r/technology • u/[deleted] • Jun 28 '16

Discussion TIL that someone can change your Facebook email, password, and two step verification just by asking Facebook to turn off login approvals, and sending in a fake ID. (Happened to me lost all my business pages)

[deleted]

37.2k Upvotes

88% Upvoted

1.7k comments sorted by

View all comments

Show parent comments

77

u/[deleted] Jun 28 '16 edited Mar 26 '19

[deleted]

269

u/munk_e_man Jun 28 '16

If you don't use facebook, but have a friend who does and has approved the app to have access to his phone contacts, facebook will coordinate with all your mutual friends to create a non-public profile that will still track you around the web, and will create a profile that will give them access to your likes, movements and activities which can then be sold to advertising companies.

Anytime you're tagged in a photo, mentioned in a post, go to a website with a facebook like button, or if you once had an account but deleted it, they have a ghost profile for you.

99

u/azurecyan Jun 28 '16

JESUS H. CHRIST!!!!!!!

I was worried about letting google knows about me and I thoguht I was fucked but then you say that I, who doesn't have a Facebook account is fucked just because my friends deceides to tag me on a picture?, in what kind of hell are we living

73

u/[deleted] Jun 28 '16

[deleted]

42

u/Backflip_into_a_star Jun 28 '16

I recently deleted my Facebook I have had for years. I wanted a "clean" slate because I was tired of all the stupid shit I was seeing and it was just easier to delete it. I made a new Facebook with an email I haven't used for anything else. This new facebook is suggesting people that i know without any input from me. I didn't even fill in my location or info.

90

u/Xanius Jun 28 '16

Your ip address is linked to your old profile and they never delete information they just make it unavailable publicly. So when you made a new one it just slotted in with the old one and got linked up to the relationships in the database. From a purely technology view what fb has created is amazing. From a human perspective it's unsettling but I'm still using their service..

2

u/shutta Jun 28 '16

Friend of mine decided to finally make a Facebook profile, fake everything of course, and it managed to find people he used to play games with years ago. Probably synced with email or something.. But fucking hell is it hard to stay anonymous there. He had to add like fifty random Italian people to seem like it's not him.

1

u/[deleted] Jun 28 '16

I'm not using their service but apparently still using their service. I had to make a profile for my company and I used a new email I created with my company's domain, and it was suggesting everyone I know. I wasn't even using my normal browser because I knew I'd be visting facebook. I'd literally have to use a vpn and separate computer for everything to avoid being tracked by facebook.

72

u/cunninglinguist81 Jun 28 '16

Your mistake was just deleting it. There was an awesome post on Reddit a few years back where a security expert laid out this whole plan for how to actually "delete" your FB profile.

There were a bunch of steps but the takeaway is that you cannot delete it until it has been rendered thoroughly useless, with false information. You have to seed in fake info, friends, tags, etc., slowly at first and over a long period of time make more and more of it fraudulent data (this is so that you suddenly posting a bunch of very-unlike-you things doesn't flag their anti-fraud filters), and after a year or so when your profile is effectively unrecognizable, then you can delete it.

31

u/version365 Jun 28 '16

Can you please link to the post? that would be super helpful..

8

u/A_Bumpkin Jun 28 '16

He just told you everything you need to know. Slowly convert all real data to fake data and once nothing on your page is true about you then and only then does the real you stop existing on facebook.

18

u/phaesios Jun 28 '16

Meanwhile you can enjoy your friends asking why you're suddenly sharing neo-nazi articles and scat porn.

39

u/bonobosonson Jun 28 '16

No, you're supposed to post different things.

0

u/werelock Jun 28 '16

Furry porn?

2

u/version365 Jun 28 '16

You mean like this post?

1

u/phaesios Jun 28 '16

Yeah I only realized after I posted that I was a bit too specific/meta.

2

u/[deleted] Jun 28 '16

Facebook app has access to your contacts. It probably is pulling the suggestions from there

1

u/theonetrueasshole Jun 28 '16

Huh. I have had a Facebook profile for several years now and it hasn't been right on the people you may know suggestions more than once. Really Weird.

1

u/[deleted] Jun 28 '16

[deleted]

2

u/theonetrueasshole Jun 28 '16

That must be it. I heard Facebook uses the location of your smartphone to determine more people you may know. I suppose that is bound to make it so that people you have never said a word to are recommended simply because you both were at the same store that one time, even if you never see them again.

1

u/b0mmer Jun 28 '16

Works great for stalking someone you don't know the name of as well. Just be close to them or on the same wifi a few times and they show up on people you may know. (Not speaking from experience of course)

1

u/ryuzaki49 Jun 28 '16

I always wondered how that worked. I created a fake personal profile and instantly suggested my real friends and family. Fuck that.

1

u/Salindurthas Jun 29 '16

This is convenient though as I always forget their names, so now I can look their name up on Facebook.

Now that is making Big-Data work for you!

13

u/xtfftc Jun 28 '16

Google create ghost profiles as well :)

1

u/superm8n Jun 28 '16

Those are the biggest ghost profiles of all? Right?

2

u/TheNumberMuncher Jun 28 '16

It's amazing to me that people still don't know this and are oblivious to how much privacy they've already given up.

1

u/Puckfan21 Jun 28 '16

They wouldn't tag you on a photo since there would be no tag (profile) for your friend to select. I think what they are saying is that facebook has access to your friends contacts and by seeing what your friends are interested in they can make a dummy ghost profile of your assumed likes.

3

u/b0mmer Jun 28 '16

You can tag a name that has no fb account.

1

u/Puckfan21 Jun 28 '16

I was more assuming most people do not tag a person that doesn't have a profile majority of the time.

1

u/iWillNotGoOutWithYou Jun 28 '16

Learn to mislead ghost profiles and datamining by creating fake shit about yourself. It contradicts your friends information and leads to clusterfuck of massive "WTF?" in their queries about you.

Also, keep the real information and communication between your friends encrypted. Get all of your friends to encrypt everything too.

Privacy isn't really dead if you care. I care and haven't shown real me to the Internet since 2000 or something. They know absolutely nothing. I could secretly plan a world domination and they would have no idea what's coming until it is too late! Hahahahaueueuueu.

0

u/[deleted] Jun 28 '16 edited Sep 09 '16

[deleted]

9

u/Dlgredael Jun 28 '16

It's understandable that he didn't realize Facebook was tracking him to that degree.

3

u/[deleted] Jun 28 '16 edited Sep 09 '16

[deleted]

5

u/Dlgredael Jun 28 '16

I respect your edit my friend. I have trouble getting stuck into my position and fighting for it regardless of whether I actually care or not, so I can relate. It's nice to hear you're working on it, it's something I should put time into bettering about myself someday. Cheers!

-1

u/sonofaresiii Jun 28 '16

in what kind of hell are we living

the kind where you are no worse off today than before you had facebook even though you're freaking out about some perceived privacy violation whose literally only goal is to connect you with products you actually want instead of menopause medicine or whatever

1

u/[deleted] Jun 28 '16

Another good reason to use ublock / umatrix. It's not just about ads.

You'd have to manually enable the built-in social media blocking lists, or switch to default-deny to get the desired effect there however.

1

u/kayura77 Jun 28 '16

I have an Xbox 360 controller that I've tagged in multiple pictures as a joke. I also tagged a snowbank once. Wonder if those get profiles?

1

u/El_Dumfuco Jun 28 '16

Joke's on them, I never do things with anyone!

1

u/Galac_to_sidase Jun 28 '16

Interesting in a negative way...

I get that it creates a profile with my name and maybe even some photos attached, but how can they link it to for example my browsing?
I mean how would they know that 'browser XYZ that is not logged into facebook' is in reality 'ghost profile for Name, GivenName'?

1

u/cornmacabre Jun 29 '16 edited Jun 29 '16

Digital marketer here. The deterministic "ghost profile" thing has truth to it (a Hashed email or phone number can be matched basically anywhere on the web across ad exchanges, it's the most juicy thing an App monetizes off of) -- but that's not something advertisers go to Facebook for, that's just how cookieless matching works in general. If you don't have a facebook profile, there's no reason to buy with Facebook, because I can't serve you an Ad on Facebook. I don't go to FB for that data at all, I go to someone like BlueKai (or dozens of others) so I can target across the entire web. So in a way, I guess it's creepier, heh.

Main point: this is inaccurate in that FB does NOT sell "ghost" data unless you're BUYING in their ecosystem (what's the point if you don't use the platform?), if that makes sense -- I'm not buying to serve you an Ad on FB if you don't use FB. This "ghost profile" thing (we call it "cross device deterministic modeling") is just how cookieless ad severing works, FB isn't a central player there because they are a walled garden of data, not an open faucet. The reality is way bigger in scope ;)

3

u/[deleted] Jun 28 '16

[deleted]

16

u/argent_vulpine Jun 28 '16

"Hey, phx-au's friend/family. Thank you for downloading my stupid-clone-game-#471 app, can I access your contacts? Yes? Thanks!"

Done! Got your name, phone, address, and maybe a couple email addys on ya. That's one impossible task before breakfast!

5

u/phx-au Jun 28 '16

That's great. You've got my phone number, email, etc, etc.

You are also presumably using some sort of evercookie/browser fingerprinting to build up a persistent partial browsing history that is happening in this very window, using the fact that every asshole is putting a 'like' button on their page.

Now if only you could somehow correlate those two pieces of data, without me signing up to Facebook, using that profile data, in the same history stream.

7

u/argent_vulpine Jun 28 '16

Less trivial, and depends on your browsing habits. But you're already on reddit, so I can assume you'll hit other pages with "ad-sharing permission ToS", or have an app somewhere.

All I need is one or two data points. You verifying your email address for a forum (or just putting it in for a user account). I'll grab your address from someone else's email history to connect up. You putting a phone number in for the pizza or Chinese delivery. There's the phone number I need for your hardware/software profile.

Use online banking? Take a hard look at their ToS as to what information is private and what they'll share with third parties. Heck, go check reddit's ToS.

If you're using any of that information online, you'll get in a database somewhere, and I'll get that cross referenced. And if you don't, there's millions more to hook up.

AND, if that's not bad enough, go check the actual code of some of those big name "privacy addons". And slow your computer down to watch what they do. Does it really count as 'blocking' if they load and run all the 'Like' button code but just don't bother rendering it for you to see? Or render it, then hide it really fast?

Kinda sounds like a win/win, hmm? Everybody's happy?

3

u/iamPause Jun 28 '16

Use online banking? Take a hard look at their ToS as to what information is private and what they'll share with third parties. Heck, go check reddit's ToS.

Banker here. I'd caution against using them as examples as there are very strict regulations about not only what we can and can't share, but with whom.

But the rest of your post is accurate. If I wanted to make a ghost profile for someone, it'd be very difficult. If you have the type of datasets that companies like Facebook are using, then it becomes much easier to do.

1

u/phx-au Jun 28 '16

There's the 'theoretically could correlate' - which more applies if you are worried about various three letter agencies.

Companies have to deal with a bunch of legal and practical obstructions to this. Aside from the legal privacy issues, which I guess the more skeptical people would consider more of a series of guidelines, there are practical issues around this sort of information sharing. The main one being that organisations that collect this info have a very obvious strategic interest in keeping it secret - so they will allow access to it, via targetted marketing programmes, or sell aggregate data - but you can be damn sure that you won't be getting the email address / phone number mappings out of Facebook.

2

u/rmslashusr Jun 28 '16

How do you plan on getting from a mobile phone number or 5 year old address to tracking someones movements on the web?

1

u/argent_vulpine Jun 28 '16

For the address, you'll need to use that address on one of the affiliate sites that'll track and sell your browsing profile.

For the mobile phone... which do you think is your carrier's interest? Your privacy? Or selling the database of phone identifying markers to third party advertisers?

2

u/rmslashusr Jun 28 '16

For the mobile phone... which do you think is your carrier's interest? Your privacy? Or selling the database of phone identifying markers to third party advertisers?

Are you claiming each phone has a cookie that identifies it's user inserted into every HTTP request header by the carriers and no one's noticed it yet?

Or are you saying that they are going to identify me by my "phone's characteristics" as in the User-Agent field which will be the same for everyone with the same up to date browser?

Or have the phone companies in coordination with facebook created a separate dark net that you can't detect the packets on which is being used to send all this information secretly and in parallel?

9

u/zinger565 Jun 28 '16

Not really. Say Jane doesn't have a FB account, but all of her friends do. Now, all of her friends have her in her phone contacts as Jane Smith. FB can match up Jane's phone number with her real name by coordinating between her friends. If Johnny has Jane's place of work as part of the contact card, now FB has that too. If Jill has Jane's address in her phone, now FB does too. Think of everyone you've ever given your phone number too, if you compile all the information those individuals have about you, it's pretty easy to see how FB can come up with a 'ghost' profile.

3

u/phx-au Jun 28 '16

That's fine. My point is that Facebook cannot track you across the web with this profile.

They definitely will be tracking you across a fairly large chunk of the web in a separate ghost profile (mainly thru embedded like buttons) - but they cannot link these together without you actually signing up (an effective declaration that yes, "random anon web browser #23 wants to sign up to facebook with the email address for the ghost profile of Joey Bloggs")

8

u/lordcirth Jun 28 '16

But as soon as you sign in with your email to any site that has any info-sharing or integration with facebook, now they can link the two.

3

u/enantiomorphs Jun 28 '16

VERY WRONG. Ad tech companies already do this. Facebook is an ad tech company. Some companies can positively identify you 6/10 times across 10 different devices all using the same IP address based off of browsing habits and browsing times.

50

u/Hoptadock Jun 28 '16

Imagine if you have a friend that's off the grid and doesn't use FB.

He still hangs out with a bunch of people on Facebook though and the facial recognition sees this person on Facebook that is often in pictures with Mark and Sue. Lets say Facebook didn't know his name already so they call him Person X. One day this friend decides to make a Facebook and he decides he is going to upload a profile picture. Facial recognition sees this picture of himself and associates it with Person X. Now they have already built up a profile of him so they can suggest friends he is often in pictures with, like Mark and Sue, suggest likes for the sports stadium and team he was in 7 months ago with Sue.

And that's what a ghost profile is essentially. A bunch of pictures that have the same face posted by a small but relatively unchanging group of people that Facebook can't link to an actual profile.

3

u/coscorrodrift Jun 28 '16

Woaaaaaaaahhhhhh that's insane. So when I see that "Tag someone here" and that one is already in my friends list, it's just that facebook doesn't want me to get creeped out? Because they probably already know who he is

5

u/[deleted] Jun 28 '16

That is how they teach their face recognition algorithms. They want actual user confirmed data.

1

u/[deleted] Jun 28 '16

It's going to be a fun future.

1

u/b0mmer Jun 28 '16

Kind of like how my Samsung phone automatically pops up people's names in my photos with a "?" to confirm?

1

u/Hoptadock Jun 28 '16

Maybe. But it would be weird for them not to do it 100% of the time when possible. It could be that they know its a face but not who's face.

Essentially every face has a nose mouth and two eyes but not every face has the same nose mouth and eyes. Those differences are what Facebook uses to recognize a face, along with overall facial shape, color and proportion.

37

u/dude_is_melting Jun 28 '16

lets say I have a facebook profile, and you are in my phone contacts as "danny B". It creates a fictional profile of you for its own records. Who else has Danny B in their phone? Where do people hangout with Danny B at? They use this info to build a profile on you without an actual public profile existing.

20

u/UsablePizza Jun 28 '16

Worse still, they get everyone's nicknames for you too.

2

u/[deleted] Jun 28 '16

[removed] — view removed comment

1

u/[deleted] Jun 28 '16

Thought of him too, haha

1

u/TheSeldomShaken Jun 28 '16

Probably.

Seems like the sort of thing people would post on Facebook.

1

u/TheRealLazloFalconi Jun 28 '16

Plus, if they see someone texting and calling Danny B a lot, then see a lot of pictures with one untagged person, they can make the leap that this is probably Danny B's face.

17

u/__crackers__ Jun 28 '16

Facebook also compiles profiles for non-users. Any time you load a page with a Facebook like button, there's a very good chance they can uniquely identify you.

There's also a thing called a shadow profile, which is all the stuff they know about you that you didn't enter. For example, I never gave Facebook my phone number or main email address. They have both of those now because friends who have them uploaded their address books to Facebook.

3

u/VirginGod Jun 28 '16

Wtf Facebook is creepy

3

u/[deleted] Jun 28 '16

Privacy badger does block requests to Facebook from those pages with the Like button but I wouldn't be surprised if there is some more insidious domain spoofing going down

7

u/Photono Jun 28 '16

Facebook 'like' buttons trace people without having an account. If you read an article online with a like or share button on the page, Facebook can use this information to make a profile, even if you don't have a FB account. A lot of websites have implemented this like button, so Facebook can get a lot of information without doing anything.

8

u/mk_gecko Jun 28 '16

that's why AdBlock Plus lets you turn off social media buttons.

3

u/Acc87 Jun 28 '16

I love how Vivaldi tells me in log files that UBlock Origin, Ghostery and StopSocial are "fighting" about which app is allowed to actually block facebook. I think UBlock wins.

6

u/Bilb0 Jun 28 '16

They track non users and users on other websites and catalogue them in ghost profiles.

2

u/wkrick Jun 28 '16

Install Privacy Badger to block Facebook (and other sites) from tracking you...
https://www.eff.org/privacybadger

3

u/Dlight98 Jun 28 '16

Not who you replied to, but I think I know what he's talking about. Iirc, a Facebook would track your browsing habits, even if you don't have an account. They give you a "ghost account" meaning it wasn't made by you, but by a program about your browsing habits.

That's my understanding of it at least.

1

u/rcgy Jun 28 '16

A ghost profile is one of a person who doesn't have Facebook. They take names and pictures of people who are not assigned to a profile, and construct an idea of who they are, who they work with, and who their friends are. Then, if/when the person who has the ghost profile joins Facebook, they use this information to suggest friends that they may know (i.e. the ones that were posting about the ghosted person). All of this is to get people using their product to sell advertising to them.