3 ms·
That looks like a white-labelling (i.e. custom domain) of SendGrid's click tracking feature. As db38x noted, SendGrid is likely encoding a bunch of data in the
by jwilliams 9y ago
That looks like a white-labelling (i.e. custom domain) of SendGrid's click tracking feature.
As db38x noted, SendGrid is likely encoding a bunch of data in the link to keep things simple/fast on the back end. Possibly it's the actual target URL and some associated data like the link text.
It's also likely that they're conservative on the encoding they use to prevent issues with different email clients (looks like Alphanumeric, dash and underscore only).
That saves them tracking all that data in a database, which I presume at SendGrid's scale is quite a lot.
- curiouslyme 9y agoAh - I had not considered SendGrid. From an absolute security perspective, using some sort of hash or similar unique ID then referencing a database seems like the strongest solution. But you are right, at large scale encoding the data in the URL plus some sort of HMAC would provide strong security with no database overhead, which I'm sure becomes significant at scale. Might be interesting to try and reverse engineer their approach. Hash algorithms have a rather long history of being proven weaker than hoped... Especially down the road this could lead to some interesting possible exploits, mostly if the link was related to some kind of account a little more sensitive than meetup.com Thanks for clarifying my thinking on this matter...