31 ms·
Firefox recently started stripping out tracking URLs [0] and the most prevalent one is Facebook with it's ?fbclid= so it looks like they're encoding it straight
by groffee 4y ago
Firefox recently started stripping out tracking URLs [0] and the most prevalent one is Facebook with it's ?fbclid= so it looks like they're encoding it straight into the URL now to bypass that, Medium does similar also.
[0] https://www.engadget.com/firefox-can-now-automatically-remove-tracking-from-ur-ls-115228742.html https://www.engadget.com/firefox-can-now-automatically-remov...
- nchudleigh 4y ago+1 this is likely the situation. I would bet that the rest of the url resolves to the old format with the search param after some decoding.
- ape4 4y agoI suppose Firefox could remove this new encoding too
- nchudleigh 4y agoWouldn't be the first time they implemented direct anti Facebook features.
- wahnfrieden 4y agoSounds like this calls for some browser extensions Beyond privacy I'm interested in generally a browser extension that disables things that provide free labor to for-profit enterprises, such as hiding the moderation queue (which even has an annoying persistent badge) on StackExchange sites, the one that asks me to provide unpaid labor to private equity and has various rules that sound nice if it were a public utility but primarily work to improve their SEO.
- daniel_iversen 4y agoMost likely can’t be fixed by an extension and also to the parent poster, Firefox can’t strip this info out because the encoded string (how I read the original question) includes the actual metadata about what’s to be displayed. Looks like fb won this round.
- hdjjhhvvhga 4y agoI was actually wondering why the big trackers haven't implemented this yet and how much time it will take them to switch. I mean, the tracking part of the URL is so obvious it's just sitting there and asking to be removed. Most tech people do that, also some extensions, and now Firefox. So it was just a question of time.
- tyingq 4y agoAt least for now, facebook has an endpoint that converts from new to old. https://www.facebook.com/plugins/post.php?href=URL_ENCODED_NEW_URL_HERE https://www.facebook.com/plugins/post.php?href=URL_ENCODED_N... Returns references to the older style url in the returned html. I also noticed it's calling that new style base64 string a "story_token" in places, and uses it in conjunction with "page_token" set to "VICE" in this case.
- wahnfrieden 4y agoThanks for digging this up! Looks like a path forward
- rvnx 4y agoNit picky but isn't this action actually illegal in some jurisdictions ? For example in France: « Obstructing or distorting the operation of an automated data processing system is punishable by five years' imprisonment and a fine of €150,000. »
- CRConrad 4y agoBut fetching data from an http server by giving it a URL is what it's for; how can that be "Obstructing or distorting" it?
- wahnfrieden 4y agomaybe! lots of reasonable anti-capitalist action is illegal. it's good to be aware but nothing to be respectful of
- Hydraulix989 4y agoBy your same logic, participating on HN is free labor to a VC firm. I don't see how you can draw the line with a general-purpose extension other than simply actively avoiding things you don't want to do through your own volition.
- wahnfrieden 4y agoI agree with the logic, and am free to criticize even if I engage as an individual without power I think a good place to start would be with user awareness
- Hydraulix989 4y agoThat's called hypocrisy :)
- wahnfrieden 4y agoI'm well aware and don't give a shit, I'm not the one as an individual causing the problems in the first place and have no individual power to correct it. But you're free to go spend your time and energy attacking victims of these behaviors as complicit, like a "gotcha" for why these powers deserve to go unchecked
- nonsensikal 4y ago
- CRConrad 4y ago"And yet, I see you participate in society." Sorry about the quote marks; from memory, so probably not an exact quote.
- dredmorbius 4y agohttps://news.ycombinator.com/item?id=32118404 https://news.ycombinator.com/item?id=32118404
- remram 4y agoIsn't answering on questions providing free labor to StackOverflow too? Providing way more value to their company? Do you draw a line between answering and reviewing?
- wahnfrieden 4y agoyeah I would like to have a public space to help my peers and am trying to build that in adjacent spaces
- pronlover723 4y agofree labor lol, they're providing a service. For free where free = no money, They give user a way to share with each other, ways to organize events, ways to sell things, ways to send messages with each other, ways to make calls to each other, ways to have video chat with each other, all for free (again free = no money). In return they put ads in your face and to make those ads more relevant they look at whatever data they can gather. I don't like be spied on but gees, they aren't getting free labor. They're paying like crazy. As someone that once at a > $1000 phone bill it's amazing to me I can video chat with friends all over the world via FBs services and pay no direct money to do it and that to keep up with them I can now just post to fb instead of send out a newsletter or write each individual person
- wahnfrieden 4y agoI don't care, there are ways to build public goods services
- ipaddr 4y agoMany sites offer these things for free without the need to track you around the internet. Facebook's business model breaks social expectations of privacy. They make a lot of money because they sell other people your data through ad targeting. Facebook controls the barely tech literate crowd by offering an aol type experience. These services are popular with the masses. No one cares that they give data to facebook so they can be sold more things and leave them poorer. You end up paying facebook no direct money but you have less money and spent when you didn't need to.
- winternett 4y agoThe only time I fill out pop-up surveys is when I want to enter wildly inaccurate data bout myself. That time back when Facebutt forced everyone to use their government names (as if it was an authentic requirement) I was shocked at how many people caved into entering their full name. Companies are having a field day with all this data collection. I hope they get real karma for the deception.
- dredmorbius 4y agoThe extension would likely need some sort of FB proxy in order to decode the provided URL to its canonical source. That is, when copying a FB URL, you'd take the supplied value, feed that to the proxy, get the translated (and presumably canonical OR), and feed that to the clipboard buffer or share dialogue. Needless to say, a fucking PITA.
- blibble 4y agopresumably they've encrypted/MAC'ed it, so you can't without breaking the link
- Mordisquitos 4y agoNot that easy, unless the URL pbfid thingy can be easily parsed into separate "post id" and "tracking id" parts — which I bet it cannot. One alternative, which would require significant effort and investment but would be a brilliant way to outsmart Facebook's crap, would be to accumulate pbfids in a common pool such that, if a given pbfid points to post X, fetch a different random pbfid that points to post X. If the initial pbfid is not recognised, add it to the pool once the post is determined, either as a new alternative for a known post, or as a novel entry. Of course, FB would hate it and would either try to expire old pbfids (and risk breaking "legitimate" links) or use legal threats, which would require them to openly admit that they don't give a shit about people's privacy preferences.
- texasbigdata 4y agoSmart but now there’s another third entity you have to trust to aggregate all this personal information from a slew of users just to… avoid the same situation initially? Sort of seems like only a marginal improvement.
- aaomidi 4y agoThe third party can’t really do much with this data.
- johannes1234321 4y agoThe third party can still see which users decode the exact same string, thus derive relationship networks. (If i regularily share links to my friends they all resolve it at the third party to te "canonical" form, that third party then knows that all those are my friends)
- aaomidi 4y agoAssuming you can even decode it. Could just be an encrypted string.
- shultays 4y agoEven if it can, it won't the next one. Which fb simply encrypts to url (assuming it is not encrypted already)
- bamboozled 4y agoHere is a good way to do it, block the entire domain :) Piece of s**
- lwswl 4y agoFacebook could also just make it completely opaque, and just add random data to their urls(by which I mean a+b=c, not a+b=ab), and then subtract it on their end. Then you literally might not be able to see anything, not even the webpage directory.
- dredmorbius 4y agoSo: pass the URL to FB to decode to canonical value, and return that for further operations (share, copy/paste, etc.). This would have to be through an extension or an internal browser function. The canonicalisation request would have to be w/o the initial person's FB identifiers as part of the request (e.g., cookies, etc.). FB might cotton on to immediate re-requests after URL provision, though that would be an interesting approach and yet further signs of expressly violating expressed intent.
- bencollier49 4y agoThey literally just announced they were doing it. https://gizmodo.com/firefox-update-stop-url-tracking-chrome-safari-brave-1849124540 https://gizmodo.com/firefox-update-stop-url-tracking-chrome-...
- tedmiston 4y agoThat's the old encoding (fbclid), not the new one (pfbid).
- thrusong 4y agoMakes a lot of sense— thanks!
- wahnfrieden 4y agoIt's opt-in behavior. So Facebook is explicitly countering opt-in requests for privacy (without informing you)
- ehnto 4y agoSee also: all the companies scrambling to circumvent App Tracking Transparency, in which they are not only being duplicitous, they're also breaking the new agreements formed with the app store and the customer. Tracking has been a grey area in technology. Now that regulations and users are trying to scrape back some control over their privacy, it's going to be a lot clearer to see the line between moral and amoral behavior in companies.
- Nextgrid 4y agoApp Tracking Transparency only forces you to do what you must have already been doing to comply with the GDPR (and potentially even the earlier ePrivacy Directive). Any complaints about ATT should've been considered admissions of guilt by the EU regulators and promoted investigations.
- akagusu 4y agoThis is the kind of thing that should be illegal.
- Beldin 4y agoThere are laws against it (in certain parts of the world at least). Of course, those laws do allow tracking in certain situations. Of course that makes enforcement harder - enforcers need to figure out if this is not an allowed case. Moreover, enforcement agencies vary in execution, with the Irish DPA so bad, their actions are indistinguishable from actively undermining GDPR.
- Jasper_ 4y agoHow many "this should be illegal"s are we going to see on this website before people realize that powerful platforms have the money, power, and politics to lobby their way out of everything? A huge chunk of this was made illegal through the GDPR, and for years on this website everyone said it was a massive overreach. Or maybe we make this spend 5 years making this specific thing illegal and they circumvent it all in two weeks. Or they just ignore it and pay the paltry fines as a cost of doing business. Not to mention the giant groups of people working at FAANG here, directly complicit with this behavior, afraid their salary and stock options will tank if anything changes. Companies have the willpower and money to fight any sort of check on their power, well after the rest of us are all beyond exhausted.
- dom96 4y agoDo you have any evidence to say that this is the case other than speculation? It's also possible that they just changed the URL format. FWIW `pfbid` seems to be a shortened version of "post fb id" so why would it include the "cl id"?
- drexlspivey 4y agowhat's the reason to change from the old format if that's all it does?
- aaomidi 4y agoMultiple other companies doing the same thing would point to a trend.
- isametry 4y agoRule #n of the internet: If Meta does anything which doesn't explicitly protect the privacy of users, you can safely assume that it harms the privacy of users.
- danijelb 4y agoI went to Vice's fb page, found the same post that OP linked to and checked the URL. The pfbid part is exactly the same to me. The URL by default has some additional params attached like __cft__ and __tn__, which can be stripped, and those are probably tracking-related. Based on this, I don't think that pfbid is connected to tracking
- tyingq 4y agoIf I were Meta, this is how I would implement this. First, get everyone used to the new opaque base64 encoded blob, by using it just like the previous numeric post id. Then, after all the initial speculation dies down, encode other stuff in it.
- tedmiston 4y agoAre you sure about that? It's not the same for me. OP: https://www.facebook.com/VICE/posts/pfbid02XdVziPTwhmPU9XzBqkRvU5o7NPXUicAJgVy8kf1a1W51hU7EmgMmCigo9rZWxCjDl https://www.facebook.com/VICE/posts/pfbid02XdVziPTwhmPU9XzBq... Me: https://www.facebook.com/VICE/posts/pfbid0TbuHEaGP2fLTRDFRTuv4Q1GtJGVfHX7Wx1gNtLoH1Bfbp9cFh6VUK4ACWjBBWsBql https://www.facebook.com/VICE/posts/pfbid0TbuHEaGP2fLTRDFRTu... There were also a bunch of other query params junk after that I omitted here for brevity.
- madeofpalk 4y agoTiktok does the same thing when you get a URL to share a video
- dawnerd 4y agoIt’s really creepy too if you don’t know the share url can leak your account name (if you were trying to keep that private)
- type0 4y agoIt is but try to explain this to a regular user and they will call you a tinfoil hat nerd
- thih9 4y agoI don’t think this is that big of a problem today, after so many privacy leaks people are a bit more aware, at least in my experience. Also tiktok actually shows a popup that the link contains information about your account.
- jjeaff 4y agoYa, most people get that there is no privacy. Where I think you get more of the "tinfoil hat" accusations is that a lot of people don't care or don't recognize the far reaching implications of lack of privacy.
- grishka 4y agoIn my experience most people do understand the basic structure of a URL even if they don't know the proper names for the parts. It doesn't take being a software developer to empirically figure out which parameters are responsible for tracking and delete them before sharing — especially if you see your own username in one of them.
- saaaaaam 4y agoDo “regular folk” really do this though? It is a serious, non provocative question. I strip all cruft off URLs but consider myself privacy aware and technically adept. I don’t think my non-technical friends have any idea about this.
- shultays 4y agoThat was such a naive move by firefox tbh
- shultays 4y agoPerhaps a bit more explanation is needed considering the downvotes: https://news.ycombinator.com/reply?id=32118663&goto=item%3Fid%3D32117489%2332118663 https://news.ycombinator.com/reply?id=32118663&goto=item%3Fi... This is an arms race firefox would lose. I think if anything, firefox trying to race it is now negatively affecting anyone that were able to manually remove tracking id themselves (or use a browser extension)
- jherazob 4y agoDon't blame the victim, blame the abuser
- sangnoir 4y agoAd-blocking, like content piracy, are activities that are ignored and can flourish in the fringes. Once they go mainstream and become threats to profit margins, considerable resources will be brought to bear to fight them.
- eurasiantiger 4y agoSo the ultimate question is: how do we make sales executives look like a threat to profit margins?
- sangnoir 4y agoThe only way I can think of is to make profits above a certain level unprofitable by taxing them at a high rate with ratcheting without bracketing (i.e. any amount up to $X billion taxed at 10%, but anything greater than $X + $0.01 will be taxed at 60% for the entire amount, resulting in a tax graph that is discontinuous for profit vs. tax). Profits can be tinkered with, so perhaps do that with revenue instead. Then, for companies of a certain size will have no need for sales executives, and will be punished by Wall Street for exceeding optimal sales targets.
- gnu8 4y agoWhy on earth would Facebook think it is ok to bypass that? This should be considered a violation of the CFAA. Start putting Facebook execs in federal prison.
- autoexec 4y agoI'm all for throwing facebook execs behind bars, but what part of the CFAA would cover encoding tracking data in a URL?