Facebook answers privacy flap over leftover cookies

(PhysOrg.com) -- A Sunday blog post by self-described hacker, writer and entrepreneur Nik Cubrilovic has set off a firestorm of discussions and accusations that Facebook violates user privacy in the form of tracking via leftover cookies. Cubrilovic accused Facebook of using cookies to track users even after users have logged off. “Logging out of Facebook only de-authorizes your browser from the web application,” he said. "A number of cookies (including your account number) are still sent along to all requests to facebook.com."

Facebook “alters” tracking cookies when you log out instead of deleting them.

Cubrilovic’s findings were from his analysis of HTTP headers sent by browsers to Facebook.com. The solution, he said, is to delete every Facebook cookie in your browser, or to use a separate browser for Facebook interactions.

The story quickly propagated as did news of Facebook employee responses that Facebook’s millions of users should not be bothered.

Facebook did not deny that cookies remain even after the user has logged out. What Facebook did seek to correct was any notion that leftover cookies were used to snoop.

Facebook engineer Arturo Bejar said that Facebook uses data from logged-out cookies to prevent spamming, phishing and other security risks.

An extended Facebook response with similar assurances came from Gregg Stefanci, a Facebook engineer. Stefani defended Facebook's intentions as user-centric, and not for profiteering by snooping.

"We don’t have an ad network and we don’t sell people’s information.” Stefanci said. "Rather, the logged-out cookies are used for safety and security protections."

One example of user protection, he said, was disabling registration if an underage user tries to re-register with a different birth date. Another purpose was helping people recover hacked accounts, and identifying shared computers to discourage the use of 'Keep me logged in.'

While Facebook staffers’ reactions defending Facebook have been quite clear, a stinging sentence on Cubrilovic's Sunday blog is feeding news posting after news posting: “This is not what 'logout' is supposed to mean.”

The cookies flap comes at a time when privacy watchdogs are worried about Facebook's new Timeline feature and are preparing a letter to the Federal Trade Commission to look into the sharing of information via Timeline. The Electronic Privacy Information Center is especially concerned over Timeline, a new design for a profile page. Jeff Chester of the Center for Digital Democracy believes that the redesign is part of an effort to boost data collection prior to an IPO.

© 2011 PhysOrg.com