5 ms·

Those tracking links are so annoying. They make it hard to see where the link is actually going. A newsletter could be linking to Wikipedia, but if you open the

Those tracking links are so annoying. They make it hard to see where the link is actually going. A newsletter could be linking to Wikipedia, but if you open the message in Gmail, there could be two or more layers of trackers in that URL. Example: The Frontend Focus newsletter in Gmail The link of the first news headline is something like https://www.google.com/url?q=https%3A%2F%2Ffrontendfoc.us%2Flink%2F109272%2Fc0daad1d97&sa=D&sntz=1&usg=AFQgCNFEh5TaNZpHqsqyBGWEaq2iL9MwCg The actual URL is https://www.slashgear.com/safari-overhaul-includes-tab-groups-and-web-extensions-on-mobile-07676634/

twobitshifter 5y ago
Yes and then if you use a content blocker the link will inevitably end up blocked.
professorsnep 5y ago
I just had to deal with an annoying tracking link to unsubscribe from an unsolicited mailing list. uBlock even blocked the link click, I had to temporarily allow the tracker to unsubscribe.
- legitster 5y ago
  Unsubscribe links have to have your identifier in them so you know who to unsubscribe when you click the link. We used to ask people for their email address to unsubscribe them, but then they accused us of using a dark pattern to keep them subscribed. So letting people unsubscribe easier with fewer hoops to jump through seems like the lesser of two evils.
boneitis 5y ago
Of course, this does nothing to subvert the tracking services like mailchimp that bury the final destination behind their own link, but... Ctrl+Alt+T $ python3 >>> from urllib import parse >>> parse.unquote('https%3A//www.google.com/url%3Fq%3Dhttps%3A//www.example.com/foo.php%3Fp0%3Darg0%26p1%3Darg1%26p2%3Darg2%26yoursoul%3DaXNtaW5l') 'https://www.google.com/url?q=https://www.example.com/foo.php?p0=arg0&p1=arg1&p2=arg2&yoursoul=aXNtaW5l' >>> from base64 import b64decode as bd >>> bd(b'aXNtaW5l') b'ismine' >>> Copy into clipboard: https://www.example.com/foo.php https://www.example.com/foo.php Ctrl+D Ctrl+D Why I even bother in 2021? I don't know.
- dredmorbius 5y ago
  URL expanders may also be useful here, where expanding encoded URLs isn't sufficient. I've found https://urlex.org/ https://urlex.org/ useful (top DDG search result). You end up with the disambiguated link in most cases (Twitter, Bitly, and similar shorteners). I've not looked to see how many levels of redirection/misdirection it will resolve.
  - OJFord 5y ago
    What does thay actually achieve though? You've still given an 'opened' hit, even if urlex expands it on the server instead of client-side (which would be truly useless). You're disguising location and device information, but that's about it?
    - dredmorbius 5y ago
      Fair point, though there are some benefits: - The "hit" comes from the resolver rather than your own IP. So long as there's no referrer pass-through of personal information, your location is minimised. - Such links often come through other social media, in my case, rather than email. In the specific case of email this practice is of little use in protecting privacy. However if you're sanitising links pulled off social media shares or the like, you're at least preventing downstream contamination. - Another practice is to randomly scramble any visible identifiers. This presumes longer URLs, rather than shortened ones. - In practice, I scrub any "utm-medium" or similar URI attributes as a matter of course. URLEX is helpful for expanding shortened links ... which I've not encountered so much in email, though truth be told, I've largely abandoned email for numerous reasons, the present topic included.
    - boneitis 5y ago
      At the least, a log hit from a different IP, I suppose. They're right, I totally forgot to mention the unshortener services, which are what I actually mostly use my Python routine (shared upthread) on. It's largely for self-amusement, admittedly. For the Google links, I actually use an extension to automatically restore the original URL links.
ivanche 5y ago
There is a Firefox extension that clears URL named, appropriately, ClearURLs :) https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ https://addons.mozilla.org/en-GB/firefox/addon/clearurls/
- lordgrenville 5y ago
  So this is nice but doesn't do what I'm looking for, which is: given an email with links like OP's (https://www.google.com/ https://www.google.com/...), go over it, follow each link to its final redirect and then replace the href with that (in this case, https://www.slashgear.com/ https://www.slashgear.com/...), letting me (for example) preview the links on mouse-over before clicking. I thought it might be possible to build something like this with curl -Ls -w %{url_effective}, but seems like it only handles HTTP 302 redirects, whereas this site seems to be using Javascript, so you probably need a real crawler.
  - beagle3 5y ago
    But do note that if such a thing existed, the actual resolution leaks information about your actions (the fact you are reading it / hovering, etc)
    - londons_explore 5y ago
      Not if it's done by the mail server in receipt of any email, even spam.
- withinboredom 5y ago
  In my experience, it breaks any links with url encoded data in it (like links that redirect you to a login page, or contain an encoded hash)
rypskar 5y ago
It used to be always check the link before clicking to know it isn't a phishing email, now everyone is hiding the actual link
- pjerem 5y ago
  And that is in the emails. Now every social network / search engine modify the link on click so that you have the right link on hover but a tracking link once you click. Browsers should disallow this.

twobitshifter 5y ago

Yes and then if you use a content blocker the link will inevitably end up blocked.

professorsnep 5y ago

I just had to deal with an annoying tracking link to unsubscribe from an unsolicited mailing list. uBlock even blocked the link click, I had to temporarily allow the tracker to unsubscribe.

legitster 5y ago
Unsubscribe links have to have your identifier in them so you know who to unsubscribe when you click the link. We used to ask people for their email address to unsubscribe them, but then they accused us of using a dark pattern to keep them subscribed. So letting people unsubscribe easier with fewer hoops to jump through seems like the lesser of two evils.

boneitis 5y ago

Of course, this does nothing to subvert the tracking services like mailchimp that bury the final destination behind their own link, but... Ctrl+Alt+T $ python3 >>> from urllib import parse >>> parse.unquote('https%3A//www.google.com/url%3Fq%3Dhttps%3A//www.example.com/foo.php%3Fp0%3Darg0%26p1%3Darg1%26p2%3Darg2%26yoursoul%3DaXNtaW5l') 'https://www.google.com/url?q=https://www.example.com/foo.php?p0=arg0&p1=arg1&p2=arg2&yoursoul=aXNtaW5l' >>> from base64 import b64decode as bd >>> bd(b'aXNtaW5l') b'ismine' >>> Copy into clipboard: https://www.example.com/foo.php https://www.example.com/foo.php Ctrl+D Ctrl+D Why I even bother in 2021? I don't know.

dredmorbius 5y ago
URL expanders may also be useful here, where expanding encoded URLs isn't sufficient. I've found https://urlex.org/ https://urlex.org/ useful (top DDG search result). You end up with the disambiguated link in most cases (Twitter, Bitly, and similar shorteners). I've not looked to see how many levels of redirection/misdirection it will resolve.
- OJFord 5y ago
  What does thay actually achieve though? You've still given an 'opened' hit, even if urlex expands it on the server instead of client-side (which would be truly useless). You're disguising location and device information, but that's about it?
  - dredmorbius 5y ago
    Fair point, though there are some benefits: - The "hit" comes from the resolver rather than your own IP. So long as there's no referrer pass-through of personal information, your location is minimised. - Such links often come through other social media, in my case, rather than email. In the specific case of email this practice is of little use in protecting privacy. However if you're sanitising links pulled off social media shares or the like, you're at least preventing downstream contamination. - Another practice is to randomly scramble any visible identifiers. This presumes longer URLs, rather than shortened ones. - In practice, I scrub any "utm-medium" or similar URI attributes as a matter of course. URLEX is helpful for expanding shortened links ... which I've not encountered so much in email, though truth be told, I've largely abandoned email for numerous reasons, the present topic included.
  - boneitis 5y ago
    At the least, a log hit from a different IP, I suppose. They're right, I totally forgot to mention the unshortener services, which are what I actually mostly use my Python routine (shared upthread) on. It's largely for self-amusement, admittedly. For the Google links, I actually use an extension to automatically restore the original URL links.

ivanche 5y ago

There is a Firefox extension that clears URL named, appropriately, ClearURLs :) https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ https://addons.mozilla.org/en-GB/firefox/addon/clearurls/

lordgrenville 5y ago
So this is nice but doesn't do what I'm looking for, which is: given an email with links like OP's (https://www.google.com/ https://www.google.com/...), go over it, follow each link to its final redirect and then replace the href with that (in this case, https://www.slashgear.com/ https://www.slashgear.com/...), letting me (for example) preview the links on mouse-over before clicking. I thought it might be possible to build something like this with curl -Ls -w %{url_effective}, but seems like it only handles HTTP 302 redirects, whereas this site seems to be using Javascript, so you probably need a real crawler.
- beagle3 5y ago
  But do note that if such a thing existed, the actual resolution leaks information about your actions (the fact you are reading it / hovering, etc)
  - londons_explore 5y ago
    Not if it's done by the mail server in receipt of any email, even spam.
withinboredom 5y ago
In my experience, it breaks any links with url encoded data in it (like links that redirect you to a login page, or contain an encoded hash)

rypskar 5y ago

It used to be always check the link before clicking to know it isn't a phishing email, now everyone is hiding the actual link

pjerem 5y ago
And that is in the emails. Now every social network / search engine modify the link on click so that you have the right link on hover but a tracking link once you click. Browsers should disallow this.