经济与社会科学2022cesifo.org
Facebook 影子档案
Facebook Shadow Profiles
入门 · 约 35 分钟读完前置知识：数据隐私基础、社交网络追踪机制
导读
这篇工作论文研究 Facebook 的“影子档案”（shadow profiles）现象：即 Facebook 为从未注册其服务的用户收集和构建个人数据档案。论文以 PDF 形式发布在 CESifo，HN 讨论主要围绕非用户如何在不知情的情况下被追踪和建档。
HN 关注点：HN 读者长期关注 Facebook 对非用户的数据收集，这篇论文提供了学术佐证，讨论焦点是影子档案的构建方式及其隐私风险。
HN 评论精选
这几条评论里：质疑 2 补充 1 亲历 1
亲历亲历者证实：仅凭通讯录数据就能为无网络痕迹的人拼出详细档案，Facebook 必然在做类似的事。
这没什么好惊讶的。我在一家用户规模小得多的公司工作时做过非常类似的事——虽然没有形成实际的档案，但仅凭某人的号码出现在多个真实用户的通讯录里，你能收集到的信息就惊人：全名、工作单位、居住城市/街区、伴侣、爱好等各种你本不该知道的东西。而且这还不是那些把生活全晒在网上的人，而是几乎无网络痕迹的人。考虑到 Facebook 的主营业务就是用户画像和行为建模，认为它不做类似的事太天真了。
axegon_查看英文原文
That shouldn't be a surprise. At an old job with far smaller user base, we used to do something very similar and while the shadow profiles were not materialized in the form of actual profiles, the amount of data you can gather about someone just by having his/her number pop up in the contact list of several of your actual users is staggering: full name, workplace, city/neighborhood where they live, their partners, their hobbies and all sorts of things which you generally should not know. And we are not talking people who have their entire life published online, but people with little to no online visibility. Assuming that facebook is not doing something similar considering that their main business comes from profiling and modeling user behavior is just naive.
质疑担心 Facebook 能将身份信息档案与浏览历史档案匹配，对从未同意的非用户构成严重隐私威胁。
Facebook 对非用户也有影子档案，直接关联姓名、邮箱和/或电话号码，至少在人们向 Facebook 共享通讯录时就会生成。我一直好奇他们能否把两类影子档案匹配起来：一个含个人身份信息，另一个含详细浏览历史。那将引发巨大的隐私问题，尤其这些是非 Facebook 用户，从未以任何形式同意过。
slg查看英文原文
Facebook also has shadow profiles for non-users that connect directly to name, email address, and/or phone number. At the very least these seem to be populated when people share their contact list with Facebook. I have long wondered whether they can match these two kinds of shadow profiles together. One profile with personally identifiable information. The other profile with detailed browsing history. That would raise a huge privacy concern especially since these are non-Facebook users and therefore people who have not opted into this at any level.
补充补充技术细节：fbclid 参数可能作为跨站 cookie 的替代品用于追踪，可用浏览器插件去除。
在 Facebook 上分享的链接会附加 fbclid 查询参数（有趣的是 Google 广告链接也有对应的 glclid）。我认为这个参数的用途是替代跨站 cookie：点击链接时原始 URL 会作为 HTTP referrer 头传递，如果他们能拿到关联站点的日志，就可能追踪这些 fbclid 的流向。有趣的是每个细节都被用于追踪。浏览器按协议不会在 referrer 中去掉特定参数，但或许可以写个浏览器插件来做到。
MichaelMoser123查看英文原文
A link that is shared on facebook gets an additional fbclid query parameter (interesting that google has it's equivalent glclid query parameter for links from google adds).I think that it is easy to get rid of this query parameter, when want to use such a link. (just adding, as I don't see that mentioned in the pdf) I think that the purpose of this query param is to act as a substitute for cross site cookies: when you click on some link then the original url is further transfered as the http referrer header of the http request, if they can get hold of the logs of some affiliated site, then they can possibly track the flow of these fbclid attributes. Interesting to observe, how every tiny detail is getting used for tracking purposes. I guess that browsers won't get rid of any specific query parameters when the url is passed as the referrer header, as that would be a violation of the protocol. However it may be possible to write a browser plug-in that does so.
质疑质疑：用计算机跟踪本质上仍是跟踪；建议绝不向公司提供电话号码以防数据串联。
这让我想起苹果那些广告：一个人在城里走动，身后跟着越来越多的人（比如他刚购物过的所有收银员），令人毛骨悚然地盯着他的一切。在互联网/Facebook 出现之前，人们这样做从来都是不被接受的，为什么现在就“可以”了？跟踪现在成了“用计算机跟踪”，就成了新概念？另外，永远不要把电话号码给任何公司，他们太容易借此把各种线索连起来。如果某服务某天以“安全”为由要你的号码，把它理解为“为了收割你的数据”，然后别用了。
makecheck查看英文原文
I’m reminded of those Apple commercials where a person is wandering around town and is followed by increasingly large groups of people (e.g. the cashiers of all the places they were just shopping), creepily looking over their shoulders at everything. This was never “OK” for people to be doing before the Internet/Facebook so why should it be “OK” now? Stalking is now stalking “with computers” so that makes it a novel concept? P.S. That’s why you never give your phone number to ANY company, it’s too easy for them to connect a bunch of dots. And if a service one day decides to ask “for security”, interpret it as “for farming your data” and stop using them.
历次讨论
- 2022Hacker News 讨论帖324 分 · 145 评
同领域还值得读
一切的回报率，1870–2015
The Rate of Return on Everything, 1870–2015
利用1870–2015年多国的长期数据，估算股票、住房等各类资本的回报率，并将其与经济增长率进行比较。
经济与社会科学2019 · 487 分 · 260 评进阶 · 约 100 分钟编辑精选一切资产的回报率，1870–2015
The Rate of Return on Everything, 1870–2015
构建了 1870–2015 年 16 个国家的长周期资产回报数据集，覆盖股票、住房、政府债券和短期票据，系统比较各类资产的真实回报与波动性。
经济与社会科学2018 · 215 分 · 151 评进阶 · 约 120 分钟编辑精选一切资产的回报率，1870–2015（2019）
The Rate of Return on Everything, 1870–2015 (2019)
这篇发表于《经济学季刊》的论文构建了 1870–2015 年间 16 个主要发达国家的股票、债券、房地产等资产收益率的长周期数据库。
经济与社会科学2024 · 190 分 · 148 评进阶 · 约 80 分钟编辑精选想法是否越来越难找？
Are ideas getting harder to find?
探讨“想法是否越来越难找到”：通过衡量多个领域的“研究生产率”，发现维持相同的增长需要投入指数级增长的研究资源，即研究效率在持续下降。
经济与社会科学2016 · 182 分 · 106 评入门 · 约 60 分钟编辑精选比特币与区块链的经济极限
The Economic Limits of Bitcoin and the Blockchain
芝加哥大学 Eric Budish 的论文从经济学角度分析比特币与区块链的根本限制：核心论点是只要攻击网络（双花或砸盘做空）的收益超过挖矿成本，51% 算力攻击就有利可图，而挖矿…
经济与社会科学2018 · 176 分 · 37 评进阶 · 约 90 分钟编辑精选