All Your Data Belong to Facebook
By: Paul Coogan
Tags: Web Browser, Privacy, Facebook Ads, Cookies, Advertising

All Your Data Belong to Facebook

That creepy feeling is real and here’s how it works

Photo by Agence Olloweb on Unsplash

“My phone is spying on me.” We’ve all heard it, or even said it, and now I’m going to pull back the curtain and show you how it works. I’ve dabbled in code since Earthlink dial up but most of what I am writing here comes from “reading the manual”.

I have been pretty blaisé about my data being collected preferring to give away my innocous usage of the internet in exchange for free content. That’s the deal right? Sort of, websites use cookies to hold your shopping cart contents and tailor the site specifically for your tastes — “shoppers like you also bought blacklight posters and pickled herring” — but we have gone way beyond the bespoke.

My curiosity was aroused after doing a little Christmas shopping. I thought maybe replacing some chipped dishes might be a practical addition to the new set I just purchased. I did a Google search on Pier 1 Tosca Dinner Plates and before the last key press I had a row of ads with the exact plate available from replacements.com. I browsed a few, decided against it, and went to bed.

Two days later my partner asks if I was looking at dinner plates because she got an email offering plates for her exact set — Yes, she got the email, not me.

We figured it had something to do with cookies and Facebook friend connections but what can you do? A shrug emoji appeared and we moved on. But it bothered me. I knew enough about the technology to get part way and the remaining connections seemed a bit shady.

How Did They Do This?

I suspected Facebook since that was the most obvious link. If I could find a connection between replacements.com and facebook.com the rest would be data connections within the Facebook ecosystem.

I had not concerned myself with online tracking in sometime and I was quickly tossed down a rabbit hole where data harvesting and privacy were in constant conflict. I will summarize my findings with as little technical jargon as possible.

The web was originally designed for browsing documents but soon needed a way to maintain state between requests, e.g. “is the user logged in”. Session cookies hold that information in memory until the browser is closed. In 1995 eCommerce sites wanted to save shopping carts between browser sessions without requiring a login. First-party persistent cookies solved this by having the browser save a small amount of text on your device that could be read back later. The data were secured by allowing only the domain setting the cookie to read it.

At this point, advertisers could tell where an ad was placed and some basic information such as region but nothing that could truly identify the user. Enter third-party persistent cookies, also known as tracking cookies. Illustrated below is a simple example of browsing Website A, having your last viewed items list transferred to a third-party cookie which is then read later by the ad service to show your browsed items in the ad showing on Website B.

Of course as you continue to browse the ad service builds a more detailed profile to advertise those blacklight posters and herring snacks you’ve been wanting.

So far this is a fairly even trade, you give up some information to get advertising that is relevent and even removing some ads that might be offensive (e.g. a vegan getting ads for Omaha Steaks). But in the privacy versus marketing tug of war the money wins. Google and Facebook already know a lot about you by virtue of having you logged in. They are both large advertisers so the third-party cookie information can be merged with your full profile.

Let’s get back to those plates! Browsers now come with developer tools built in so viewing cookie contents is very simple. Here is my viewing history stored in the replacements.com cookie.

previouslyViewed [{“pattern”:243274,”composite”:false,”url”:”/china-pier-1-toscana-terra-cotta/c/243274",”exp”:1609730547192},{“item”:42933681,”pattern”:243271,”url”:”/china-pier-1-toscana-burgundy/c/243271",”exp”:1609730437634},{“item”:42933871,”pattern”:243273,”url”:”/china-pier-1-toscana-ivory-dinner-plate/p/42933871",”exp”:1609730417126},{“item”:42933771,”pattern”:243272,”url”:”/china-pier-1-toscana-gold-salad-plate/p/42933771",”exp”:1609730406480},{“item”:42933791,”pattern”:243272,”url”:”/china-pier-1-toscana-gold-9-soup-pasta-bowl/p/42933791",”exp”:1609730209479}]

You can see the data pretty clearly and with a transfer to the third-party it can be used to push the sale. But wait, it was my partner that got the push in an email! Taking a look at the email it was easy to see it arrived from replacements@safeopt.com. SafeOpt provides a service that touts “Brand Collaboration — Join thousands of brands working together to improve customer experiences and grow revenue.” The inner workings of SafeOpt are only available by requesting a demo but it can be assumed that once the third-party cookies of these thousands of brands are merged into a “data lake” connecting my profile to my partner’s profile is not difficult. The real giveaway was the subject line: “Let’s pickup where we left off”.

So is Facebook off the hook on this one? Not at all. Facebook has even expanded tracking to brick and mortar stores with Off-Facebook Activity. This service allows any business to upload “hashed” customer data and have Facebook make a match. The hashing is one-way encryption that allows making a match without seeing the real data. The email address “hej@inkbear.com” becomes “b31ae737d3b012a9a2d1ddf5d94b695b” (using MD5) with no way to reverse it. Facebook finds a profile with the same hash and saves the match. This lets the store know if their ad was played to you before you bought something AKA a “conversion”. Flipping the sequence around, you could buy a shirt at Macy’s and start seeing ads for ties on Facebook. This also applies to apps like the Ring doorbell system.

Lastly, not to trigger paranoia, is browser fingerprinting. Just requesting a single web page includes quite a bit of data. Here’s mine :-)

USER AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Safari/605.1.15

HTTP_ACCEPT HEADERS: text/html, */*; q=0.01 gzip, deflate, br en-us

BROWSER PLUGIN DETAILS: Plugin 0: WebKit built-in PDF; ; ; (Portable Document Format; application/pdf; pdf) (PostScript; application/postscript; ps) (Portable Document Format; text/pdf; pdf).

TIME ZONE OFFSET: 480

TIME ZONE: America/Los_Angeles

SCREEN SIZE AND COLOR DEPTH: 1680x1050x24

SYSTEM FONTS: Andale Mono, Arial, Arial Black, Arial Hebrew, Arial Narrow, Arial Rounded MT Bold, Arial Unicode MS, Comic Sans MS, Courier, Courier New, Geneva, Georgia, Helvetica, Helvetica Neue, Impact, LUCIDA GRANDE, Microsoft Sans Serif, Monaco, Palatino, Tahoma, Times, Times New Roman, Trebuchet MS, Verdana, Wingdings, Wingdings 2, Wingdings 3 (via javascript)

ARE COOKIES ENABLED?: Yes

LIMITED SUPERCOOKIE TEST: DOM localStorage: Yes, DOM sessionStorage: Yes, IE userData: No, openDatabase: false, indexed db: true

HASH OF CANVAS FINGERPRINT: 573151a043aa0608d8ba9e2e56bd1997

HASH OF WEBGL FINGERPRINT: f9005465a29cc9af5ce80896ba68904d

WEBGL VENDOR & RENDERER: Apple Inc.~Apple GPU

DNT HEADER ENABLED?: False

LANGUAGE:en

PLATFORM: MacIntel

TOUCH SUPPORT: Max touchpoints: 0; TouchEvent supported: false; onTouchStart supported: false

AD BLOCKER USED: False

AUDIOCONTEXT FINGERPRINT: 35.10893232002854

CPU CLASS: N/A

HARDWARE CONCURRENCY: N/A

DEVICE MEMORY (GB): N/A

Remember that hash thing? That block of data can be turned into an identifier (“529d7853126789827f73251403800ad8”) that will be unique to several thousand people, quite a small number in the total population and when combined with other elements can be even narrower.

Stopping the Tracking

“Three may keep a secret, if two of them are dead.”

― Benjamin Franklin, Poor Richard’s Almanack

Obtaining complete privacy on the internet is a fool’s errand but we do need a modicum of privacy.

Disabling third-party cookies in the browser is quickly becoming a default setting but as you can imagine, other methods and workarounds soon crop up. Still a trip to the Electronic Frontier Foundation is recommended; check into Privacy Badger and Cover Your Tracks.

Off-Facebook Activity seems particularly intrusive after the Cambridge Analytics scandal and Facebook has provided tools for managing it. The settings are buried fairly deep so here is the direct link to Off-Facebook Activity settings. Note that turning it off only makes your data anonymous and does not delete it.

Ultimately privacy is not just a personal preference, as you can see my loose setting led to my partner receiving spam so tighten up your security, if not for yourself, for your friends and family.