Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in.
For example, if you go to hide.me's torrent page, it will tell you what logins of yours were detected, even though you never (explicitly) approved this website to access your account.
I know that switching to "private browsing" and/or using extensions such as Ghostery help in some ways, but is there a more straighforward way to block this?
I think what you are noticing is a client-side acknowledgement of your sessions with Facebook, Gmail, etc. If a sharing script originates from facebook.com and you have an active session with that hostname, they will present a streamlined share button (for example) for your account. The website linking you to the script on Facebook cannot see who you are according to Facebook, or according to any hostnames that they do not control, if you do not explicitly authorize them to access that information.
In other words: if your browser currently holds a session cookie for facebook.com, then you will be able to use account-specific features of that script. It's meant as a matter of convenience, although it would give Facebook a pretty good ledger of where you've been and what you're up to (but no more than Google's tracking cookies). You can at least go incognito in Chrome or Firefox if you want to avoid leaks like that while working through a secure proxy.
Edit:
In the case of hide.me, they are doing about the most a host in their position possibly can in order to scare prospective customers into thinking they know more than they do. For instance, here's how they determine whether or not you are logged in to Facebook and Google+. In the case of Google+, they just add a new img element to the DOM and listen on a "loaded" event from the element—that is, they are literally just checking whether or not your browser is able to load an image that isn't available to non-users.
In the case of Facebook, their SDK allows a website to determine whether a user is logged in:
FB.getLoginStatus() allows you to determine if a user is logged in to Facebook and has authenticated your app. There are three possible states for a user:
- the user is logged into Facebook and has authenticated your application (connected)
- the user is logged into Facebook but has not authenticated your application (not_authorized)
- the user is not logged into Facebook at this time and so we don't know if they've authenticated your application or not (unknown)
There will be similar methods for other social networks.
How can I hide my logged in sessions from other websites?
A good precaution you can take is to disable third party cookies in your browser. This would stop a website's HTML page with reference to a resource on Facebook or Twitter from causing your browser to send your authentication cookie with the request, so their API cannot determine whether you are logged in or not.
However, some websites attempt to circumvent this by opening a popup window which makes the request include a 1st party cookie (as it is a direct request to the social network domain), and the result of this is communicated via window.opener to the website's domain that you are on. You may be able to block these by configuring your browser's popup blocker. However, unless you set the popup blocker to its most stringent settings, websites may be able to open the popup when you click other page elements, exposing your privacy.
If you want to completely block sites from getting your logged in session statuses you will need to use private/incognito mode (this works at the time of writing) or another browser with clean cookies and empty HTML5 local objects and you should also clear any Flash and Silverlight local storage items which can be shared between browsers. However, Facebook are not at present known to be storing data using browser plugins.
