4 ms·

Isn't this true about any link?

ocdtrekkie 7y ago
No. If you hover over a link in your web browser, regardless of what it says on the link, the hover text (often appearing at the bottom left of your web browser) should show you the real, full destination URL. Try hovering over any link in HN, and you'll see the URL you're going to actually go to when you click on it. However, when you hover over a Google Ads link, it does not do this. It shows you a friendly URL for the destination (such as https://www.ebay.com https://www.ebay.com) but when you click on it, you get redirected with a bunch of tracking stuff added or even through a URL not on the ebay.com domain, as shown in this "exploit". In fact, even if an advertiser were to use a "clean" link as the destination, you first get redirected on that click through a google.com URL, even though the hover text is still lying about the destination. I'm not even sure what it's doing here, there's some neat JavaScript in play. The hover text shows the "clean" URL, but if I inspect it, and then hover over it again, it shows the real redirect URL through google.com.
- albertgoeswoof 7y ago
  You’re wrong about being able to trust standard anchor links- you can’t. You can intercept the click using an onclick handler and redirect the user to wherever you want. Viglink and Skimlink do this for affiliate programs, which is somewhat legitimate.
  - ndiscussion 7y ago
    We posted at the same time, you're right. Disabling js fixes this (and so many other problems) js websites cannot be trusted
- ndiscussion 7y ago
  They detect a left-click and in the click handler they replace the href, so it's impossible to see before navigating. Pretty evil huh?
- rasz 7y ago
  Google has been doing this on google.com search page for ages before "upgrading" to ping I used to run if((event.target.tagName.toLowerCase() === 'a') && (event.target.childNodes[0]) && (/^(http?:\/\/(www\.|encrypted\.)?google\.[^\/]*)?\/?url/.test(event.target.href))) { var matches = /[\?&](url)=(.+?)&/.exec(event.target.href); if (matches != null) { event.target.href = unescape(matches[2]); } } nowadays if (link.ping) link.ping = null; is enough
  - megous 7y ago
    browser.send_pings = false on Firefox
deleted 7y ago
[deleted]

No. If you hover over a link in your web browser, regardless of what it says on the link, the hover text (often appearing at the bottom left of your web browser) should show you the real, full destination URL. Try hovering over any link in HN, and you'll see the URL you're going to actually go to when you click on it. However, when you hover over a Google Ads link, it does not do this. It shows you a friendly URL for the destination (such as https://www.ebay.com https://www.ebay.com) but when you click on it, you get redirected with a bunch of tracking stuff added or even through a URL not on the ebay.com domain, as shown in this "exploit". In fact, even if an advertiser were to use a "clean" link as the destination, you first get redirected on that click through a google.com URL, even though the hover text is still lying about the destination. I'm not even sure what it's doing here, there's some neat JavaScript in play. The hover text shows the "clean" URL, but if I inspect it, and then hover over it again, it shows the real redirect URL through google.com.

albertgoeswoof 7y ago
You’re wrong about being able to trust standard anchor links- you can’t. You can intercept the click using an onclick handler and redirect the user to wherever you want. Viglink and Skimlink do this for affiliate programs, which is somewhat legitimate.
- ndiscussion 7y ago
  We posted at the same time, you're right. Disabling js fixes this (and so many other problems) js websites cannot be trusted
ndiscussion 7y ago
They detect a left-click and in the click handler they replace the href, so it's impossible to see before navigating. Pretty evil huh?
rasz 7y ago
Google has been doing this on google.com search page for ages before "upgrading" to ping I used to run if((event.target.tagName.toLowerCase() === 'a') && (event.target.childNodes[0]) && (/^(http?:\/\/(www\.|encrypted\.)?google\.[^\/]*)?\/?url/.test(event.target.href))) { var matches = /[\?&](url)=(.+?)&/.exec(event.target.href); if (matches != null) { event.target.href = unescape(matches[2]); } } nowadays if (link.ping) link.ping = null; is enough
- megous 7y ago
  browser.send_pings = false on Firefox

deleted 7y ago

[deleted]