5 ms·

Can’t you just add click event listeners in JavaScript to do the same thing? Honestly I never knew the ping spec existed and thought that was what people were u

by btown 8y ago

Can’t you just add click event listeners in JavaScript to do the same thing? Honestly I never knew the ping spec existed and thought that was what people were using to accomplish this.

thaumasiotes 8y ago
I thought what people did to accomplish this was to make links that go to the tracking page, and have the tracking page redirect to the real destination. That seems to be what happens when you click on a google result.
- jniedrauer 8y ago
  uBlock origin blocks some of these and gives you the target link with the option to go directly to it. But it misses a lot of them.
- chatmasta 8y ago
  I see a POST + GET when clicking on a Google SERP URL. [0] I saw another variation of this the other day [1] where an advertisement would spoof the href so that the "hover preview" was misleading, and an onMouseOver event handler would swap the href before you click it. [0] https://pasteboard.co/I93MWvH.png https://pasteboard.co/I93MWvH.png [1] https://pasteboard.co/I93NKsG.png https://pasteboard.co/I93NKsG.png
kgwxd 8y ago
Yes, unless JS is disabled, now even disabling JS isn't enough. This move sucks hard. Please, everyone, move to Firefox now, even if it's only for personal browsing (use what you must for work), and write a strongly worded message to the maker of the browser you are leaving.
- TheAceOfHearts 8y ago
  If you have JavaScript disabled they can still redirect you through a portal page to capture your visit and then send you to the actual link.
  - timwis 8y ago
    not if your computer's off tho
  - Grollicus 8y ago
    But that means they have to send links to the tracking page, that will show the tracking page on hover as the link destination etc. That is much more noticeable than sending a link that shows www.google.com but instead goes somewhere else on click.
  - kgwxd 8y ago
    That's transparent. They're claiming this is more transparent when it's not transparent at all. The browser is supposed to be a user agent, not a corporate lackey.
- geocar 8y ago
  You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>
  - danShumway 8y ago
    I just tested this in Firefox. If the request isn't cached, it just immediately times out as soon as the page load begins. I haven't tested to see if it still gets delivered to the server. If the browser is sending out the request and just not waiting for a response, then it would still be usable. It's still worth noting though that in either case this is a way more complicated attack than adding a ping attribute. With the ping attribute, you don't have to worry about browser caching because you're using a post request. If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. You also need to worry about false positives and false negatives -- a user clicking on a link and then dragging off of it without visiting will still trigger your tracking code, and a user navigating via keyboard controls won't trigger this at all. None of that is to say that CSS tracking isn't something we should worry about (for instance, I really wish Firefox disabled `visited` styling by default), but I don't think this is an effective argument for saying that we should just give up and make tracking even easier (not that parent is claiming this). And in any case, it's also not like it would be exactly hard for a future version of Firefox to add an option that disabled `active` styling specifically for link tags. Tracking protection is a game of cat and mouse. We patch things as we go.
    - geocar 8y ago
      > I haven't tested to see if it still gets delivered to the server. I have, and it does.
    - minitech 8y ago
      > If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. Or serve Cache-Control: no-cache?

by btown 8y ago

Can’t you just add click event listeners in JavaScript to do the same thing? Honestly I never knew the ping spec existed and thought that was what people were using to accomplish this.

thaumasiotes 8y ago

I thought what people did to accomplish this was to make links that go to the tracking page, and have the tracking page redirect to the real destination. That seems to be what happens when you click on a google result.

jniedrauer 8y ago
uBlock origin blocks some of these and gives you the target link with the option to go directly to it. But it misses a lot of them.
chatmasta 8y ago
I see a POST + GET when clicking on a Google SERP URL. [0] I saw another variation of this the other day [1] where an advertisement would spoof the href so that the "hover preview" was misleading, and an onMouseOver event handler would swap the href before you click it. [0] https://pasteboard.co/I93MWvH.png https://pasteboard.co/I93MWvH.png [1] https://pasteboard.co/I93NKsG.png https://pasteboard.co/I93NKsG.png

kgwxd 8y ago

Yes, unless JS is disabled, now even disabling JS isn't enough. This move sucks hard. Please, everyone, move to Firefox now, even if it's only for personal browsing (use what you must for work), and write a strongly worded message to the maker of the browser you are leaving.

TheAceOfHearts 8y ago
If you have JavaScript disabled they can still redirect you through a portal page to capture your visit and then send you to the actual link.
- timwis 8y ago
  not if your computer's off tho
- Grollicus 8y ago
  But that means they have to send links to the tracking page, that will show the tracking page on hover as the link destination etc. That is much more noticeable than sending a link that shows www.google.com but instead goes somewhere else on click.
- kgwxd 8y ago
  That's transparent. They're claiming this is more transparent when it's not transparent at all. The browser is supposed to be a user agent, not a corporate lackey.
geocar 8y ago
You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>
- danShumway 8y ago
  I just tested this in Firefox. If the request isn't cached, it just immediately times out as soon as the page load begins. I haven't tested to see if it still gets delivered to the server. If the browser is sending out the request and just not waiting for a response, then it would still be usable. It's still worth noting though that in either case this is a way more complicated attack than adding a ping attribute. With the ping attribute, you don't have to worry about browser caching because you're using a post request. If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. You also need to worry about false positives and false negatives -- a user clicking on a link and then dragging off of it without visiting will still trigger your tracking code, and a user navigating via keyboard controls won't trigger this at all. None of that is to say that CSS tracking isn't something we should worry about (for instance, I really wish Firefox disabled `visited` styling by default), but I don't think this is an effective argument for saying that we should just give up and make tracking even easier (not that parent is claiming this). And in any case, it's also not like it would be exactly hard for a future version of Firefox to add an option that disabled `active` styling specifically for link tags. Tracking protection is a game of cat and mouse. We patch things as we go.
  - geocar 8y ago
    > I haven't tested to see if it still gets delivered to the server. I have, and it does.
  - minitech 8y ago
    > If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. Or serve Cache-Control: no-cache?