Forgot your password?
typodupeerror
Facebook Privacy Social Networks Your Rights Online

Heise's 'Two Clicks For More Privacy' vs. Facebook 206

Posted by timothy
from the like-grit-in-the-eye-of-sauron dept.
First time accepted submitter FlameWise writes "Yesterday, German technology news site Heise changed their social 'like' buttons to a two-click format (Original in German). This will effectively disable unintentional automatic tracking of all page visits by third-party social sites like Facebook, Twitter or Google+. Less than 24 hours later over 500 websites have asked about the technology. Facebook is now threatening to blacklist Heise (Original in German)." As I read the updated story, Facebook has backpedaled a bit, so "blacklist" may no longer be the operative word. An anonymous reader adds a quick explanation of the changed interface: "Instead of enabling Facebook to track a user (arguably without prior consent) by placing a 'like' button on the website in the usual way, a greyed-out like button is shown. If a user wants to share or 'like,' he has to execute an additional click to enable the original Facebook 'like' button and get the desired behavior. This technique obviously has a disadvantage for Facebook, because the behavioral tracking does not work anymore."
This discussion has been archived. No new comments can be posted.

Heise's 'Two Clicks For More Privacy' vs. Facebook

Comments Filter:
  • by Anonymous Coward

    "disable unintentional automatic tracking of all page visits by third-party social sites like Facebook"

    I think anyone who cares the slightest bit about privacy already blocks facebook's address blocks, googles trackers, and so on.

    Your computer obeys you. You get to decide whether it stories cookies from any given site, whether it loads *anything* from facebook's addresses, whether it loads web bugs, and so on. It is under your control. I figure that my computer exists to make MY life easier, not to make

    • by Samantha Wright (1324923) on Saturday September 03, 2011 @12:13AM (#37294092) Homepage Journal
      This is a mindblowingly old and tired debate, but I think the typical reply to you goes something like "most people are mostly stupid and as a result we need to take care of them. Further," goes the repartee, "all of this this should be opt-in to begin with."
      • by KiloByte (825081)

        You mean, it should be legal to rob you or murder you unless you register for a legal protection program?

        • by Sique (173459)

          It's not called "legal protection program", it's called "applying for citizenship/residental status and paying taxes", but you get the general idea.

          • So - where you live tourists are fair game ofr killing and robbing?

            Safety of life, limb and property is a human right in civilized countries, not a citizen's right.

            • So - where you live tourists are fair game ofr killing and robbing?

              Yeah.... Duck season, rabbit season, tourist season....

            • Yes, tourists are just anarchists who can whatever they want and have anything done to them. That's how it works. /sigh

        • By "all of this" I meant "all of this privacy-invading tracking stuff." Didn't you even read the headline?
        • by Ihmhi (1206036)

          They have those, they're called Concealed Carry Licenses.

          Well, not everywhere sadly. New Jersey sucks.

        • by HiThere (15173)

          I can think of decent arguments in favor of that, as long as you weren't bound to any of their rules unless you interacted with those who were signatory. Could end up with governments based around the idea of insurance companies, with some people opting for a more tightly controlled one and others opting for a looser one. And a few just not signing up.

          Implementation, of course, would probably be a nightmare. But in theory it sounds nice.

    • by Anthony Mouse (1927662) on Saturday September 03, 2011 @12:19AM (#37294116)

      "Automatic tracking" can almost entirely be disabled already - and for years now. You just have to DO IT, and most people would rather bitch than spend the 5 minutes it takes.

      If I'm just reading the news, I use whatever computer is in front of me. Sometimes that's my PC, or my laptop, or my PC at work, or a school computer, etc. Having to change a setting on every different computer I use is a huge annoyance, to say nothing of the times when I don't have administrative access to make certain changes.

      Anything that makes protecting my privacy the default is a win.

    • by asdf7890 (1518587)
      "Automatic tracking" can almost entirely be disabled already - and for years now. You just have to DO IT, and most people would rather bitch than spend the 5 minutes it takes.

      Not that easily, at least not for basic users. I can control everything on my main PC and netbook and know what needs to be controlled to sort out privacy issues I care about, but most people don't have that level of knowledge and there are many circumstances where the level of control is not present. You can't install privacy protecti

  • They embed a Facebook "like" button on their website... And then they decide it's creepy so they grey it out???

    When I think something is creepy I just remove it....

    • Re:I don't get it... (Score:5, Informative)

      by YodasEvilTwin (2014446) on Saturday September 03, 2011 @12:10AM (#37294080) Homepage
      No, dude. They have a little grey icon hosted locally, and when it's clicked they do an AJAX call and insert the Facebook "Like" button dynamically. That prevents Facebook from using the page that gets loaded in the iframe with the Like button from tracking the user until they've clicked the button. Otherwise everyone who visited the site would automatically be tracked when the Like button was automatically loaded.
    • Re:I don't get it... (Score:4, Informative)

      by Arancaytar (966377) <arancaytar.ilyaran@gmail.com> on Saturday September 03, 2011 @02:05AM (#37294528) Homepage

      The greyed-out dummy button (that's what the markup calls it in the HTML class description) has the function of showing users that the option still exists, but requires them to enable it. It also is loaded from the Heise site itself, thereby requiring users to explicitly opt in before their browser sends any request to Facebook.

      Consequently, instead of automatically sending data about all visitors (including those who don't even have Facebook accounts and have no use for the Like button) to Facebook, only those visitors who want to give information to Facebook anyway (by clicking the Like button) will be tracked.

  • Nice to see this. (Score:2, Insightful)

    by ArchKaine (652697)
    I have to say that I'm impressed with Heise doing this. This puts the choice of being tracked into the user's hands.
    • by Anthony Mouse (1927662) on Saturday September 03, 2011 @12:23AM (#37294134)

      I can certainly see why Facebook hates it though: Not only does it deprive them of the tracking information for all the people who don't click the like button, it changes the user's choice in clicking the button from "click this button if you like the story, but you'll be tracked either way" to "click this button to cause Facebook to track you" -- and if it becomes common knowledge that that is how the like button works, fewer people will use it.

      • Yea. I didn't know that and I am most certainly displeased by that little trick. It's like 'put this like button on your webpage so Facebook can track everyone who looks at your webpage for free even if they don't use the button'.

        That kind of accurate info like how many people are visiting certain websites and which pages could be sold to competing websites by Facebook. I'm not surprised the site did that if they realized the implications of the buttton.

        • by vlueboy (1799360)

          It's only because Germany very recently started pushing an anti-facebook stance. I doubt they would have implemented this so easily without a government breathing down their necks --they're the largest German web news provider IIRC.

          Non-Americans don't even have the same business models that drive traffic to US sites. They don't even have per-story comments a-la CNN, New York Times or Yahoo (too lazy to translate and confirm whether they have a official off-site forum that is obligatory of sites looking for

          • they're the largest German web news provider IIRC.

            Note that they're also the foremost German tech news publisher. Their articles are aimed at precisely the section of readers that are more likely to care about their online privacy and to recognize when something violates it.

          • by silanea (1241518)

            Non-Americans don't even have the same business models that drive traffic to US sites. They don't even have per-story comments [...]

            It would have been sufficient to RTFA to see that you are wrong. Underneath the text even the Google translation shows quite prominently "Read comments (162 posts)". Let us visit the largest German news websites that I can name off the top of my head and click on an exemplary story to see who has per-story comments:

            7 out of 8 have per-story co

          • by xaxa (988988)

            It's only because Germany very recently started pushing an anti-facebook stance.

            No, the whole EU has, pretty much since the start, had a pro-privacy stance. More recently, attention has turned to website privacy matters -- e.g. cookies.

            I work for the British government, and a few months ago had to confirm exactly what cookies were used on our websites. In my case, only session cookies to track "shopping basket" type things, which are fine, but the main website uses Google Analytics. It's likely that at some point in the next 12 months we'll have to remove Google Analytics. (Or, perh

          • by yacc143 (975862)

            Well, technically what many US companies have been doing has been strictly illegal in the EU. Germany traditionally has a tendency to be strict on privacy protection, but technically the law is just a local reenactment of the EU data protection directive. Worse, for US lobbies and politicians, the "Datenschutzbeauftragte" is position that is hard to pressure. Basically if you do a business with person X, you are by law required to do it with the minimal data collection possible. Or you let the user opt-in i

          • Germany, and large parts of the EU. If you read the "Datenschutzgesetz" (data protection law) of Germany, and if you consider just what lengths you have to go to to protect the privacy of your users, you wonder whether you should store ANY kind of information AT ALL.

            I.e. how it should be.

          • It is also a requirement of new directives that force EXPLICIT consent from users.

        • and this fact? this surprises you? really?

      • by geekmux (1040042)

        I can certainly see why Facebook hates it though: Not only does it deprive them of the tracking information for all the people who don't click the like button, it changes the user's choice in clicking the button from "click this button if you like the story, but you'll be tracked either way" to "click this button to cause Facebook to track you" -- and if it becomes common knowledge that that is how the like button works, fewer people will use it.

        Facebook should be irritated, but certainly not shocked about peoples (or content providers) reactions to discovering what they've been doing with tracking.

        Of course, we should also not be shocked when a month from now, not a damn thing has changed with regards to people being concerned about their privacy and tracking online.

    • by vlueboy (1799360)

      The name sounded familiar and some digging shows that these are the same guys that did an IPv6 trial [h-online.com] in the past year. So they've already one-upped slashdot with something.

      Maybe I'll start learning German to be packed up for the not-so-far day when slashdot implements their Like button: thousands of us per day already acquiesced with Geeknet adding 3 different links to "follow us on $SOCIAL_NETWORK" on the front page. The next logical step to ???? PROFIT! is just to wait for a juicy FB/FBI deal to track non

    • Heise is famous (or "infamous" to certain parties) for "Doing the right thing(tm)!". They've done so in the past and I truely hope they continue to do so in the future.

  • Privacy is just something to gossip about.

    • good point... is there something like a "fuck facebook" plugin? you know, block all resources hosted on facebook domains, unless you're actually browsing facebook... if something like that doesn't exist, it kinda should, and surely google and others could use being included in that, too....

      • This filter list for the Firefox addon "AdBlock Plus" is exactly what you're asking for. It blocks social networking elements everywhere except on the sites themselves.

        http://www.camp-firefox.de/forum/viewtopic.php?f=4&t=82797 [camp-firefox.de]

        • thanks! :)

          that still leaves chrome, opera and safari :D (yeah I know I'm greedy, but it's for a good cause ^^)

          • by brim4brim (2343300) on Saturday September 03, 2011 @01:13AM (#37294366)
            Just use Ghostery, available for all the popular browsers (IE, Safari, Opera, Firefox, Chrome): http://www.ghostery.com/download [ghostery.com]
            • wow, that's perfect :D

            • Just use Ghostery, available for all the popular browsers (IE, Safari, Opera, Firefox, Chrome)

              Not really for Chrome. It works sporadically. As in you can load a page and a random subset of trackers will be blocked, hit reload on the same page and a different random subset of trackers gets blocked.

              The Ghostery developers blame Google for having a crappy API. They may be right, I don't know. Whatever the reason though it means I only use Chrome for exactly one website, "they" can track me all they want on that one website.

              • by KiloByte (825081)

                Since you can't exactly accuse Google of being technically inept, it's obvious the inability to block tracking, lack of sane cookie handling, etc, in Chrome is done on purpose. It's not a hard thing to implement, too -- heck, even Netscape (2.0?) did cookies better, by giving you choice to allow/allow for session/reject them, and to save your choice per-domain. As far as I know, in Chrome there's currently no way to have cookies limited to a session by default but allow permanent ones on a whitelist basis

            • by cvtan (752695)
              I suspect Ghostery will have the same problem as RequestPolicy. That is, some sites have 50 or so suspicious trackers etc. There is no way to navigate the web if you have to fret over 50 3rd party redirects and tracking widgets on a page. The concept is welcome, but I don't see how anyone can use it efficiently.
            • Thanks for that...that's exactly what I was looking for too.
          • AdBlock Plus exists for Chrome.

      • by wgoodman (1109297)

        Actually, the disconnect plugin is there to specifically remove tracking from FB and other sites by default. you can enable it on specific sites if desired, but the default is block all their bs tracking. This blocks things that adblock does not (though adblock is a must either way)

  • by 93 Escort Wagon (326346) on Saturday September 03, 2011 @12:52AM (#37294272)

    When you're done reading Facebook, Click "Account" then "Log Out" before visiting any other sites. Only be logged into Facebook when you're actively using Facebook.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      When you're done reading Facebook, Click "Account" then "Log Out" before visiting any other sites. Only be logged into Facebook when you're actively using Facebook.

      How naive of you. Your IP is still the same, and so is your user-agent/fonts/etc. They don't need you to be logged in order to track you.

      • Hence the word "partial" in the subject. They can still track that an individual goes to those particular Facebook-affiliated sites. But, if you're logged in, you're handing them your name on a silver platter.

    • by Baloroth (2370816)
      Yeah, I remember getting a nasty shock a few days ago when I didn't do that (I normally am very obsessive about it), and I noticed my name appearing in other pages. Seriously, Facebook, stop stalking me. Well, that is why browser extensions were made (Ghostery, I hope you work as advertised.)
      • by jo_ham (604554)

        Why do you think I have Facebook sandboxed in its own browser, separate from all of my other browsing?

        I do not trust them as far as I can throw them.

    • by theCoder (23772)

      Logging out is not necessarily good enough. Facebook also tracks IP addresses that aren't currently logged in. Better to add adblock rules like:

      ||facebook.net^$domain=~facebook.com
      ||fbcdn.net^$domain=~facebook.com
      ||facebook.com^$domain=~facebook.com
      ||fbcdn.com^$domain=~facebook.com

      I don't think the last one is necessary -- it has zero hits in my Adblock right now. The others have quite a few hits.

      This does mean you won't see any "like" buttons, but if you don't use them, you won't miss anything.

      Does an

    • by antdude (79039)

      Also, clear cookies or use another computer/web browser that don't use Facebook.

  • GameBoyRMH's sig (Score:3, Interesting)

    by Onymous Coward (97719) on Saturday September 03, 2011 @01:01AM (#37294318) Homepage

    I had just learned about what Facebook had been doing by reading GameBoyRMH [slashdot.org]'s sig:

    Facebook's pure HTML tracking system [tinyurl.com] - How long has this been going on?

    • Can someone explain to me some GOOD things you can do with iframes?

      I guess it is a silly question... ?

      They just seem like a bad idea to me.

      • Can someone explain to me some GOOD things you can do with iframes?

        Well, I'm very much a total javascript newbie still, and recently I decided to implement popup windows for my custom CMS thingy. Using iframes for that, I could simply re-use everything as is, and the submit button of pages "embedded" in a popup still works. For example the comment form pops up, you enter your comment and hit submit, the popup says thank you for your comment, you close the popup. Or you go to the "comment on X" page directly

        • Thanks.

          So what if iframes were limited to loading content only from the same domain as the parent page?

          Would that be a burdensome limitation?

  • by slart42 (694765) on Saturday September 03, 2011 @01:59AM (#37294514)

    Some missing context: http://www.kreativ-ackern.de/2011/08/20/gefaellt-mir-facebook-dienste-illegal/ [kreativ-ackern.de] (In German).

    Basically, a German authority for privacy rights has recently claimed that embedding a Facebook "Like" button on your web site is a violation of german privacy rights, because it allows tracking of all users of the web site by a third party. According to the article, having a "Like" button on your site can yield in fines up to EUR 50k. This is probably technically and legally correct, I doubt that anyone would actually be sued any time soon, though. But the headline has made a big splash on the german internet in the last weeks, and I'd assume that heise's move is a direct reaction to this (which is mentioned in the document as a possibly legal way to have a Like button on your web site).

  • Small correction (Score:3, Informative)

    by Affenkopf (949241) on Saturday September 03, 2011 @02:27AM (#37294600)
    Heise didn't change their social 'like' buttons. They introduced them. Heise never had these buttons before because of the privacy issues.
  • 127.0.1.1 www.facebook.com

    / just saying

    • by GeekDork (194851)

      127.0.1.1 www.facebook.com

      I'm blacklisting *.facebook.com, their CDN (fbcdn.net), and connect.facebook.net in ABP (the connect rule is older since it used to break a bunch of sites when the service started and was even more unreliable than it is today). The other solution would be to just make my home DNS auth for those zones, which I've done for a bunch of other crap like doubleclick, making that stuff NXDOMAIN.

  • It is quite obvious how getting this icon from facebook every time a page is loaded will allow facebook to track it. But why does that mean you have to click twice after this change? Couldn't they just host the icon locally and still let the link do what it used to do on the first click?
    • by ais523 (1172701)
      That'd be a CSRF attack against Facebook if it worked. Imagine if sites could simulate a "Like" on themselves from users who had no intention of clicking the button, but had actually clicked something entirely different. It's a good thing that it's impossible.
  • I wonder if someone shouldn't produce a script which does this so lots of sites can implement similar behaviour. Not just Facebook but also Google+, Digg etc.
  • This is actually a fantastic solution to a good part of the social-network-tracking-you problem - namely that Facebook et. al. are not only tracking what you do on their site, but also a lot of your other activities.

    The best part is that Heise has promised to release the source code next week, so other sites can use the same approach. I definitely want to see this everywhere.

  • by geekmux (1040042) on Saturday September 03, 2011 @06:39AM (#37295244)

    If I'm understanding this correctly, Facebook, using their "Like" button, has basically been allowed to receive two distinct types of tracking information. One is the information they should be allowed to see (who actually clicks on the "Like" button), and the other is information on whomever loaded the page that contained a "Like" button.

    And now, someone has come up with a rather ingenious way to separate those two data streams, and if they're smart about it, sell the latter data back to Facebook rather than allowing them to get it for free.

    And Facebook is trying to strongarm them by blacklisting. Now, the question is when another 1000 sites do this same thing, in an attempt to generate an additional revenue stream(selling hit data to FB), will Facebook continue to try and strongarm them by blacklisting?

    Why am I having flashbacks and cold sweats over who will win that strongarm war? The words "too big to fail" flashed in my mind for some reason...

    • Sorry, but I very much doubt that Heise would sell that information. First they would probably get into trouble with German privacy laws and their users would be furious if that would become known, I certainly would be. Isn't it possible, that someone just does the right thing once and doesn't see any reason, why some other party (it isn't only facebook, also google+ and twitter are handled the same way) should receive nearly complete information what its users are doing on site?

    • by hey (83763)

      I hope somebody packages this code as a simple to download and install widget.

    • by w4rl5ck (531459)

      First thing, Heise will not sell this information, they are basically the good guys, protected by several laws and priviledges they would loose by such action, plus widely financed - they dont need to do so.

      Their main interest is to expose something bad going on, which is just living up to their journalist role. Good stuff.

      Facebook is already retreating, they know they can only loose, and Heise is - in Germany - very, very big (I think every techy guy/girl in Germany at least pays minimum attention to their

  • Those who don't want this bullshit can install the lovely Facebook Disconnect [google.com] extension for Chrome, which removes any and all Facebook tracking from any non-Facebook pages.

    Pain in the arse to have to install an extension because of one company's idiocy, but there we go.

"Let every man teach his son, teach his daughter, that labor is honorable." -- Robert G. Ingersoll

Working...