to determine if a user is logged in to Facebook and has authenticated your app. There are three possible states for a user:

  • the user is logged into Facebook and has authenticated your application (connected)
  • the user is logged into Facebook but has not authenticated your application (not_authorized)
  • the user is not logged into Facebook at this time and so we don't know if they've authenticated your application or not (unknown)

There will be similar methods for other social networks.

How can I hide my logged in sessions from other websites?

A good precaution you can take is to disable third party cookies in your browser. This would stop a website's HTML page with reference to a resource on Facebook or Twitter from causing your browser to send your authentication cookie with the request, so their API cannot determine whether you are logged in or not.

However, some websites attempt to circumvent this by opening a popup window which makes the request include a 1st party cookie (as it is a direct request to the social network domain), and the result of this is communicated via window.opener to the website's domain that you are on. You may be able to block these by configuring your browser's popup blocker. However, unless you set the popup blocker to its most stringent settings, websites may be able to open the popup when you click other page elements, exposing your privacy.

If you want to completely block sites from getting your logged in session statuses you will need to use private/incognito mode (this works at the time of writing) or another browser with clean cookies and empty HTML5 local objects and you should also clear any Flash and Silverlight local storage items which can be shared between browsers. However, Facebook are not at present known to be storing data using browser plugins.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.