Discussion:
OT: Facebook under investigation over data refusal
(too old to reply)
Wolf K
2018-08-27 13:20:03 UTC
Permalink
https://www.theregister.co.uk/2018/08/24/irish_data_protection_commish_opens_inquiry_on_facebook_data_transparency/
--
Wolf K
kirkwood40.blogspot.com
Complexity is not a condition to be tamed, but a lesson to be learned.
(James Bridley, 2018)
Wolf K
2018-08-27 14:43:48 UTC
Permalink
Post by Wolf K
https://www.theregister.co.uk/2018/08/24/irish_data_protection_commish_opens_inquiry_on_facebook_data_transparency/
From the article:

"Facebook slurps information about your device, the websites you
visited, apps you used and ads you've seen via Facebook business tools
and plug-ins, such as the Like button, on partner sites.

This is stored alongside an identifier for that person, *whether you
have an account or not*, and whether you're logged in or not."

Emphasis added.
--
Wolf K
kirkwood40.blogspot.com
Complexity is not a condition to be tamed, but a lesson to be learned.
(James Bridley, 2018)
Mayayana
2018-08-27 15:38:32 UTC
Permalink
"Wolf K" <***@sympatico.ca> wrote

| This is stored alongside an identifier for that person, *whether you
| have an account or not*, and whether you're logged in or not."
|

That's been known for some time. FB pioneered
the sleazy trick of putting buttons on webpages
in iframes, so that they could run cross-site
scripting and set 1st-party cookies, given default
browser settings. It's sensible for anyone who
doesn't use FB to block them in a HOSTS file.
Here's what I use in Acrylic DNS proxy HOSTS:

127.0.0.1 *.fbcdn.net
127.0.0.1 *.facebook.net
127.0.0.1 *.facebook.com
127.0.0.1 *.fb.com

Same idea in regular HOSTS, but you'll need to
track down all the subdomain strings used.

There was a related piece in the NYT business
section today about how the big tech companies
are calling on the Trump people to get an anti-privacy
law passed before the California privacy law goes
into effect. Their strategy is to talk about how
they now see the value of privacy.... but let's
make it a voluntary self-policing.... and let's
pass a feredal law to that effect that can block
state laws from enforcing privacy regulations.
Jesper Kaas
2018-08-27 18:48:45 UTC
Permalink
On Mon, 27 Aug 2018 11:38:32 -0400, "Mayayana"
Post by Mayayana
It's sensible for anyone who
doesn't use FB to block them in a HOSTS file.
127.0.0.1 *.fbcdn.net
127.0.0.1 *.facebook.net
127.0.0.1 *.facebook.com
127.0.0.1 *.fb.com
Sounds great Mayayana. Thanks.
Hope I understand you correct: I have installed Acryllic DNS and put
the list you provided into it's Hosts-file, and restarted the Acryllic
service. Have I then blocked all the facebook stuff you see on almost
every website from tracking me?
Downside is that it is then imposible to go to facebook with this
installed and Acryllic service running. Need to comment out the lines
with facebook in the Acryllic Hosts-file. Do you se an easy way to
switch between running with and without blocking facebook?
I used to run NoScript in Firefox, but that has started preventing
logging in with the Danish NemId used for logging in to important
services for Danish citizens, for example the tax authorities.
--
Jesper Kaas - ***@neindanke.online.no
Mayayana
2018-08-27 19:37:09 UTC
Permalink
"Jesper Kaas" <***@neitakk.online.no> wrote

| >127.0.0.1 *.fbcdn.net
| >127.0.0.1 *.facebook.net
| >127.0.0.1 *.facebook.com
| >127.0.0.1 *.fb.com
| Sounds great Mayayana. Thanks.
| Hope I understand you correct: I have installed Acryllic DNS and put
| the list you provided into it's Hosts-file, and restarted the Acryllic
| service. Have I then blocked all the facebook stuff you see on almost
| every website from tracking me?

As far as I know. I haven't done any recent checking
to see if they have additional domain names in use.
That's possible. Things change and increasingly companies
are trying to obfuscate. For instance, I've seen javascript
that did something like include a base-64 string that
then had to be decoded and rebuilt before I could figure
out that the page was going to try to call doubleclick.net.
The actual URL was deeply hidden. Maybe to fool adblockers?
I don't know. (I've never used an adblocker.)

I keep a vbscript on my desktop to search pages and
occasionally drop one onto it to collect new URLs. It
just searches through the page text for anything that
looks like a URL. Then it shows me the list in case I
want to add any to HOSTS. For instance, as a quick
test I just went to cbsnews.com. I got these 4
ad/spy URLs that I'd never seen before:

127.0.0.1 *.avature.net
127.0.0.1 c.evidon.com
127.0.0.1 *.sonobi.com
127.0.0.1 *.indexww.com

It's possible that there was also an obfuscated FB
URL that's new, but I don't enable script so my vbscript
can't tell me. CBS news did have www.facebook.com
in its page.

So.... Those 4 FB domains are all that I know of, but
I'm not certain. You'd have to do some research to
be sure.

| Downside is that it is then imposible to go to facebook with this
| installed and Acryllic service running. Need to comment out the lines
| with facebook in the Acryllic Hosts-file. Do you se an easy way to
| switch between running with and without blocking facebook?

No. Unfortunately that's the tradeoff. I don't use
FB, so for me it's just a matter of blocking their
surveillance. But as you say, to allow them requires
commenting out the HOSTS entry and then stopping/
starting Acrylic.

| I used to run NoScript in Firefox, but that has started preventing
| logging in with the Danish NemId used for logging in to important
| services for Danish citizens, for example the tax authorities.

It's getting worse. I see more and more sites that
act up without script.

Some are due to incompetence.
In that category is junk like Wix-hosted sites that aren't
really websites. They're created with drag-drop tools
online and hosted from wix.com as a javascript package.

Some are deliberate. Some media sites now do things
like putting the actual text of the webpage inside
script. So if you don't enable script you get no page.
And that keeps changing. Forbes.com used to
do that. Then they started just blocking noscript visitors.
Lately their site seems to work. Wired.com didn't work
for awhile. Now it does. Atlantic used to be fine. Now
it's a mess but I can read it if I disable CSS. About
once per week, WashingtonPost gives me a blank page.
They're trying to force me to subscribe, but ironically
I can't see the page. I only see white. I only know
what they're up to because I checked it without CSS. :)

Then there are what I think of as the risky ones. Things
like wordpress sites (prone to vulnerabilities and generally
built by people who don't know what they're doing) that
don't work without script.
The most common problem I'm seeing lately is CSS,
either faulty or deliberately broken without script, that
must be disabled in order to see a page. I have mixed
feelings about that. so many pages are poorly designed
these days, anyway, that I often prefer to read them
without CSS. For instance, this article I saw yesterday
at NYT is one of the better ones:

https://www.nytimes.com/2018/08/22/science/neanderthals-denisovans-hybrid.html

WashPo is usually worse. But it's still a heavily
seriffed font, too big, and triple spaced. It's easier
to read if I disable the CSS and then read it as
verdana with a 1.3 line-height.

One of the weirder ones is npr.org. That's a non-profit,
educational organization in the US, connected with US
public TV. They started showing me a choice: Enable
script and agree to spying, or view their news page
as a simple list of links. They're actually telling me
that if I don't agree to be spied on then I'll be
punished by seeing a clear and simple version of their
articles. (It's not as though the photos are usually
relevant, anyway.) I thought it was strange that a
non-profit should require me to accept spyware ads,
but I guess it's legal.

I think you just have to do what works best for you.
I like to use 2 Mozilla browsers. Pale Moon is set up
to block script/cookies/iframes/3rd-party files, along
with the Secret Agent extension. Then I have Firefox
with moderate settings and NoScript. I use that if
I have to allow script somewhere. Usually it will work.
But I don't use Twitter, FB, Snapchat, etc, so I
just put those in HOSTS.

The other day I had an experience similar to yours
with the Danish site. I started reading something
on reddit and decided to join so that I could join
the conversation. After switching to FF and enabling
several things, it still wouldn't work. I wasn't seeing
a captcha that I apparently needed to solve. Maybe
I needed to allow "suprercookies"? I don't know. I
finally gave up. They were requiring me to have no
security or privacy at all in order to use their site
and that simply isn't defensible on their part, so I
have to assume dishonest intentions.

With very extreme sites I use another computer.
Sort of a "sacrificial lamb" that has no private data
on it. Example: A couple of years ago I was shopping
for a new pickup truck. The car dealer sites just
wouldn't work. So I went onto the other computer,
with all the crap enabled. But it's got so bad that
sometimes I don't even know what I've blocked that's
causing problems. And most sites won't say.
Shadow
2018-08-27 20:42:09 UTC
Permalink
On Mon, 27 Aug 2018 15:37:09 -0400, "Mayayana"
Post by Mayayana
| >127.0.0.1 *.fbcdn.net
| >127.0.0.1 *.facebook.net
| >127.0.0.1 *.facebook.com
| >127.0.0.1 *.fb.com
| Sounds great Mayayana. Thanks.
| Hope I understand you correct: I have installed Acryllic DNS and put
| the list you provided into it's Hosts-file, and restarted the Acryllic
| service. Have I then blocked all the facebook stuff you see on almost
| every website from tracking me?
As far as I know. I haven't done any recent checking
to see if they have additional domain names in use.
https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all

I was going to post the full list, but it was too big ....
;)
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Mayayana
2018-08-27 22:37:55 UTC
Permalink
"Shadow" <***@dow.br> wrote |
|
https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all

Nice. Thanks.

Loading...