11 ms·
Google does this so they have click tracking data. But they don't need to mangle URLs in Chrome because it supports the `ping` attribute on <a> tags [0]. The p
by varenc 5y ago
Google does this so they have click tracking data. But they don't need to mangle URLs in Chrome because it supports the `ping` attribute on <a> tags [0].
The ping attribute basically adds click tracking as a native browser feature so you don't need to do URL redirects. It also makes these analytics much easier for the site and mysterious to the user. Looks like most vendors besides Firefox support it. (They were pretty opposed I recall)
If you're a Chrome user, there's some extensions that disable ping requests/link auditing [1]. (EDIT: a commenter noted that uBlock Origin already blocks these! So I recommend that over this obscure extension)
[0] https://caniuse.com/ping https://caniuse.com/ping
[1] https://chrome.google.com/webstore/detail/ping-blocker/jkpocifanmihboebfhigkjcdihgfcdnb https://chrome.google.com/webstore/detail/ping-blocker/jkpoc...
- hvdijk 5y agoFirefox has a browser.send_pings setting to control this, not sending any pings when it is set to false. This is explicitly a valid browser implementation of the ping attribute: https://html.spec.whatwg.org/multipage/links.html#hyperlink-auditing https://html.spec.whatwg.org/multipage/links.html#hyperlink-... > 2. Optionally, return. (For example, the user agent might wish to ignore any or all ping URLs in accordance with the user's expressed preferences.) The problem isn't that Firefox doesn't support the ping attribute, the problem is that Google fails to respect user requests not to track.
- metalliqaz 5y agoExactly. That's why I solved this problem by using DDG. Although I admit some searches I have to send to Google to get the result I'm looking for.
- zuhsetaqi 5y agoSame for me, but all google searches are done by DDG bangs like 'g!'
- metalliqaz 5y agoYeah, me too. Love the bang system. Don't forget to put the exclamation point in front! "!g"
- greenyoda 5y ago> Don't forget to put the exclamation point in front! "!g" At least some of the bang keywords work with the "!" on either side. I tried "g!" and "w!" and they work OK.
- zuhsetaqi 5y agoFor all the bangs I use it works either way but yes, the official way is with the exclamation in front
- zokula 5y agoUsing bangs defeats the purpose of using DDG in the first place. And DDG tracks your clicks just like Google does.
- zuhsetaqi 5y agoAbsolutely not at all. It's the reason number one why I use it because very often I know on which page I want to search for a query. And having DDG as the default search engine in the browser gives me the ability to use the URL bar to directly query Youtube with !yt or Wikipedia with !w and a lot more.
- mrguyorama 5y ago>use the URL bar to directly query Youtube with !yt or Wikipedia with !w and a lot more. My understanding is both Chrome and Firefox can do this natively, ie without DDG
- zuhsetaqi 5y agoYes you can add these, in Firefox it's called Search Shortcuts and a few are there by default. But there are a few reason why I prefer DDG: 1. I don't have to add those things in my Browser 2. When I searched DDG for something don't find good stuff I can just go to the search bar on the DDG page and add any !bang to query a search engine I like (!y for Yahoo, !g for Google, …) 3. No matter which Browser I use on which device, the only thing I have to change is the default Search engine and it's set up for anything I want to search. This is especially nice for me since I use Firefox on my Mac, Brave and Safari on my iPhone and Brave and Chromium on my Windows device
- Dah00n 5y agoSeems to me the old Emac (or vi) saying have changed. Today it is "How do you know someone uses DDG? He'll tell you!"
- mcdevilkiller 5y agoHow do you know someone uses Google? Well, virtually everyone does, so they probably do.
- Ajedi32 5y agoSeems like it's set to false by default. So it's not really a "user request" not to track so much as a "browser request" not to. Reminds me of the situation with the "Do Not Track" header where browsers sending it by default caused the signal to lose all meaning.
- JohnFen 5y agoThat wasn't what caused DNT to fail. What caused it to fail was that websites could decide whether or not to honor it, and honoring it would have meant a reduced ability to spy on people, impacting their income.
- Ajedi32 5y agoThat was part of it. Obviously if sites had no choice in the matter then it wouldn't have mattered whether browsers enabled it by default or not. Since it was a voluntary thing though, browsers sending it by default pretty much destroyed what chance there was of mainstream sites deciding to implement support for it. It's one thing to give up on tracking a small portion of users who explicitly opt-out, and another thing entirely to give up on tracking everyone except for a tiny minority who choose to opt-in.
- 8note 5y agoIf browsers weren't sending it be default, it wouldnt have any support because nobody saw enough traffic with it to implement it. The design is the problem since websites who don't feel like it don't have to honor it. Whether it's because it'll bankrupt them by everyone setting it, or not bothering with supporting their unprofitable users.
- metalliqaz 5y agoIts reasonable to assume that users choose a more privacy focused browser intentionally, meaning that "default" setting is intended by the user and not a decision that's made for them without their knowledge.
- varenc 5y agoI noticed this part of the spec too: > When the `ping` attribute is present, user agents should clearly indicate to the user that following the hyperlink will also cause secondary requests to be sent in the background, possibly including listing the actual target URLs. > For example, a visual user agent could include the hostnames of the target ping URLs along with the hyperlink's actual URL in a status bar or tooltip. Does any browser supporting pings actually do that?? Also the "Note" in that section provides a decent argument for supporting `ping`. Basically, users will have their clicks tracked anyway, but the `ping` attribute provides more transparency and a better user experience. Though the transparency part is debatable given browser implementations.
- kevin_thibedeau 5y agoThird party links won't be "tracked anyway" if you're blocking JS. That's the only reason to have this feature since a site can track activity from its own links via logs.
- nephanth 5y agoThis is wrong : what google currently does on firefox is make you go through a link that logs you clicked on it, then redirects you to your destination. This doesn't need any javascript, it just needs to log your http request, so it should work on any browser (even, say, elinks)
- account42 5y ago> Also the "Note" in that section provides a decent argument for supporting `ping`. Basically, users will have their clicks tracked anyway, but the `ping` attribute provides more transparency and a better user experience. I see this argument used a lot for including user-hostile features in browsers. I don't think it's a good argument since having a browser implementation a) makes this privacy abuse easier and b) legitimizes the practice. Meanwhile as shown in this post, user-preference to disable the feature is ignored and simply worked around by websites.
- matheusmoreira 5y agoThe ping attribute is blocked by uBlock Origin. It's called hyperlink auditing in the dashboard.
- hosteur 5y agoI don’t want my clicks to be tracked!
- dimitrios1 5y agoThen call your ISP! They are tracking them, too!
- input_sh 5y agoOkay? Does that mean my search engine should do that too? Two wrongs don't make a right.
- dimitrios1 5y agoSorry, my wording insinuates it's an either or. I meant to point out this is a war that needs to be fought on multiple fronts, and arguably your ISP has the better data (with the worse IT security, to boot)
- fsckboy 5y agoyou just told your free search engine all the different variations on the search strings you're looking for, basically all what is on your mind, and you've chosen your search engine based on the quality of the search they provide, and now you don't want them to know which result you chose? I'd argue that it's the one piece of information they are most entitled to in the tit-for-tat, you help me and I'll help you arrangement you two have.
- vikingerik 5y agoEven through HTTPS? They'll have the domain and IP address and transfer size, but not the URL or contents of the traffic. (Unless they managed to MITM a trusted certificate somehow.)
- dimitrios1 5y agoHTTPS encrypts the host? Thought you had to know where to go to open that secure transmission. It's enough for your ISP to know you went to "pornhub.com" for example.
- nextos 5y agoFor Firefox, there's a relatively popular extension called ClearURLs that sanitizes most URLs to remove tracking, including Google's and Amazon's.
- johnmaguire 5y agoI did notice a bug with this... I had a magic link for authentication in Gmail that used a `+` symbol in a URL, e.g. `http://example.com/token/abcd123+3cf== http://example.com/token/abcd123+3cf==` and ClearURLs ended up convering the `+` to a `%20` which caused the server to fail to find the token. Otherwise I love ClearURLs.
- deleted 5y ago[deleted]
- aembleton 5y agoOr you can add https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt https://raw.githubusercontent.com/DandelionSprout/adfilt/mas... to your uBlock Origin filters
- woodruffw 5y agoIt’s also a notable DDoS amplification vector[1]. [1]: https://securityaffairs.co/wordpress/83890/hacking/ddos-html-hyperlink-audit-ping.html https://securityaffairs.co/wordpress/83890/hacking/ddos-html...
- Ajedi32 5y agoI'm confused as to why ping was used in that situation at all, rather than, for example, just a normal POST request.
- judge2020 5y agoDoesn't require running javascript, so presumably the devices could be more efficient in sending them versus XHR/fetch.
- Ajedi32 5y agoThe article specifically says the offending pages used JavaScript to add the ping attribute to the <a> tags, so the attack wouldn't have worked against users with JS disabled anyway.
- woodruffw 5y agoMy understanding of the actual amplification vector is that the JS is just obfuscation on top: they could have just as easily deployed static HTML with those attributes.
- aembleton 5y agoIt doesn't use Ping on Chrome browsers. For example, this is how the a tag looks like on Chromium: <a href="https://news.ycombinator.com/ https://news.ycombinator.com/" data-ved="2ahUKEwiIxrz0jKDzAhUWHcAKHQnnArkQFnoECAcQAx" ping="/url?sa=t&source=web&rct=j&url=https://news.ycombinator.com/&ved=2ahUKEwiIxrz0jKDzAhUWHcAKHQnnArkQFnoECAcQAx https://news.ycombinator.com/&ved=2ahUKEwiIxrz0jKDzAhUWH..."> and this is how it looks like in Firefox: <a href="https://news.ycombinator.com/ https://news.ycombinator.com/" data-ved="2ahUKEwj9i67MjKDzAhXUfMAKHWJcCYsQFnoECA0QAx" onmousedown="return rwt(this,'','','','','AOvVaw3F-2xUE22tTvOxNDwVufx-','','2ahUKEwj9i67MjKDzAhXUfMAKHWJcCYsQFnoECA0QAx','','',event)"> You can see that Chromium based browsers call a ping endpoint whereas Firefox browsers use a mousedown event. This device detection uses the user agent; changing it on Firefox to look like Chrome results in a ping attribute instead of mousedown.
- zo1 5y agoNot to be facetious but Wow - I'm not sure how we let that "feature" slide past the "privacy" folk.
- Santosh83 5y agoIt didn't slide past. I recall a lot of discussions but those discussing and outraging are not the ones implementing and pushing forward with sheer momentum of technological dominance and money. It's the same for every privacy issue.
- IncRnd 5y agoThis is actually well-known and gets blocked by ublock origin and others.
- rodgerd 5y agoThe Google monopoly doesn't give a fuck.
- NelsonMinar 5y agoNote the caniuse link says "While still in the WHATWG specification, this feature was removed from the W3C HTML5 specification in 2010." Another reason I prefer Firefox. Why implement a rejected non-standard feature whose primary purpose is to enable surveillance?
- judge2020 5y ago> whose primary purpose is to enable surveillance Google search is good because it tracks what links people click and knows when they come back to go to a different url on the page. if 99% of people visit the top result for a query, return, then hit the second one, chances are that the top result never answers what the search query asks.
- inetknght 5y ago> Google search is good because Google search might have been good over a decade ago but today it's trash.
- dragonwriter 5y ago> Google search might have been good over a decade ago but today it's trash. IME, its still consistently far and away better than the alternatives. Part of the difference in perception of quality may be that over time it has come to use more personal signals to zero in on relevant results, and the people that complain about how bad it is overlap considerably with those who actively seek to deny those signals to Google.
- spinningslate 5y agogood point, that seems plausible. It's an unenviable choice though: good results from incessant surveillance (and nasty link re-writing per topic), or poor results if you use it infrequently. [I wouldn't know. I've been using DDG for so long now, I can't remember the last time I used Google search. Maybe I've forgotten how much better G is. Truth is, though, DDG does what I need of it. Rarely come away without the answer I want. So no temptation to use Google. At. All.]
- JohnFen 5y agoSupport for the ping attribute is one of the several reasons why I don't use Chrome/Chromium.
- amelius 5y agoIs this turned on by default in Chromium too?
- johnchristopher 5y agoSo that's what is going on https://news.ycombinator.com/item?id=21427341 https://news.ycombinator.com/item?id=21427341 I thought I was the only one.
- eps 5y agoI see no cases when I, as a user, would want my broswer to support "ping" attribute. It's basically shady as fuck.
- dudus 5y agoIt would allow Google or other companies to track which result the user clicked without resorting to more complex JavaScript tracking or redirects. I bet anyone would prefer the ping method rather than the redirects we see on Firefox that mangle copied urls. You seem to be of the opinion that no tracking would be better. And that's fine and a popular opinion around here. But that's not an option as Google relies heavily on the clicks as an input for ranking. So in a context where you consider tracking HAS to happen ping does offer advantages for the user.
- ddevault 5y agoThis might hold up better if Google's rankings were actually good for all of the spyware they add. Here's a search I performed earlier today: https://l.sr.ht/u1vK.png https://l.sr.ht/u1vK.png The desired result is indicated in red, well below the page break. All of the other results are blogspam, SEO hacking, and mostly useless "featured snippets" and "people also ask".
- jpalomaki 5y agoIf everybody was using "ping" instead of their various other tracking solutions (Javascript, redirecting) then you could just disable it in browser settings.
- tshaddox 5y agoThat's the whole point: to give link tracking a simple consistent interface, which makes it much easier to implement (no JavaScript libraries or proxy URLs) and to disable (a user agent can very easily choose whether to respect the ping).
- deleted 5y ago[deleted]
- tailspin2019 5y agoWow, I had no idea about this. At least with the mangled link approach it’s easier to tell that tracking is going on, but that ping attribute seems extraordinarily sneaky to me. I get that it enables “clean” links but the opaque tracking is way worse in my eyes. Sigh. Edit: when I think about it, I guess it’s not that dissimilar to what you can do with JS based tracking anyway, so perhaps it’s not really any worse than what already exists. But it still feels wrong for some reason.
- 1vuio0pswjnm7 5y agoThis can be blocked easily in a variety of ways with forward proxy as well. Google generally does not allow POST method for user-iniatiated queries, e.g., from HTML forms. However POST method is commonly used for tracking. Using the web today with a "modern" browser and trying to exercise the slightest amount of control is like being in a Spy-vs-Spy MAD magazine comic strip.
- thomasahle 5y agoWhy can't they just add a click-listener to the links?
- soheil 5y agoEven without ping still doesn’t make sense why they can’t just use a JS event hook on click to fire a track/log request in the background instead of having to do a redirect. They already do this on link copy.