Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Unfortunately, now this method will be flooded, and everyone of note in SV will be inundated with similar ads. But it is an interesting case study in how to be creative and think outside the box.

Facebook recently paid me a bounty for pointing out a problem that enabled this type of pinpoint targeting accuracy on their ad platform despite a policy that greatly limited it. It's interesting that LinkedIn doesn't consider it a privacy problem. I noticed that you could create custom audiences for ads by simply using anyone's FB vanity URL and appending @facebook.com to target by email. So if the vanity url of the target was facebook.com/mark, then you could target an ad to that person by simply adding mark@facebook.com to a custom audience list. They have now fixed it, but this same thing the author did here could have also been done on FB until about 2 months ago (and can still be done, but now you need their actual email address to target them).



I wish I'd known this back when I was actually running Facebook ads. I'm glad it was pointed out to them, but would have been great to know as I worked at an early large-scale FB advertiser.


I found this exploit a while back; when I checked more recently, the minimum number of people that you need to target in order for an ad to be accepted is closer to 1000. So it's harder to replicate.

similarly, with the facebook thing. I saw that Facebook is rolling back usage of the facebook.com email addresses, so I'm not sure how long that will keep working.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: