Re:Fake “like” factories – how we reverse engineered faceboo...
by stevenicr on Monday December 30, 2019 @11:51PM
(#21919049)
This is terrible. Someone with access to server logs at a few web sites (or someone that loads a third party resource (ads, analytics, sharethis buttons, etc) onto a few web sites) would be able to know exactly who is coming from fbook and viewing different types of content.. no inside access to fbook or their data required.
I can't believe nothing is auto-stripping this url addition between firefox and ublock origin - must find and tell others.
Re:Fake “like” factories – how we reverse engineered faceboo...
by _-___________-_ on Tuesday December 31, 2019 @05:56AM
(#21920190)
Note that the ID changes for each "click" - hence "Facebook CLICK ID" - so you can't tie different clicks back to the same user without access to Facebook's data.
But yes, an extension to strip these (along with `gclid` from Google, `reddit_cid` from Reddit, and so on) would be very welcome.
Re:Fake “like” factories – how we reverse engineered faceboo...
by stevenicr on Tuesday December 31, 2019 @06:52AM
(#21920438)
thanks for this - I was confused about it since I have seen a few that looked very similar (first 12 characters of it the same) - did a quick, slightly deeper check into history and see that I do have 2 urls that have the exact same string, but it appears at least in this one case, that it's a click to a short link that forwards (dj-m.ag to djmag dot com) - so the similarity was confusing, and see some doubles freaked me out.
now I see at least some differences in several - so I guess unless there is an easy pattern match, or as the title of this hn thread story suggests they may be able to reverse engineer fbook clicks - it's highly concerning to be sure since so many places use third party scripts and assets.
fingers crossed this is good and it gets better.
Analytics companies (I think Google and a few others) can pay Facebook to get data on your behalf like what page it came from and the demographics of the visitor.
Google AdWords does this as well on paid clicks with GCLID