Taking control of Facebook

March 27, 2018 1:32 PM

Firefox announces their new Facebook Container Extension (FF Blog), a special Firefox mode which will isolate Facebook browsing from the rest of your browser history, cookies and identities. Firefox also promises that they don't track anything in the extension either.

Get it here.

After all, the things Facebook knows go beyond user data (Ars Technica round up of recent FB issues).

posted by bonehead (35 comments total)

Can anyone more tech-savvy than me (a person who in turn is, and I know I'm banging on this drum repeatedly but I think it's very relevant in response to this news, still more tech-savvy than their twentysomething younger sister who didn't know how to install Firefox extensions) explain how this compares to other third-party extensions like Ghostery?
posted by inconstant at 1:38 PM on March 27, 2018 [1 favorite]

(In case it's not coming through: that is a genuine request for information, not a snark.)
posted by inconstant at 1:38 PM on March 27, 2018 [4 favorites]

Is this different/better than running it in Chrome's Incognito Mode? That's how I currently use it so that I'm sure that I'm logged out when I'm done.
posted by octothorpe at 1:40 PM on March 27, 2018

If you have to treat your social network like a malware-ridden porn site, it should be considered a social disease network.
posted by benzenedream at 1:52 PM on March 27, 2018 [77 favorites]

You say that like social networks aren't already malware-ridden porn sites.
posted by davelog at 1:53 PM on March 27, 2018 [8 favorites]

Is this different/better than running it in Chrome's Incognito Mode? That's how I currently use it so that I'm sure that I'm logged out when I'm done.

My understanding is that this is basically a Facebook-specific auto-incognito mode. You don't need to manually launch your browser in "porno mode", then navigate to FB. It just opens a single tab for you in incognito while making sure that you're logged out in the rest of the browser and have all cookies deleted.

So I don't think this is conceptually different, only it's making absolutely sure that FB is isolated, removes the extra step of having to manually isolate it, and also removes the risk that you'll screw up and forget. Also, if you click a non-FB link in FB, it will open that site outside the container.
posted by middleclasstool at 1:57 PM on March 27, 2018 [6 favorites]

Walled garden for the walled garden.
posted by Kabanos at 1:57 PM on March 27, 2018 [9 favorites]

Alright. If I'm facebook and you visit me in incognito mode, lets talk about what you are still sharing. Your browser version, your browser widgets, and the knowledge you are incognito. I am not sure how much of your computer information is sent, but they can get a pretty solid view of your OS. In addition, FB has your IP address, and the specific things you view while going to FB. From that, your behavior will condense measurement of your session into a limited pool of UserIDs, assuming you don't log into FB and are only viewing public content while on their site. Login, and they attribute all of your session behavior to you - they may not know the OTHER sites you've visited, but they know enough from what you've done on their site to "improve" how to market to you. Worst case, you are handed a look-a-like model for someone else providing insight into your behavior...

But wait - FB really has your email address, so that's where all this is Game, Set, Match.

So FB doesn't get to tie your online but not FB behavior if you browse incognitio, unless another service is tracking you, such as Convertro. FB provides a hashed view of your behavior on their site, they provide you a tactical and strategic analysis on what you do and what your interests across all their sites - without anyone 'sharing' your personal information, just a hashed ID that represents your email address but is not actually your email address and can't be hacked because SHA-256 says you can't hack it and that's likely true but we've shared enough about you that yeah... you are close enough to known and shared by this intermediary between all these companies.

So go ahead... think you've hidden from these companies. What you don't make easy they'll still get, still model, and still attribute to you - whether it is right or wrong - but it isn't wrong... it is what your expected behavior is, only your outlier behaviors exist as a differentiation of you between you and everyone else. They serve as both a digital fingerprint if strong enough, or as something to just be scrubbed out if it isn't profitable enough to market to - and then you'll still get your generic classification segment stream of bullshit marketing. Your digital self is an indentured servant, served up to the marketing masters.
posted by Nanukthedog at 1:58 PM on March 27, 2018 [11 favorites]

I'm really glad that Mozilla is doing this, but given that Facebook has little icons/code snippets embedded on lots of pages outside Facebook (say, an Instagram icon or whatnot), can't they track you anyway?
1) I click on an external link in my Facebook container. Facebook knows I've clicked on this link.
2) I land on a page outside Facebook, outside my Facebook container. There's a little Facebook icon, or ad, or whatever on that page. Facebook sees me load that bit of data, and correlates my outside-the-container persona with my inside-the-container persona. I remain tracked.

I may be overthinking this or overestimating the skullduggery involved, though.
posted by phooky at 1:59 PM on March 27, 2018 [3 favorites]

inconstant: it basically works opposite the way Ghostery does: the Firefox extension makes browser tabs with Facebook completely self contained, so no data like cookies can be leaked out of it when you visit any other sites on the Internet. What Ghostery does is prevent other sites from accessing data stored by Facebook. This container approach should theoretically be more secure and reliable, since Ghostery has to keep their list of Facebook-affiliated domains to block constantly up-to-date. All the container has to do is say "is the user going to Facebook.com? Lock it in a container."

octothorpe: It's basically like always using Facebook in an Incognito Mode window, except you don't have to log back in each time you go to it.
posted by zsazsa at 1:59 PM on March 27, 2018 [5 favorites]

I use two-factor login for FB, which makes logging in each time via an incognito tab even more cumbersome, so this add-on is great. I hope they figure out a way to make it work in the Firefox Android mobile browser, too, since I have never ever ever downloaded FB's mobile app.
posted by PhineasGage at 1:59 PM on March 27, 2018 [3 favorites]

Being less trackable and seeing virtually no ads requires a lot of work. It should, by right and by law, be the default but that's not the world we live in. My recommendations:

- Block third party cookies. Always.
- uMatrix. Whitelist only third-party javascript that meaningfully makes the page function, such as ajax.googleapis.com for google maps.
- Install EFF's Privacy Badger
- uBlock Origin. A good standard adblocking extension.

it's time consuming to set up, and uMatrix in particular can be time consuming to set up the whitelist for each new website you visit, but it pays off.
posted by tclark at 2:08 PM on March 27, 2018 [11 favorites]

Can anyone confirm that this even works, for reals (see also phooky's comment)? It's almost the first of april, after all…

They'd have to make something similar for Google as well, but that's where Mozilla gets most of their money from, so.
posted by farlukar at 2:11 PM on March 27, 2018

There's a little Facebook icon, or ad, or whatever on that page.

I'm hardly an expert either, but my read of the blog post is that this does work for Facebook stuff that isn't explicitly on Facebook, like those ubiquitous share links. So I suspect that they've got you covered. I'd want confirmation of that though.
posted by bonehead at 2:14 PM on March 27, 2018 [1 favorite]

BOOM goes the business model!
posted by The Tensor at 2:15 PM on March 27, 2018

Kabanos: Walled garden for the walled garden.

Let me workshop this for you: Facebook isn't so much a walled garden as it is a bamboo garden that has spread to grow into neighboring gardens, yards and driveways. "But it's not invasive," says the bamboo sales person. "Invasive is [something else]."

This is a strong ground barrier for your bamboo garden - some people really like bamboo, but let's keep bamboo in its own truly walled garden.
posted by filthy light thief at 2:34 PM on March 27, 2018 [8 favorites]

To add: A surefire way to beat adblock-blocking scripts is to tinker in uMatrix and find out what host is serving up the adblock blocker. Block that host (which is often, but not always third party) and you'll not get nagged about it. uMatrix is extremely powerful and can be awesome, but the learning curve isn't trivial.
posted by tclark at 2:36 PM on March 27, 2018 [2 favorites]

For those wanting to set up uBlock Origin, the author has a very good wiki for it here:

https://github.com/gorhill/uBlock/wiki

Edit: Also, the subreddit (/r/uBlockOrigin/) is quite useful, too.
posted by zbaco at 3:04 PM on March 27, 2018 [8 favorites]

I don't understand, when you visit millions of web pages around the web they tell Facebook that you're there...what would this do to stop that? Facebook knows your WAN address and your login activity. If this is a company that builds shadow profiles for millions if not billions of non-users, it's a forgone conclusion they rebuild sessions out of your sporadic behavior based on this kind of clue.

This feels a lot like every science fiction movie ever where someone has said "oh don't worry, we're letting the bioweapon/malware out of it's box but we totally totally totally have the situation under control and nothing will go wrong!"
posted by trackofalljades at 3:40 PM on March 27, 2018 [4 favorites]

Thank you for the explanation, zsazsa. Does this mean that concerns such as those brought up by trackofalljades should be dealt with by using both extensions in concert?
posted by inconstant at 3:46 PM on March 27, 2018

So usually they tell facebook via javascript in the page that runs and reports back to facebook. That can be stopped because it's running in your browser. If they're actually collecting the data on their own servers and then transmitting it to facebook separately, there's not much you can.
posted by vibratory manner of working at 3:47 PM on March 27, 2018 [2 favorites]

For anyone who's going all in with setting up extensions, I can second uMatrix as a high quality implementation.

uMatrix already blocks third-party cookies by default.

Privacy Badger is kind of weird. It mostly doesn't break stuff, but the times it did frustrated me. I think the model is kinda fun, but I'm not sure I recommend it in combination with other blockers. I wouldn't suggest using it with together with uMatrix. You pile up unnecessary complexity to rummage through when you can't work out why a site is broken. There's already enough to worry about inside uMatrix :).

The stealth selling point of stuff that says it blocks trackers, like Privacy Badger, is that it ends up blocking most advertisements as well. But I also wouldn't use Privacy Badger if you want to run a real ad-blocker but disable it on your favourite webcomic or local community weblog. And if you have an ad-blocker that successfully blocks the ad requests, there's nothing to track anyway.

This leaves Facebook "Like" widgets etc., something that ad-blocks aren't designed to help with by default. It somewhat frustrated me because Privacy Badger integrated and took over one of the original "widget" blockers. I didn't manage to find another decent widget-blocker, so I was back to managing cookies or scripts. Point to uMatrix.

Containers is another attempt that should work on "widgets". The Facebook Container approach seems great to me. I think it does show up the extra effort it takes to manage the generic Firefox Containers approach though. I.e. when you don't have a site-specific extension, that can automatically work out when you do and don't want something to open in the specific container.

I set uMatrix to block first-party scripts as well, basically substituting for NoScript. If you're familiar with that idea - I think uMatrix is actually a step up from NoScript in terms of convenience. (Either before or after NoScript on Firefox had to be rewritten for WebExtensions). There's just one speed-bump you have to remember if you start toggling first-party scripts.

The granularity of uMatrix is a bit overkill to be honest. But if you don't mind learning the UI, it's so well designed; I don't forget what it means. And it's powerful enough that it doesn't require a completely impractical number of clicks. To start off with, there's the big "disable filtering for this scope" button. That works much more practically than what "Temporarily allow all" actually meant on the old NoScript.

In summary, I think this stuff is genuinely hard to deal with reliably. I'm sure the likes of Facebook prefer it that way. At least there's still Firefox with... at least incentives to brand themselves like this, run this sort of experiment, and hosting a decent extension ecosystem. I get a somewhat more scummy impression about the overall contents of the Chrome extension "store".
posted by sourcejedi at 4:24 PM on March 27, 2018 [3 favorites]

I might be getting this wrong but for people who'd like to enforce this behaviour not just for Facebook but for every site they visit, setting privacy.firstparty.isolate to true in about:config does the trick.
posted by Bangaioh at 4:26 PM on March 27, 2018 [3 favorites]

If you open Chrome and Safari and login to Facebook in one of them, and then surf to a site that uses Facebook tracking stuff in both browsers, Facebook will see one anonymous user and one logged-in user.

Containers enforce that same division, only without requiring you to operate separate browsers. The extension creates a new container called Facebook.com and sets up a rule that intercepts any attempt to open the Facebook website in a tab. When intercepted, the attempt is moved into the Facebook container tab.

Since a division exists between the Facebook container and the Default container, even though you’re logged in at Facebook in the Facebook tab, when you surf non-Facebook websites, they aren’t “in” the Facebook container (because they’re not put there by the extension), and so any Facebook tracking stuff on a non-Facebook site will show you as an anonymous user because the Default container has all the Facebook cookies wiped by the extension.

This does not prevent Facebook trackers from tracking in general - but it does prevent them from conclusively linking their tracking data to your Facebook account, which is a big step forward for privacy. Anti-tracker extensions and third-party cookie blocking still serve the purpose of blocking cross-site activity in general, but are difficult for everyday users to operate usefully as they break the web with regularity (not just Google, either). So the extension shoots for a low-disruption experience, harnessing containers to hide your Facebook identity from trackers.
posted by crysflame at 4:51 PM on March 27, 2018 [1 favorite]

If you don't use Facebook or its products at all and you want to block Facebook almost entirely from your computer or network, you can edit your host file or even your home router firewall to include this huge list of Facebook domains.

One upside of doing this is that this makes most of the rest of the web a whole lot faster to your browser because you don't have 99% of the pages throwing complicated Facebook integrated widgets at you.
posted by loquacious at 4:52 PM on March 27, 2018 [13 favorites]

Does the container also lock down access to other aspects of your system (such as screen resolution, available fonts, or GPU profiling) that could be used to fingerprint your machine to compare against other logins from your IP address?
posted by acb at 4:59 PM on March 27, 2018 [1 favorite]

This is great, but - isn't the biggest data grab done by the Facebook app (and its access to everything else on your phone), not the website?
posted by Dashy at 6:19 PM on March 27, 2018 [2 favorites]

This does not prevent Facebook trackers from tracking in general - but it does prevent them from conclusively linking their tracking data to your Facebook account, which is a big step forward for privacy.

Look, in this day and age, if I can see an anonymous entry from an a computer and I see a logged in entry from the same computer, and I can confirm via 3rd party matching that your session ID matches an ID that I know matches your ID at a 3rd party website that I've paid for matching access to, I know who you are. I'll just collapse those two session IDs together via some fuzzy matching and call it good. Or if I model and say these two accounts are probabilistically the same person, I'll collapse the two session IDs and call it good.

You aren't fooling anyone that is looking at you.
posted by Nanukthedog at 6:48 PM on March 27, 2018 [1 favorite]

Dashy: "This is great, but - isn't the biggest data grab done by the Facebook app (and its access to everything else on your phone), not the website?"

People who install this probably aren't running the app on their phones; I'm not.
posted by Mitheral at 7:01 PM on March 27, 2018 [1 favorite]

When I saw this announced I immediately thought it would make a great FPP, so thanks for this.

I do appreciate Mozilla's effort on this, if only for the fact that it helps to promote greater awareness about how NSAbook is actually tracking you. On a broader level though (and going along with farlukar mentioning that you need this for Google too), this to me is a lot like putting a sticking plaster on a decaying corpse. A Firefox extension is nice, but it ain't going to fix the aggregation of data as business model problem, of which this browser-side tracking is only one part. What's needed is for more individual users to wise up, tell NSAbook and similar to kindly F-off, and go and use decentralised services instead.
posted by Juso No Thankyou at 8:38 PM on March 27, 2018

Echoing previous comments, I too think this is a good effort, but I can't help feeling that I shouldn't have to work this hard to protect myself from the nefarious machinations of a website. Therefore I finally conceded that I can't beat them, and I finally deleted my Facebook account yesterday - assuming that they actually delete it. I'm certain that they'll hang on to the all of the data that they're already collected on me forever.
posted by SonInLawOfSam at 8:57 PM on March 27, 2018 [3 favorites]

If you're going that route, then absolutely do what loquacious says and block Facebook at DNS level, or at least use something like uMatrix. As pointed out above, they track everyone everywhere their widgets are embedded, whether they have an account or not.

Here's a sample uMatrix ruleset (notice the instagram and whatsapp domains):
* facebook.com * block
* facebook.net * block
* fbcdn.com * block
* fbcdn.net * block
* tfbnw.net * block
* fbsbx.com * block
* appspot.com * block
* fb.com * block
* fb.me * block
* fbcdn-profile-a.akamaihd.net * block
* instagram.com * block
* instagramstatic-a.akamaihd.net * block
* cdninstagram.com * block
* whatsapp.com * block
* online-metrix.net * block
* edgekey.net * block
* edgesuite.net * block
posted by Bangaioh at 12:51 AM on March 28, 2018 [6 favorites]

And since people are suggesting general privacy extensions for Firefox, Decentraleyes is another good one.
posted by Bangaioh at 12:56 AM on March 28, 2018

After jumping through many hoops, I deleted my Facebook account about 11+ years ago.
posted by DJZouke at 5:56 AM on March 28, 2018

isn't the biggest data grab done by the Facebook app (and its access to everything else on your phone), not the website?
It depends if you are using an Android(yes) or an iPhone(no).
posted by soelo at 12:39 PM on March 30, 2018