Facebook can track you even after logout -hacker

Facebook users, be warned: the social network giant may still be able to track you even after you log out of your session. This was the finding of an Australian hacker who said Facebook's "cookies" —bits of information saved on a user's computer— still lets Facebook keep tabs.

"(L)ogging out of Facebook only de-authorizes your browser from the web application, a number of cookies (including your account number) are still sent along to all requests to facebook.com. Even if you are logged out, Facebook still knows and can track every page you visit. The only solution is to delete every Facebook cookie in your browser, or to use a separate browser for Facebook interactions," hacker Nik Cubrilovic said in a blog post.

He also noted Facebook's new application programming interface (API) allows applications to post status items to one's Facebook timeline without user intervention.

This may raise a privacy concern that "because you no longer have to explicitly opt-in to share an item, you may accidentally share a page or an event that you did not intend others to see."

Cubrilovic said that during logout, a number of Facebook cookies are not being deleted.

He noted two cookies (locale and lu) are given new expiry dates, and three new cookies (W, fl, L) are set.

When he made a subsequent request to www.facebook.com as a "logged out" user, he said the primary cookies that identify him as a user are still there.

"This is not what 'logout' is supposed to mean - Facebook (is) only altering the state of the cookies instead of removing all of them when a user logs out," he said.

Such a setup allows a supposedly logged-out user to still send his or her account ID to Facebook when he or she visits any page with a Facebook "Like" button, or share button, or any other widget.

"The only solution to Facebook not knowing who you are is to delete all Facebook cookies," he said.

Log-out experiments

Cubrilovic recalled an experiement where he created a number of fake Facebook accounts after logging out of his browser.

After using the fake accounts for some time, he found that they were suggesting his real account to him as a friend.

"Somehow Facebook knew that we were all coming from the same browser, even though I had logged out," he said.

He said these are serious implications if one uses Facebook from a public terminal.

"If you login on a public terminal and then hit 'logout,' you are still leaving behind fingerprints of having been logged in. As far as I can tell, these fingerprints remain (in the form of cookies) until somebody explicitly deletes all the Facebook cookies for that browser," he said.

He pointed out Facebook knows every account that has accessed Facebook from every browser and is using that information to suggest friends to a user.

"The strength of the 'same machine' value in the algorithm that works out friends to suggest may be low, but it still happens. This is also easy to test and verify," he said.

Reported to Facebook

Cubrilovic said he reported this issue to Facebook in a detailed email but got the "bounce-around."

He said the entire process was so flaky and frustrating that he did not bother sending them two XSS holes that he have also found in the past year.

"The question is what it will take for Facebook to address privacy issues and to give their users the tools required to manage their privacy and to implement clear policies - not pages and pages of confusing legal documentation, and 'logout' not really meaning 'logout,'" he said. — TJD, GMA News

Loading...

Editor’s note:Yahoo Philippines encourages responsible comments that add dimension to the discussion. No bashing or hate speech, please. You can express your opinion without slamming others or making derogatory remarks.

  • Halt Indonesia drug executions until graft claims probed: Australia
    Halt Indonesia drug executions until graft claims probed: Australia

    Australia on Monday urged Indonesia to ensure all legal processes have been cleared of corruption before executing two of its nationals as bribery allegations surfaced regarding their drug smuggling trial. Foreign Minister Julie Bishop spoke to her Indonesian counterpart Retno Marsudi on Sunday evening while Prime Minister Tony Abbott has written to President Joko Widodo to again plead for the executions to be halted. "Bali Nine" drug traffickers Myuran Sukumaran and Andrew Chan could face …

  • Pagasa: Drought may worsen
    Pagasa: Drought may worsen

    The drought in 12 already dry areas in the country is expected to worsen as the summer season peaks next month, the Philippine Atmospheric, Geophysical and Astronomical Services Administration (PAGASA) warned yesterday. In an advisory, PAGASA said the provinces of Albay, Bataan, Batangas, Biliran, Cavite, Cebu, Ilocos Norte, Leyte, Misamis Occidental, Pampanga, Zamboanga del Norte and Zamboanga del Sur will continue to receive “way below” or “below normal” rainfall in May. PAGASA defines …

  • Maximum restraint for Phl troops in West Phl Sea
    Maximum restraint for Phl troops in West Phl Sea

    The military has advised its pilots conducting surveillance in the West Philippine Sea to exercise maximum restraint even if they are being bullied by Chinese troops. Armed Forces spokesman Brig. Gen. Joselito Kakilala said all actions of the pilots should be consistent with the declaration of conduct signed by claimant countries. Armed Forces public affairs chief Lt. Col. Harold Cabunoc said the Philippines should remain on moral high ground when it comes to the territorial dispute. A …

  • MMDA simulates rescue march after quake, tsunami
    MMDA simulates rescue march after quake, tsunami

    The Metro Manila Development Authority (MMDA) yesterday led the annual rescue march from Quezon City to Manila, giving rescue volunteers a glimpse of possible scenarios if the metropolis is hit by a strong quake or is inundated by a tsunami. Cora Jimenez, MMDA general manager, said 700 volunteer rescuers walked from the Quezon City memorial circle to the Bonifacio monument in front of the Manila city hall to simulate a response-exercise to a magnitude 7.2 earthquake. Renato Solidum, …

  • Islamic State threatens Mindanao, Phl tells Asean
    Islamic State threatens Mindanao, Phl tells Asean

    Foreign Affairs Secretary Albert del Rosario bared yesterday before the Association of Southeast Asian Nations (ASEAN) reports of the Islamic State of Iraq and Syria (ISIS) threat to the Philippines through the Black Flag Movement in Mindanao. Speaking before ASEAN foreign ministers, Del Rosario said the ISIS threat to Philippine security is real rather than imagined because of the Black Flag Movement’s pledge of allegiance to ISIS leader Abu Bakr al-Baghdadi. …

  • ‘Chinese reclamation affecting Phl’s energy security bid’
    ‘Chinese reclamation affecting Phl’s energy security bid’

    China’s occupation and buildup of its military structures in the West Philippine Sea and South China Sea is causing the country’s top energy official to get the jitters as the encroachment is seen as a huge dent on the Philippines’ efforts to achieve energy security. “It is a concern but if we don’t bring it to the United Nations, where will we bring it? We cannot bang heads with them,” Energy Secretary Carlos Jericho Petilla told The STAR in an interview over the weekend. The US Energy …

  • Phl to Asean: China getting de facto control
    Phl to Asean: China getting de facto control

    The Philippines yesterday urged the Association of Southeast Asian Nations (ASEAN) to unite and stop China’s massive reclamation in disputed waters as it will give China “de facto control” over the area and cause $100 million in marine wealth losses annually. At the ASEAN Foreign Ministers’ Meeting here, Foreign Affairs Secretary Albert del Rosario told his counterparts that the situation in West Philippine Sea had worsened just a year after the Philippines began to draw international …

  • Gov’t spends P11.8 M for Noy’s Asean trip
    Gov’t spends P11.8 M for Noy’s Asean trip

    The government has allotted about P11.8 million for President Aquino’s attendance at the 26th Association of Southeast Asian Nations (ASEAN) summit in Kuala Lumpur and Langkawi in Malaysia from April 26 to 28. “President Aquino’s participation to the 26th ASEAN Summit is important as the region gears toward the creation of an ASEAN community, which is envisioned to provide new opportunities for the peoples of this region, including the Philippines,” Ochoa said in a statement. He was with …

POLL

Should Aquino be held accountable over the Mamasapano operations?

Loading...
Poll Choice Options