Facebook admits Beacon tracks logged-off users
Contradicts recent assurances by executives that ad service won't track off-site activities
IDG News Service - Facebook Inc. has confirmed a CA Inc. security researcher's findings that the social networking site's Beacon ad service is more intrusive than previously acknowledged, an admission that contradicts statements made earlier by Facebook executives and representatives.
Facebook's controversial Beacon ad system tracks the activities of its users even if they are logged off from the social networking site and have previously declined the option of having their activities on specific external sites broadcast to their Facebook friends, a company spokesman said via e-mail.
Although the spokesman said that Facebook deletes the data without using it, the admission will probably fan the flames of criticism of the service by privacy advocates.
The Facebook spokesman did not initially reply to a request for further explanation on how the Beacon action gets triggered if a user is logged off from Facebook, when the social networking site's ability to track its users' activities should be inactive.
It's also unclear whether Facebook plans to modify Beacon so it doesn't track and report on the activities of logged-off users.
Beacon is a key part of the Facebook Ads platform introduced by the social networking firm with much fanfare several weeks ago. Beacon tracks certain activities of Facebook users on more than 40 participating Web sites, including those of online retailers Blockbuster and Fandango, and it reports those activities to the users' Facebook friends, unless told not to do so.
Off-Facebook activities that can be broadcast to one's Facebook friends include purchasing a product and signing up for a service.
The program has been blasted by advocacy groups like MoveOn.org, and by individual users whose recent purchases and other Web activities have been transmitted to their Facebook friends. This has led to some embarrassing situations, such as blowing the surprise of holiday presents.
Last Thursday night, Facebook tweaked Beacon to make its workings more explicit to users and to make it easier to nix broadcast messages and opt out of having activities tracked on specific Web sites. Facebook didn't go as far as providing a general opt-out option for the entire Beacon program, as some had hoped.
Then, on Friday, just hours after Facebook had scored some points with its modifications to Beacon, Stefan Berteau, a senior research engineer at CA's Threat Research Group, blogged on CA's Web site about Beacon's until-then unknown ability to monitor logged-off users' activities and send the data back to Facebook.
Users aren't informed that data on their activities at these sites is flowing back to Facebook, nor are they given the option to block that information from being transmitted, according to Berteau.
If users have ever checked the option for Facebook to "remember me" -- which saves users from having to log onto the site upon every return to it -- Facebook can tie their activities on third-party Beacon sites directly to them, even if they're logged off and have opted out of the broadcast. If they have never chosen this option, the information still flows back to Facebook, although without it being tied to their Facebook ID, according to Berteau.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts