22

I recently visited opensecrets.org and was surprised to see a message box in the lower right corner of the window asking if I wanted to talk, and displaying my name.

The pop-up says Chat with opensecrets.org in Messenger.

As far as I know, I haven't allowed Facebook to share any data with this site, so how does this website know my name?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Bolton Bailey
  • 331
  • 3
  • 7

1 Answers1

45

I went on that website and this is what I saw:

Screenshot of opensecrets.org

They are using the Customer Chat Plugin from Facebook.

They don't know your name, they're just embedding an iframe to allow you to speak with their Facebook page's administrator(s).

Only Facebook knows who you are.

Benoit Esnard
  • 13,942
  • 7
  • 65
  • 65
  • 3
    Is it really an iframe and not just a DIV section? If so, what prevents the main website to access its DOM with JS and retrieve the user's name? – A. Hersean Feb 25 '19 at 12:37
  • 8
    @A.Hersean That's really an iframe, so the website can't read the name nor the discussion. – Benoit Esnard Feb 25 '19 at 13:05
  • 115
    "Only Facebook knows who you are." Sounds like a quote from a horror movie. – Overmind Feb 25 '19 at 13:23
  • 2
    Keep in mind that _if you continue_ then they will know you are chatting with them from their web page. – Michael Hampton Feb 25 '19 at 14:54
  • 1
    Were you logged in to Facebook when that chat popped up? – BruceWayne Feb 25 '19 at 15:12
  • 1
    @BruceWayne: I was. – Benoit Esnard Feb 25 '19 at 15:22
  • 4
    Maybe a slightly more detailed part to the answer that I think OP is looking for: The website does not know who you are. The website just sends a "facebook thing" to your browser, as part of its webpage. When your page loads in your browser, the "facebook thing", which runs in a facebook domain iframe, accesses your local cookie (which was created by visiting facebook), and uses that cookie to figure out your identity. The original website still has no idea what your identity is, but your **local** browser page (which is showing a page that once came from the web server) and Facebook does. – Flater Feb 25 '19 at 16:07
  • Comments are not for extended discussion; this conversation has been [moved to chat](https://chat.stackexchange.com/rooms/90327/discussion-on-answer-by-benoit-esnard-website-seeing-my-facebook-data). – schroeder Feb 27 '19 at 13:42