Facebook answers privacy flap over leftover cookies

Sep 27, 2011 by Nancy Owano report

(PhysOrg.com) -- A Sunday blog post by self-described hacker, writer and entrepreneur Nik Cubrilovic has set off a firestorm of discussions and accusations that Facebook violates user privacy in the form of tracking via leftover cookies. Cubrilovic accused Facebook of using cookies to track users even after users have logged off. “Logging out of Facebook only de-authorizes your browser from the web application,” he said. "A number of cookies (including your account number) are still sent along to all requests to facebook.com."

Facebook “alters” tracking cookies when you log out instead of deleting them.

Cubrilovic’s findings were from his analysis of HTTP headers sent by browsers to Facebook.com. The solution, he said, is to delete every Facebook cookie in your browser, or to use a separate browser for Facebook interactions.

The story quickly propagated as did news of Facebook employee responses that Facebook’s millions of users should not be bothered.

Facebook did not deny that cookies remain even after the user has logged out. What Facebook did seek to correct was any notion that leftover cookies were used to snoop.

Facebook engineer Arturo Bejar said that Facebook uses data from logged-out cookies to prevent spamming, phishing and other security risks.

An extended Facebook response with similar assurances came from Gregg Stefanci, a Facebook engineer. Stefani defended Facebook's intentions as user-centric, and not for profiteering by snooping.

"We don’t have an ad network and we don’t sell people’s information.” Stefanci said. "Rather, the logged-out cookies are used for safety and security protections."

One example of user protection, he said, was disabling registration if an underage user tries to re-register with a different birth date. Another purpose was helping people recover hacked accounts, and identifying shared computers to discourage the use of 'Keep me logged in.'

While Facebook staffers’ reactions defending have been quite clear, a stinging sentence on Cubrilovic's Sunday blog is feeding news posting after news posting: “This is not what 'logout' is supposed to mean.”

The cookies flap comes at a time when privacy watchdogs are worried about Facebook's new Timeline feature and are preparing a letter to the Federal Trade Commission to look into the sharing of information via Timeline. The Electronic Information Center is especially concerned over Timeline, a new design for a profile page. Jeff Chester of the Center for Digital Democracy believes that the redesign is part of an effort to boost data collection prior to an IPO.

Explore further: New social networks connect cooks and diners

Related Stories

AOL integrates Facebook chat with AIM

Feb 10, 2010

(AP) -- As part of an ongoing effort to improve its user experience, Internet company AOL Inc. is letting users of its AIM instant-messaging service chat with friends on Facebook.

Social networking aggregator sues Facebook

Jul 10, 2009

(AP) -- In a counter-punch to the world's biggest online hangout, a small Web company called Power.com has sued Facebook, saying it doesn't follow its own policy of giving users control over their content.

Facebook tightens user security

Jan 26, 2011

Facebook on Wednesday announced heightened privacy controls for members of the world's largest online social network.

Recommended for you

Brazil enacts Internet 'Bill of Rights'

1 hour ago

Brazil's president signed into law on Wednesday a "Bill of Rights" for the digital age that aims to protect online privacy and promote the Internet as a public utility by barring telecommunications companies ...

Brazil passes trailblazing Internet privacy law

Apr 23, 2014

Brazil's Congress on Tuesday passed comprehensive legislation on Internet privacy in what some have likened to a web-user's bill of rights, after stunning revelations its own president was targeted by US ...

User comments : 5

Adjust slider to filter visible comments by rank

Display comments: newest first

Doug_Huffman
2.4 / 5 (5) Sep 27, 2011
Do not trust deFaceDbook. Do not use Facebook.
stealthc
1 / 5 (1) Sep 27, 2011
the solution is to use the tor standalone version of firefox -- click on it to establish a connection in a standalone version of firefox, takes all of the headache over fiddling with settings and just lets you browse without their nosing into your business.
deepsand
2.7 / 5 (12) Sep 27, 2011
More cookie paranoia.

Firstly, "log-out" does not mean "clear persistent cookies," but only "clear session cookies."

Secondly, cookies cannot be altered or read by anyone other than the Domain Name (DN) that created them, and then only when one is connected to that DN. The notion that idle cookies are somehow being used is urban myth.
Ricochet
5 / 5 (1) Sep 28, 2011
I experienced a similar issue with Mapquest. I had a packet sniffer running that scanned outbound packets for my personal info, etc... it caught the website trying to send every address I typed into their search pages to the ad agency they ran through. That was about 5 years ago, and I haven't used them since, so I don't know if that's a current practice... maybe someone with a packet sniffer can check it?
deepsand
2.8 / 5 (12) Sep 28, 2011
That:
Has nothing to do with cookies; and,
Can be done client side, as was your experience, or server side without your knowledge.

Either way such data collection is SOP. If that bothers one, DO NOT USE ANYTHING GOOGLE, as they are egregiously aggressive in this regard.

More news stories

Brazil enacts Internet 'Bill of Rights'

Brazil's president signed into law on Wednesday a "Bill of Rights" for the digital age that aims to protect online privacy and promote the Internet as a public utility by barring telecommunications companies ...

SK Hynix posts Q1 surge in net profit

South Korea's SK Hynix Inc said Thursday its first-quarter net profit surged nearly 350 percent from the previous year on a spike in sales of PC memory chips.

FCC to propose pay-for-priority Internet standards

The Federal Communications Commission is set to propose new open Internet rules that would allow content companies to pay for faster delivery over the so-called "last mile" connection to people's homes.

When things get glassy, molecules go fractal

Colorful church windows, beads on a necklace and many of our favorite plastics share something in common—they all belong to a state of matter known as glasses. School children learn the difference between ...

FDA proposes first regulations for e-cigarettes

The federal government wants to prohibit sales of electronic cigarettes to minors and require approval for new products and health warning labels under regulations being proposed by the Food and Drug Administration.