Thursday, September 29, 2011

Facebook is twitchy over privacy and security

It seems that they have a Quick Reaction PR team in place, to dispute claims that they're cavalier about their user's security.  Like leaving behind cookies that can track the web pages you visit even after logging out:
Cubrilovic’s conclusion after examining the behavior of Facebook’s cookies is simple: “Even if you are logged out, Facebook still knows and can track every page you visit.”

This is because instead of telling browsers to remove cookies when users log out, Facebook merely "alters" the state of those little parcels of data – including the cookie that stores your account number.

As a result, if you happen to pass by a page with a Facebook “like” button, "share" button, “or any other widget”, your information – including your account number – will be sent back to Facebook. And if you log into Facebook from a public terminal, those cookies could be left behind.
Enter the Facebook PR Ninja Strike team, with a quiver of denial:
In a comment on Cubrilovic's blog, a Facebook engineer – identifying himself as staffer Gregg Stefancik – said that “our cookies aren’t used for tracking”, and that “most of the cookies you highlight have benign names and values”.

"Generally, unlike other major internet companies, we have no interest in tracking people," the insider added.
[*COUGH* Google! *COUGH*]

Interesting that Facebook is getting edgy when people point out Yet Another Privacy Fail.  Interesting that they do it so quickly.  Interesting that they call out Google.

I almost never use Facebook.  Are they tracking my surfing?  Dunno.  In the past, they're been entirely cavalier about their user's privacy, and Mr. Stefancik doesn't actually dispute Cubrilovic’s claim.  A non-denial denial, if you will.

Me?  I don't trust them, based on their past behavior.  Your mileage many vary, void where prohibited, do not remove tag on penalty of law.

1 comment:

NotClauswitz said...

As close as I get to Facebook is their commercial-arm Linked-In, but that's entirely another World, and one reason I'm not joining Google+ either. Ever.
Today I got a linked-in request sent to my DirtCrashr address, by a guy in Bangalore... WTF? I killed it.