Does cookies before FB registration really matters?

[blackhatlegend]

Lately, I read or hear from someone that cookies before FB registration are important.
The opinion is that "good" pre-registration cookies give more trust to newly registered account / help your account to stay alive for a bit longer time until checkpoint is thrown.

What is unclear for me in that opinion is that, how facebook sees your cookies if you were not registered or logged in at all (so, basically, you have completely clear browser)?

 

[joaovieiraaa]

Good question...

 

[LeadCloak]

Lately, I read or hear from someone that cookies before FB registration are important.
The opinion is that "good" pre-registration cookies give more trust to newly registered account / help your account to stay alive for a bit longer time until checkpoint is thrown.

What is unclear for me in that opinion is that, how facebook sees your cookies if you were not registered or logged in at all (so, basically, you have completely clear browser)?

This thread shows us some of the cookie methods fb uses... https://security.stackexchange.com/...ack-your-browsing-without-third-party-cookies

 

[Dresden]

Here is what a former Facebook CSO had to say about it:

“For example, if the datr cookie demonstrates that a browser has been visiting hundreds of sites in the last five minutes, that’s a pretty good indication we are dealing with a computer-controlled device (a bot).

On the flip side, consistent use over several days usually indicates that a browser is legitimate and should be able to access Facebook normally.

While we use this aggregated, statistical information about browsers for security, we thoroughly delete logs generated by the datr cookie after 10 days. People can delete the datr cookie and this associated information from their browser at any time.

Of course, the absence of history in the datr cookie reduces our ability to determine the legitimacy of a visit to our site, which means we will likely prompt for more information to help keep spammers out. These controls have been evaluated and validated repeatedly by the Irish Data Protection Commissioner.”

These past few days I have been visiting 5-10 sites that contain a Facebook Pixel everyday from each one of my browsers. I'll report back if I see any results.

I think visiting a couple sites a few days before logging in or registering an account could be a big plus. I will also be testing this in the following days.

 

[blackhatlegend]

This thread shows us some of the cookie methods fb uses... https://security.stackexchange.com/questions/220974/how-does-facebook-track-your-browsing-without-third-party-cookies

Here is what a former Facebook CSO had to say about it:

“For example, if the datr cookie demonstrates that a browser has been visiting hundreds of sites in the last five minutes, that’s a pretty good indication we are dealing with a computer-controlled device (a bot).

On the flip side, consistent use over several days usually indicates that a browser is legitimate and should be able to access Facebook normally.

While we use this aggregated, statistical information about browsers for security, we thoroughly delete logs generated by the datr cookie after 10 days. People can delete the datr cookie and this associated information from their browser at any time.

Of course, the absence of history in the datr cookie reduces our ability to determine the legitimacy of a visit to our site, which means we will likely prompt for more information to help keep spammers out. These controls have been evaluated and validated repeatedly by the Irish Data Protection Commissioner.”

These past few days I have been visiting 5-10 sites that contain a Facebook Pixel everyday from each one of my browsers. I'll report back if I see any results.

I think visiting a couple sites a few days before logging in or registering an account could be a big plus. I will also be testing this in the following days.

Big thanks to both of you. That information could be very useful. I will also test this because on paper it all looks quite logical.

 

[blackhatlegend]

Any results or information so far?

 

[M4DM4X]

Big thanks to both of you. That information could be very useful. I will also test this because on paper it all looks quite logical.

Did you make your tests?

 

[Dresden]

Doesn't seem like it has a huge impact for me. All of my accounts are still running without any locks or photo verifications.

Proper warm up and imitating human behavior seems to be working just fine.

 

[M4DM4X]

Doesn't seem like it has a huge impact for me. All of my accounts are still running without any locks or photo verifications.

Proper warm up and imitating human behavior seems to be working just fine.

I am switching to cookies right now, because login/pass always end up in a verif after a few days even with no spammy accs. Fingers crossed.

 

[blackhatlegend]

Doesn't seem like it has a huge impact for me. All of my accounts are still running without any locks or photo verifications.

Proper warm up and imitating human behavior seems to be working just fine.

I am switching to cookies right now, because login/pass always end up in a verif after a few days even with no spammy accs. Fingers crossed.

I have tried to register new accounts with/without cookies, no impact at all. Half of registration marked (checkpoint) right after clicking Submit button on Facebook.
It does not give me even to verify my phone number.
I am using multiloginapp + 4G proxies. Currently have no idea what to do next...

 

[Dresden]

I have tried to register new accounts with/without cookies, no impact at all. Half of registration marked (checkpoint) right after clicking Submit button on Facebook.
It does not give me even to verify my phone number.
I am using multiloginapp + 4G proxies. Currently have no idea what to do next...

Seems like it's a lot harder to make accounts these past few months. Did you try making one using a phone?

 

[blackhatlegend]

Seems like it's a lot harder to make accounts these past few months. Did you try making one using a phone?

Yeah, I don't have any problems registering on phones.
But, you know, phones don't give us same volumes as PC registration give so I'm still trying to figure it out.