I’ve been increasingly irritated with the noise-to-signal ration Facebook creates in my life. I definitely had the “I just threw up in the back of my mouth a little” feeling during the Web 2.0 Summit Zuckerberg love-fest. And now there’s increasing evidence that Facebook Beacon, their ill-considered advertising engine (or is it their privacy invasion engine?) is potentially a new vector for so-called affiliate marketers, spammers, scammers, and other vermin to gain access to unsuspecting users. Worse, it turns out that protecting yourself from this new attack by trying to leave Facebook is no easy task.
Henry Blodgett reports that Facebook is in deep doo-doo with both the New York Times and Coca-Cola over their misrepresentations about the opt-in/opt-out nature of Beacon:
The “Beacon” fallout continues. The New York Times’ Louise Story essentially accuses Facebook’s Mark Zuckerberg of lying to her about Beacon’s being “opt-in.” Coca-Cola got a similar impression from the company – and, having learned the truth, is holding off on using the program. Meanwhile, Facebook’s spokesman attempts to explain to the NYT’s Louise Story what Zuckerberg really meant – and makes matters worse.
And Dare Obasanjo blows the lid on why Beacon is totally broken and almost certainly unfixable:
Anyway, back to the title of this blog post (Facebook Beacon is Unfixable). The problem with Facebook Beacon is that it is designed in a way that makes it easy for Facebook Beacon affiliates to integrate into their sites at the cost of user’s privacy. From Jay Goldman’s excellent post where he Deconstructed the Facebook Beacon Javascript we learn
Beacon from 10,000 Feet
That basically wraps up our tour of how Beacon does what it does. It’s a fairly long explanation, so here’s a quick summary:
- The partner site page includes the beacon.js file, sets a <meta> tag with a name, and then calls Facebook.publish_action.
- Facebook.publish_action builds a query_params object and then passes it to Facebook._send_request.
- Facebook._send_request dynamically generates an <iframe>which loads the URL http://www.facebook.com/beacon/auth_iframe.php and passes the query_params. At this point, Facebook now knows about the news feed item whether you choose to publish it or not.
When you read this you realize just how insidious the problem actually is. Facebook isn’t simply learning about every action taken by Facebook users on affiliate sites, it is learning about every action taken by every user of these affiliate sites regardless of whether they are Facebook users or not.
At first I assumed that the affiliates sites would call some sort of IsFacebookUser() API and then decide whether to send the action or not. Of course, this is still broken since the affiliate site has told Facebook that you are a user of the site, and depending on the return value of the hypothetical function the affiliate in turn learns that you are a Facebook user.
But no, it is actually worse than that. The affiliate sites are pretty much dumping their entire customer database into Facebook’s lap, FOR FREE and without their customers permission. What. The. F*ck.
Game over. This is more than enough to convince me that Facebook has more downside than upside for me. Look, I freely admit I am not the core demographic for Facebook. I’m a 50-year-old guy who’s been happily married for 25 years (and so doesn’t want to find a date or a new “special friend”), doesn’t play games, could care less about drinking games, zombie bites, and other frippery, and initially believed in the potential this framework offered.
Chatting with Tris Hussey and Sam Sethi on Twitter just now, I learn that jumping ship might not be as easy as I thought.
On Twitter, Sam Sethi says: “… just try and leave. You need to unsubscribe from every group and jump through a few more hoops,” and points here.
Facebook does allow people to ‘deactivate’ their accounts. This means that most of their information becomes invisible to other viewers, but it remains on Facebook’s servers - indefinitely.
This is handy for anyone who changes their mind and wants to rejoin. They can just type their old user name and password in, and they’ll pop straight back up on the site - it will be like they never left.
But not everyone will want to grant Facebook the right to keep all their data indefinitely when they aren’t using it for any obvious purpose. If they do want to delete it permanently, they need to go round the site and delete everything they’ve ever done.
That includes every wall post, every picture, and every group membership. For a heavy Facebook user, that could take hours. Even days. And it could violate the UK’s Data Protection Act.
Summary - leaving Facebook has been made almost impossible and proportionately harder the more you’ve participated. Sorry. That sounds pretty much like my definition of EVIL. When will these people learn that this sh*t doesn’t fly? I agree with Open Garden who says:
and thats why opensocial is a step in the right direction ..
Here’s the final proof I’m right and it’s time to nuke any trace of my casual flirtation with Facebook. Fake Steve Jobs says so (and of course he’s always right… about everything:
See this story on CNET which refers to this story from some Harvard publication. Gist is that the Harvard publication dug up some documents involved in a lawsuit against Facebook. Facebook claims it’s an invasion of Zuckerberg’s privacy and went to court trying to have the documents yanked. As CNET points out this is a little bit odd considering that in recent weeks Facebook has been bagged for publishing info about its users’ online purchases and has defended itself, claiming it has every right to share private info about its users. Oh, the Harvard article also suggested Zuckerberg is kind of a sh*tbag. No idea where they got that idea.