> Tellingly, my female FB friends are much more likely to obfuscate their names (and get blocked for it).

This is the part of Facebook that's really creepy. As a guy who used to date around a lot, I was surprised by how well the "find user" function works.

You connect with someone on Tinder, and meet up in real life. You have no friends in common, no digital connection other than a week-old Tinder conversation consisting of 5 messages. Neither of you checks-in to the restaurant you met up at.

But when you type the woman's first name into Facebook (you don't know her last name), she will be the first suggested result.

I don't know how they do it. But they do it. I'm assuming geo-tracking of phones and noticing that you spent X hours together the previous night.

> I don't know how they do it. But they do it. I'm assuming geo-tracking of phones and noticing that you spent X hours together the previous night.

My boss and I were wondering the same thing after spending few days at client's site in another country, after which Facebook suggested the client as a friend to my boss, even though they never interacted electronically by means other than company e-mail. We thought about geo-tracking, but then concluded that it's more likely Facebook must have identified both of them were connecting to the same Wi-Fi network at the same time.

Somehow the Wi-Fi network theory sounds even creepier than geo-tracking.

Also in my example, I didn't usually connect to any Wi-Fi because I have LTE. But of course I don't turn off wi-fi when I leave the house so my phone still does network discovery.

Well, when you think about it they probably associate users who use the same IP address. From that perspective it's difficult to see how they could avoid using this data. It's like not noticing that two different people called you from the same number.

Does it now? By Wi-Fi tracking I'm thinking of SSID matching (which are public information), not pinging devices inside a single network.

Your data point about on-but-not-connected Wi-Fi supports both geotracking and SSID tracking. We need more data!

Facebook harvests a mountain of data about you when you use the new Messenger app. I swear the only purpose it has as a separate app is to be far worse than they think they can get away with the main Facebook app being.

It's probably from the messenger data that they correlated your proximity.

You know when websites ask for consent to share data with third parties? This is mostly how they do it. What you view on linkedin goes to fb and vice versa.

I had used a chat service only once to call some guys and the day after all participants were suggestions on linkedin.

To most of those free service a product is you and they monetize your graph in this way.

Then you have subsidiaries. You may gave not given facebook or messanger access to you contacts, but what anout whatsapp? Any app with access to your contacts may have sold them. And even if you have none the other party might, or even a third party.

> What you view on linkedin goes to fb and vice versa.

That's completely unfounded speculation, and I'd love to see any citation for it.

I'm inherently skeptical because for these companies their most important asset is their data. The idea that they would share that data willy-nilly with third parties makes no business sense.

it is indeed speculation, but at least anecdotal, not totally unfunded

http://www.interactually.com/linkedin-creepiest-social-netwo...

http://imonlinkedinnowwhat.com/2009/09/14/linkedin-people-yo...

there are quite a few instances of weird guess about the people you might know suggestions

of course the actual source is kept as one of their best secrets.

Neither of those links you shared provided any evidence whatsoever for LinkedIn and Facebook having a secret bidirectional data sharing relationship.

The far more intelligent explanation is that suggestions are, as LinkedIn repeatedly emphasizes, based on imported contacts. Note that even if you don't import contacts, the other person might have.

Try using Occam's razor before jumping to unprofitable conspiracy theories. (Again, why on earth do you think Facebook would voluntarily share data with Facebook?)

> Again, why on earth do you think Facebook would voluntarily share data with Facebook?

Because why not? Facebook isn't really competing with LinkedIn right now - the latter doesn't try to enter private life, and the former doesn't really touch work life much. Both could benefit from sharing data with each other - from better recommendations to creation of shadow profiles. I don't see how this is an unreasonable theory.

This is insanely creepy...

Another possibility is that your social graph might have more overlap than you realize, even if it's not very much, it could be enough to make them the 'nearest' to you in some way. At least some of the graph data can come from sources invisible to you (i.e. people looking at other people's Facebook connections).

Yes, that could be an option too, though in this case it would be surprising given that this was a new subcontractor of our actual client, in a place neither of us have ever been before. But I recognize the phenomena you mention; I sometimes see random people on Facebook with surprising amount of overlap with my social graph, even crossing the groups I consider mostly unrelated (say, a person is a friend with few of my buddies from university AND some other unrelated group of locals AND also knows that random person I met somewhere that lives on the other side of the country).

That does seem hard to explain. It's creepy sometimes to wonder just how much they can figure out from how little and where all the information siphons are actually located.

Honestly, I find it both empowering (oh the data I can find if I know where to look) and reassuring. Why reassuring? Because it reminds us that lies can and will be discovered. Some people like to think they'll get away with one but it's only a function of how much someone else cares. But reality is self-consistent and in the Great Web of Causality falsehood is just damage that needs to be routed over.

Conversely, lying is a malicious act. It'sdirectly sabotaging the model of the world and reasoning capabilities of other human beings, with recursive damage being dealt as that person propagates or reasons from false information. Unless placed in life or death situation (std::jews_hiding_in_your_basement), you really shouldn't do it. It boggles my mind how lightly people treat spreading falsehoods.

I think things will eventually come around once reputation in life is unavoidably attached to everything they say, though, but it might be messy getting there.

Could it be that she has searched for and found your FB profile before you searched for her?

> I don't know how they do it. But they do it.

A big avenue for this is phone numbers. If you have exchanged phone numbers or texted and either person has the facebook app installed on their phone they may show up on "people you may know"

This is almost certainly it. It comes from adding each other to your smartphones address book so a name shows instead of a number.

Do you have her number in your phone?

Sometimes yes, sometimes no. But I don't remember giving FB permission to view my phone numbers.

If you have the FB app installed it has access to your contacts.

Let me rephrase, I don't want it to have access to my contacts and did not realize that it does. Now that I know it likely does, I am discomforted.

At least on iOS it doesn’t, unless you gave it the permission yourself.

Hopefully in Android Marshmallow this feature is not again shot down just before release.

Granular permission control is one single thing I am waiting for in Android 6.0 because that is the only feature I wanted to root my phone for.

What does the FB app give you that the website doesn't anyway? I had no idea why I would want it on my phone when FB was pushing it on me.

Instant messaging :(

There are phones for which that may not be true.

It's probably due to the Tinder app being tied to your Facebook account.

I don't see the problem. A friend request is hardly that threatening. If you don't accept his/her fb request, how can he/she bother you?

It's not about the friend request per se, it's about being able to find people.

A large part of your FB profile is public. At the very least, I now know your last name. Maybe even your birthday.

In a lot of cases, that's enough to perform some light identity theft. Or I can find your exact address. Or I can find out where you work, or just see all the places you like hanging out at and so on and so on.

I don't want to be that easily findable by strangers, which is why I consistently use a "fake" identity online and offline. It's still me, everyone knows me as Swizec Teller, the name just doesn't have anything to do with my legal first and last name. And my legal name is purposefully difficult to tie with this identity unless you have certain background knowledge.

It's almost like computer security. One little vulnerbility might be nothing. But it allows someone to pivot to something else. Which allows them to pivot to the next level. etc. etc.

Except that at this point it's IMO worrying too much. Being afraid of having your name discovered is a bit on the paranoid side for most people. Hell, it's usually trivial to get that data off-line and dangerous people will likely target you directly.

By the way, some people don't even try. Few days ago I saw a girl on the tram carrying her CV in such a way it would be trivial to shoulder-surf her name, email, phone number, date of birth and home address.

That attitude changes when you get death threats sent to your email that mention your home address because your dad had a business disagreed with an unstable person.

Yeah, that happens irl sometimes.

The scary thing is that you don't know who will turn out to be unstable, and it can be someone you never even interact with who is just trying to use you to get under somebody else's skin.

Ouch. That sucks :(.

Still, problematic as it is, that's just bad luck. We can't all live in fear of evil strangers sending death threats to us. There is no way a normal person can reasonably protect themselves from an attack like this targeted personally. We need to empower the police to deal better with such cases.

> Still, problematic as it is, that's just bad luck. We can't all live in fear of evil strangers sending death threats to us. There is no way a normal person can reasonably protect themselves from an attack like this targeted personally.

I disagree. Protection of yourself is a multi-angle approach.

One of the very practical ways to not live in fear of evil strangers is to practice good online anonimity, pseudonymity and/or compartmentalisation.

Back when I first got regular Internet access in 1998, this was a no-brainer. Almost everybody did it, and even if you slipped up at first, it was often possible to just cover some tracks and start over with a new nickname.

I walked the web like that for years, until modern Internet made it a lot harder. I was forced to make some hard choices about my own privacy (and thereby automatically about other people's privacy too) versus the ability to stay in contact with certain (groups of) friends. Not for one-to-one messages, email still works fine for that in principle, and everybody still uses it. It's the group communications that were the real issue, forcing very hard choices on people that actually want to choose privacy. But I digress.

The point is, simple precautions like this used to be no harder than simple real-life precautions such as locking your door and not leaving your phone or wallet on the bar counter as you go to the toilet. Simple common-sense things such as not writing your street address on your key-chain label. Or in cases of "bad luck", if some creepy guy is being creepy, being able to safely tell the bartender, paying attention that he doesn't see where you're going as you leave, letting a trusted friend know where you are, etc.

No it doesn't offer 100% protection, but it helps a lot! Real-life precautions like the above are the "way a normal person can reasonably protect themselves" from these types of real-life attacks and threats.

Nobody, corporation or government, would consider making such real-life precautions harder to follow. Or if a corporation would leverage network-effect to turn such a real-life precaution into a social handicap or taboo, people would quickly ask themselves "wait, is this really what we want?", and as soon as the first victims fell, the corp would get a lot of flak for it.

I believe we should allow people to be able to afford the same sorts of easy-to-follow on line precautions, without forcing people to make the awkward choice between privacy (and sometimes safety) and partaking in social life without too much inconvenience to themselves, and importantly, their friends too.

I get it, but I think your examples are not equivalent. I agree that the real-life precautions you mentioned are easy to follow and important. But the equivalent of those on-line would be: not sharing your passwords (especially to bank and e-mail), not posting your home address on public forums, telling your trusted friend you're off-line so if they see any activity from you it means you've been hacked, etc.

The real-life equivalents to the on-line precautions you've mentioned would be not telling anyone your name, wearing masks in public, not leaving any trail of your activities, and relocating to another town if anyone accidentally discovered what's your first name.

Basically, I don't believe dangers on the Internet warrant such precautions for general population.

I also first went on-line around 1998 and in my part of the world, people were just playing around. Nicknames were created not because one needed them, but because mostly nobody asked for real names.

Well, on-line space and real-life space are very different. I don't think it's very useful to compare "equivalent" precautions by analogy like that.

The reason for that should be clear enough from the examples you gave. Some types of precautions are much easier, sensible or acceptable to do in one type of space than in the other, or vice versa. Some precautions are clearly ridiculous, or just don't carry the same kind of protection in the other type of space. In real life you also don't need to worry someone downloads a copy of your drink :-)

I didn't pick the examples because they have a clear and useful digital equivalent either. It was to demonstrate some other points: Sometimes we have to take precautions to protect ourselves, even if they inconvenience us, even if they do not protect 100% perfectly. And even if the dangers we try to protect ourselves from are clearly illegal, we still take the precautions because we don't expect the law/police to always be there and protect us before they happen. In fact, for real-life we generally prefer it that way, we don't really want to policeman at every corner, hovering above our every move, we want to be able to take care of ourselves, by ourselves. Because sometimes there is no one else.

I'm arguing that we should aim for a similar way in on-line space. Not by carrying the protections to their literal not-quite-equivalent real-life analogies, that would be silly. But to create a similar way of being able to protect oneself, in an (on-line) socially acceptable manner, without having to rely on the state (or a corporation).

I'm arguing that in on-line space, one of the options for precaution should be the ability to pick pseudonyms. They come much more natural to the on-line world than the real world, because on-line you're not attached to a physical presence. This is an advantage, you can't do it in real-life. It doesn't make sense to carry the analogy over, wearing masks isn't quite the same, plus it's not socially acceptable. There are of course many other on-line precautions to protect yourself against dangers, but we were discussing pseudonyms.

BTW a quick side-note, not directed to you in particular. I find that on HN there is a strong tendency to try and find real-life analogies for all sorts of cyber/digital on-line concepts. Often resulting in discussions that carry a metaphor way too far. "No it's more like trying to tie your shoes while your feet are in a locked safe, but your socks are the key ..." -- eh. My point is, in my experience, such kinds of analogies are only useful when trying to somewhat explain a technical concept to a non-technical person. It's not useful at all as a starting point to reason from, just because the analogy (mostly) holds as far as it's descriptive of the concept, doesn't mean the other properties of the analogy that you can reason from there are in any way predictive of the technical concept by the same line of reasoning. Isn't this called "leaky abstractions" in programming? :-)

I agree, we can't live in fear of that. And it's as sinple as making your legsl identity ungooglable.

Artists have figured out long ago that pseudonyms serve a purpose. These days we get sinilar levels of exposure online.

There are privacy settings for all of this... it's not forced in any way. Take the 5 mins to setup everything and it all works.

Except in cases like those noted in the EFF's documents, where FB will change your publicly listed information without your consent and remove your ability to change it back.

I hear this a lot but I dont get it - Facebook has some of the most robust privacy settings of any platform.

You can control exactly how much information you want the public and different groups to see. Also, most people who complain about public data are the ones who willingly share most of it in the first place without a care.

This is absolutely not true historically. I don't know what their privacy policies are now, but they have a track record of changing them with very little fanfare.

The most important thing is public vs friends. And they've always had those basic settings for a long time... so again not sure what the big issue is.

You can still just not put things online or not be friends with someone to protect yourself if you don't want to configure privacy settings.

They have responded to the criticism of their historical behavior and now only make changes with quite a bit of fanfare. They haven't done anything overtly evil related to privacy in a while.

"Facebook hasn't abused their users much in a while, so I trust them to never do so again ever" is pretty fucking slim for someone whose career or life could be endangered.

Exactly. I have been let go (with a good package, though) from a dream job over a single personal comment from a long-time friend, who happened to work for a rival company. "You're friends irl with NNN? Sorry we have to let you go, cannot have risks like this when planning this merger". Hello, depression.

It's possible to use Facebook in a way that couldn't endanger your life or career, depending on who you are. Obviously if someone is stalking you or something, that's a different story. But most people can just omit the information that they find to be sensitive and limit their friends list to people they trust.

> It's possible to use Facebook in a way that couldn't endanger your life or career, depending on who you are. Obviously if someone is stalking you or something, that's a different story.

It's the story in the article we're discussing, in fact.

> Obviously if someone is stalking you or something, that's a different story.

Yup.

Perhaps dont share information if your career/life depends on it?

That's a very different argument than "I dont get it - Facebook has some of the most robust privacy settings of any platform"

I can have different arguments - especially for different scenarios.

If it really is your life at risk, dont share on Facebook or online. Otherwise, use privacy controls. What am I missing?

First sentence of the fucking article: "Facebook claims its practice of forcing users to go by their 'real names' (or 'authentic identities' as Facebook spins it) makes the social network a safer place."

Second sentence of the fucking article: "In fact, the company has often claimed that the policy protects women who use the social media platform, even when faced with community advocates pointing out that the policy facilitates harassment, silencing, and even physical violence towards its most vulnerable users."

If Facebook claimed that its practice of forcing users to go by their real names endangered some of those users and it consciously warned those users about the danger of posting personal information on facebook, that would be one thing. But it seems like they are doing the opposite.

I'm really not sure what point you're making here. Everyone will be affected differently by these rules as subject to their scenario. There's no way to make a general statement by Facebook for their entire 1B+ user base.

I do believe for the vast majority it does make things safer but if YOUR particular situation is different, then yes, use privacy settings, or dont be on Facebook or dont be online at all.

All the blame here seems to be toward Facebook somehow exposing information when every single step of that information getting out there is completely voluntary and has a massive amount of privacy control available.

Failure to use the right service in the right way rests on the user, not the service.

"Political dissidents and abuse victims can't safely use Facebook" is the problem we're discussing. I take it your solution is "political dissidents and abuse victims shouldn't be using the internet at all"?

If using your real name gets you in trouble for X reason then what does Facebook have to do with it? Using your real name anywhere would get you in trouble.

So then Facebook is obviously not the right place for it if you need strong anonymity. Again, what is the blame on Facebook as if they came in and registered your name and profile by force? Choose wisely for your scenario, that's all I'm saying.

> Again, what is the blame on Facebook as if they came in and registered your name and profile by force?

Pretty sure you're trolling at this point, but if not google "facebook shadow user profile" and get your mind blown.

It's weird how you keep restating the problem and acting like you've actually described the solution somehow.

> They have responded to the criticism of their historical behavior and now only make changes with quite a bit of fanfare. They haven't done anything overtly evil related to privacy in a while.

That's great. Are you willing to risk your physical safety on this?

Should other people be willing to risk theirs? If not, what if they are part of your real-life social circle, but because of this they cannot join the private FB group-chat thing that happens to be the main mode of communication for this social group? What if they might have reservations discussing their reasons not being able to join?

Sure, but users who are legitimately concerned about privacy would be pretty foolish to rely on Facebook's settings, which was the comment I replied to. It's not like we're talking about behavior from 20 years ago.

To be fair, I don't think those users should trust any service's privacy settings. Facebook is almost certainly better than, say, Ashley Madison. But I think most of us would ridicule a "real names only" policy proposed by Ashley Madison, even though they haven't had a major privacy violation since their last CEO.

If you are legitimately concerned about privacy, why are you putting it on Facebook or online in the first place?

It's like everyone here wants to blame Facebook when it's actually less work to just not post anything.