11 ms·
Facebook has started to encrypt links to counter privacy-improving URL Stripping
- dimitrios1 4y agoEasily defeated by having a secondary server access the url, strip any remaining parameters, then returning the URL to the user. You will have to really trust your browser, however. A gambit I am willing to take. It is Facebook we are talking about, after all. The game of cat and mouse continues.
- Spivak 4y agoNobody is gonna go through that effort though, and it’s not possible to translate the params back because only the server decrypts them. This seems like the tipping point where cat wins for all but like 5 people. I’m actually kinda surprised this hasn’t happened earlier.
- dimitrios1 4y agoI used to go through the effort of manually stripping tracking params out of my URLs until the browsers integrated it. I will go through this effort until browsers integrate it, or until there is a secondary service that's easily runnable. This would just be pi-hole but for the internet instead of your local network.
- stargrazer 4y agoWouldn't it just be easier to 'not use facebook'?
- Bud 4y agoNo. I imagine you already know why.
- camkego 4y agoThis brings up an interesting point. If you have a secondary server do this operation as opposed to the browser, the only thing that has changed from the receiver's point of view is the source IP. So maybe privacy protecting browsers will start to do double loads: 1. First to get the real URL 2. Next to do the browsing with the association information stripped from the URL/cookies/etc
- dimitrios1 4y agoYep.
- anonymoushn 4y agoFB still gets to know whose shared URL is being accessed how much and when.
- dimitrios1 4y agoThey will not be able to reliably tell their users if the end user landed on the page, and most importantly, specific users. They will only be able to guess. Today, the tracking mechanism works in tandem with the facebook pixels or tracking scripts on the receiving end to give full E2E campaign clarity. This will break that, or at least introduce heavy uncertainty that will definitely impact their revenue model.
- j0057 4y agoThe secondary server can cache the result, so that only the first time there's a signal to FB.
- dimitrios1 4y agoThen the game of cat and mouse will continue in this fashion: facebook will generate unique URLs for each user (if they aren't planning to do so already)
- deleted 4y ago[deleted]
- rolph 4y agoso instead of being able to opt out, by editing extraneous commands, face book is locking you into accepting commands with the link. stretch that out a bit and it will fit - facebook controls your browser by infiltrating commands packed into an encrypted string. that looks alot like what C&C servers do, the next step would be dropping a bot into users systems
- kareemsabri 4y agoThe ideal solution here is to stop using Facebook.
- ColinWright 4y agoRegrettably, I have family members with whom I really must stay in touch, but who think that FB is the internet. No matter what I've said, what I've shown them, and what I've encouraged them to do, there is nothing to replace it. They can post photos, statuses, chat with friends, reply to other friends' posts ... what can replace FB for them? Nothing. So I'm forced to stay on FB. Vile platform, no alternative.
- kareemsabri 4y agoYeah, that's fair. There's a cost. I've deleted it a couple years ago. I miss out on some stuff for sure. I have an iMessage group chat with my family as a replacement, but of course not the extended family and certainly not the more distant friends.
- FrenchDevRemote 4y agoWhat about SMS and phone calls? It's like saying I need alcohol to stay in touch with my alcoholic friend. No you don't.
- ColinWright 4y agoSee my reply here: https://news.ycombinator.com/item?id=32131180 https://news.ycombinator.com/item?id=32131180
- robolange 4y ago
- LightG 4y ago
- 4y ago
- googlryas 4y agoHas anyone checked if it is just a serialized+base64 encoded swift proto with the original URL? There could be other reasons for this, but evading firefox rewriting links seems most likely - some gateways strip too-long query strings for example, but will leave the rest of the URL alone.
- Volker_W 4y ago> some gateways strip too-long query strings for example Uhm. What?
- grishka 4y ago$ echo "0RjTS7KpBAGt9FHp5vCNmRJsnmBudyqRsPC7ovp8sh2EWFxve1Mk2HaGTKoRSuVKpl" | base64 -D | xxd 00000000: d118 d34b b2a9 0401 adf4 51e9 e6f0 8d99 ...K......Q..... 00000010: 126c 9e60 6e77 2a91 b0f0 bba2 fa7c b21d .l.`nw*......|.. 00000020: 8458 5c6f 7b53 24d8 7686 4caa 114a e54a .X\o{S$.v.L..J.J $ echo "AZXT7WeYMEs7icO80N5ynjE2WpFuQK61pIv4kMN-dnAz27-UrYqrkv52_hQlS_TuPd8dGUNLawATILFs55sMUJvH7SFRqb_WcD6CCOX_zYdsebOW0TWyJ9gT2vxBJPZiAaEaac_zQBShE-UEJfatT-JMQT5-bvmrLz7NlgwSeL6fGKH9oY9uepTio0BHyCmoY1A" | base64 -D | xxd 00000000: 0195 d3ed 6798 304b 3b89 c3bc d0de 729e ....g.0K;.....r. 00000010: 3136 5a91 6e40 aeb5 a48b f890 c37e 7670 16Z.n@.......~vp 00000020: 33db bf94 ad8a ab92 fe76 fe14 254b f4ee 3........v..%K.. 00000030: 3ddf 1d19 434b 6b00 1320 b16c e79b 0c50 =...CKk.. .l...P 00000040: 9bc7 ed21 51a9 bfd6 703e 8208 e5ff cd87 ...!Q...p>...... 00000050: 6c79 b396 d135 b227 d813 dafc 4124 f662 ly...5.'....A$.b 00000060: 01a1 1a69 cff3 4014 a113 e504 25f6 ad4f ...i..@.....%..O 00000070: e24c 413e 7e6e f9ab 2f3e cd96 0c12 78be .LA>~n../>....x. 00000080: 9f18 a1fd a18f 6e7a 94e2 a340 47c8 29a8 ......nz...@G.). This doesn't look to me like unencrypted serialized data. Serialization would usually have some visible structure to it and possibly visible ASCII strings. Also notice that the lengths of both strings are aligned to 16 bytes — this might mean AES block encryption.
- RKearney 4y agoPrevious Discussion: https://news.ycombinator.com/item?id=32117489 https://news.ycombinator.com/item?id=32117489
- cuteboy19 4y agoAmazing that they noticed it this quickly. Most people are used to see all those URLs with encoded garbage to notice this change
- niutech 4y agoThere is a solution how to get the old Facebook post URL posted in this thread: https://news.ycombinator.com/item?id=32118095 https://news.ycombinator.com/item?id=32118095
- neilv 4y agoI've had background projects working on Web privacy measures since the Junkbuster days in the 1990s. Pretty much any practical measures I've thought of, I think of (usually obvious) ways they can be countered, and assume it's only a matter of when that measure is on the adversary's radar and worth their time.
- userbinator 4y agoJunkbuster --- now that's a name that takes me back! MITM proxies for filtering were far more common back then, but the "security" industry managed to scare most people out of using one, ironically causing them to only remain on corporate networks. I still use Proxomitron for this purpose.
- LightG 4y ago“A strange game. The only winning move is not to play.”
- deleted 4y ago[deleted]
- 1vuio0pswjnm7 4y agoIf the author edits their post and the reader then follows the "View Edit History" URL, then the reader can see in the address bar the story_fbid= and the (author) id= URL parameters without the obfuscation. If the reader follows the "People who reacted" URL, then the reader can see the story_fbid= and (author) id= paramaters, without obfuscation. If the reader follows the "Comment" URL, then the reader can see the story_fbid= and (author) id= paramaters, without obfuscation. If the reader follows the "React" URL, then the reader can see the story_fbid= and (author) id= paramters, without obfuscation. Those are just four ways to discover the unobfuscated story_fbid number. There are probably others. Tested with mbasic.facebook.com. I have always stripped everything but the story_fbid and (author) id parameters when sharing URLs pointing to posts on Facebook. Anything else in the URL is unnecessary. On the desktop/laptop/RPi, this stripping can be automated using a localhost forward proxy. Another issue that seems to fly under the radar with Facebook users is the prefixing and proxying of external URLs with https://lm.facebook.com/l.php?u= https://lm.facebook.com/l.php?u=.
- darkstar999 4y agoWhat about it? They end up at the same url.
- plorg 4y agoI haven't used Facebook in quite a while, but when I did I had a set of userscripts to defuse this tracking. It worked similarly to Google link stripping, by defusing the JavaScript that rewrote the link between the time you clicked it and when your browser opened it. Initially I built it because the free wireless internet in my apartment was unreliable and the redirects could be enough to prevent a page from opening. My method was pretty blunt - I removed element entities that held the target URL, and that broke the listener function. A later iteration would actually unset the listener event. This all worked because it seemed important to FB that you be able to see where the link would take you (e.g. by hovering). I wouldn't be surprised if Facebook's paternalism (and Google's for that matter, but I haven't seen it from them, though I mainly use DDG now) now led them to add this "protection" directly to links as they're served up. I can't tell from the article whether that's the case, and at this point I'm not going to log in to FB to figure it out.
- userbinator 4y agoIMHO this was totally expected and is an argument for "browser neutrality" --- I believe a browser shouldn't be doing this or many other things by default. Modifying URLs and filtering page content should be the responsibility of extensions and the like. I personally use a filtering proxy.
- cypress66 4y agoFirefox is not doing this by default I'm pretty sure
- WorldMaker 4y agoThough "Enhanced Tracking Protection" is easy to opt-in.
- jefftk 4y agoMy understanding is that Firefox, and eventually all the other browsers, intend to do something like this by default. They are all working to prevent cross site tracking, linking your activity on one site to your activity on another. For example, Chrome has: "In parallel to that we will aggressively combat the current techniques for non-cookie based cross-site tracking, such as fingerprinting, cache inspection, link decoration, network tracking and Personally Identifying Information (PII) joins." -- https://www.chromium.org/Home/chromium-privacy/privacy-sandbox/ https://www.chromium.org/Home/chromium-privacy/privacy-sandb...
- AinderS 4y agoSince there's zero chance that websites and ad companies will stop their spying and manipulation (let's call it "webpage neutrality"), what you're proposing is unilateral disarmament. To require a lot of know-how and tech savvy to get privacy, while leaving the common user to the mercy of a hostile web. This is like the argument that the Do Not Track flag was illegitimate if the browser defaulted it to 'on'. An argument that is never applied to tracking or the countless "by visiting this webpage you consent to.."
- ev1 4y agoThis is opt in, not enabled by default, and requires you to intentionally pick 'Strict' which has a warning as its first line of text that says some sites may break.
- agluszak 4y agoThat should be illegal.
- doodlesdev 4y agoNo it shouldn't. It's unethical, sure, but the correct way to fight this is to not give money (or your time) to companies that engage in these behaviors.
- Dylan16807 4y agoA test: if it was illegal by default, would there be a reason to make it legal?
- FateOfNations 4y ago"illegal by default" is fairly at incompatible with the concept of an open, liberal society.
- Dylan16807 4y agoThanks, I wasn't suggesting that! It's a thought experiment to look at specific categories. Maybe it's not worth making something illegal, but it's useful to answer the question to get a good perspective. In this case I would say it's definitely not something I specifically want to be legal.
- agluszak 4y agoAt this point it is barely possible to ignore Facebook (Twitter, Instagram etc. also). I'm a great proponent of the fediverse, but FB without regulation will simply eat all the ethical alternatives.
- int_19h 4y agoThe company we're talking about here is, if not an outright monopoly, a dominant market player that actively abuses their dominance to the detriment of both competitors and customers. The correct way to fight that is to make such a thing not exist anymore.
- squarefoot 4y agoAside stopping the use of Facebook, which of course is the best solution but not doable for many, the AdNauseam (.io, browser extension) approach to pollute their tracking data might be inspirational. The gist is: can't eliminate ad links? Then have an app "click" all of them randomly so that counters become irrelevant. So there is this link that identifies user X?, well then write an extension that distributes and "clicks" it around on say 1000 other machines in a p2p way so that it becomes meaningless. I have no idea if it's doable in this FB context, but usually when links can't be anonymized, the next move is to make them produce irrelevant data by adding noise.
- asdfologist 4y ago
- Nextgrid 4y agoJust as unethical as creating spyware that spies on users who haven’t given informed consent or sometimes even non-users.
- arthurcolle 4y agoEverything is fair game in asymmetric guerilla warfare against well-capitalized antagonists
- Calavar 4y agoFacebook also tracks the activity of people who have never registered an account while they browse on third party websites.
- kareemsabri 4y agoYou can't just say something is unethical, you need to provide a rationale for why people are ethically obligated to preserve a company's revenue stream in their usage of its product. I don't think a consumer owes Facebook any responsibility in terms of protecting its revenue.
- 4y ago
- dang 4y agoRecent and related: Ask HN: What is with the new URLs on facebook.com? - https://news.ycombinator.com/item?id=32117489 https://news.ycombinator.com/item?id=32117489 - July 2022 (249 comments)
- 2-718-281-828 4y agoconsidering that FB did and does serve a purpose beyond meaninglessly scrolling through your timeline and liking pictures - f.x. organising and advertising events or managing group interactions. is there a new FB - something that could replace it or maybe even did? I'm off FB now for about six years but sometimes I wonder if I'm missing out sometimes. I really don't want to move back in.
- knife1nhead 4y agoSame sentiments here. I have heard that the marketplace is great for selling second hand goods locally. But I still think the benefits of not being on facebook outweigh what I'm missing out but curious on reevaluating my stance.
- deleted 4y ago[deleted]
- nonrandomstring 4y agoReplace the word "facebook" with "alcohol" or "heroin" and re-read every comment in this thread. We have a real problem, don't we?
- deleted 4y ago[deleted]
- salawat 4y agoNo stuff. I'm beginning to wonder whether I want to even work in the tech sector anymore. Nothing but exploitation.
- Kaze404 4y agoIt’s interesting because the (in my opinion valid) comments of “but I have friends and family that I can only contact through Facebook” also somewhat translate to that analogy. It’s not uncommon to hear stories of people who quit drinking for example and soon after lose all their friends because their friendship really only existed in contexts where alcohol is present (maybe even mandatory to some extent).
- nonrandomstring 4y ago> It’s not uncommon to hear stories of people who quit drinking for example and soon after lose all their friends And (crucially) then go back to drinking. Human attachment patterns are a primary factor in dependency problems. Addicts get into groups who mutually support each other's habit. Leaving the drug means leaving the only group who "understand" you. It's the same for cults. There's a chapter on this in Digital Vegan. Social media companies shamelessly and aggressively leverage that psychology.
- SnowHill9902 4y agoIt can be subverted: make Firefox touch the “encrypted” URL to see what it links to, then serve the cleartext URL.
- jefftk 4y agoThat still gets them their cross-site analytics, since the encrypted URL is only accessed when you're visiting the page.
- askvictor 4y agoDepends on how many URLs on are on the page; if there are 20 (encrypted) urls, and the browser touches each of them, but the user only follows one of them, the data FB gets is much less useful.
- mihaic 4y agoI would love to stop using Facebook, Instagram or Whatsapp, but I would really need to criple my social life if I'd give up on any of these. And I'm not even a very active person, it's just that so many people I want to engage with have a huge chunk of their lives tied to one of these. I can't understand the people saying there is a free market choice here, this can only be solved with simple regulation that targest large platforms. If the SEC can use its judgement on what constitutes a security, than we can have a social media comission to oversee Facebook.
- ansh_nanda 4y agoI had this same problem so I made an app that allows me to use Instagram without using the Instagram app. It also blocks ads + suggest posts, removes all tracking, removes read receipts in DMs and when viewing stories, and also allows me to create custom feeds like Twitter lists. Turns out a lot of people had this problem, so I made it into a company. I don't want to blatantly advertise but let me know if you'd like me to link the website.
- peterkelly 4y agoIf someone is important enough in your life, you'll both find ways to make it work. The mental health benefits of leaving Facebook are worth it.
- ptudan 4y agoI think one thing this discounts is that you form loose connections and sometimes those loose connections become stronger later. If you have a friend of a friend who you add on socials, and then you see their updates, and then you see them at a mutual party, despite not being well acquainted you are reasonably up to date with their lives. This can make the conversation flow better and you may form a meaningful connection.
- aembleton 4y agoWhat about a local running group that organises everything through Facebook?
- deleted 4y ago
- Cameri 4y agoFirefox and Brave should warn the user that they are going to be tracked by accessing URLs like these if tracking protection is enabled.
- klabb3 4y agoAt this point a full-screen spyware warning with the only option to continue being a tiny "allow once/i know what I'm doing" would be appropriate. The lengths these companies go to to map your every move is beyond comprehension. And sure, there are bad actors and there always will be, but that they're the biggest companies in the world with a top notch reputation, in most circles, is absolutely insane.
- Ansil849 4y ago
- pvg 4y agohttps://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=author%3Adang%20callout%2Fshaming&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- znyboy 4y agoFor what it's worth, the work of an few engineers implementing the business decisions of their employer does not make those people inherently evil. It is their job, and they need to pay the bills somehow. This change is highly anti-consumer and potentially unethical, yes, but it makes perfect sense towards the group's own business interests.
- Ansil849 4y ago> For what it's worth, the work of an few engineers implementing the business decisions of their employer does not make those people inherently evil I think when people do unethical actions, it makes the person doing the unethical action unethical. People are defined by their actions. I'm also tired of this 'need to pay the bills somehow' excuse. Someone who has an engineering job at Facebook has vast career options.
- int_19h 4y agoThey are not forced to do that work at a gunpoint, and as software engineers who managed to land jobs at FB, they most certainly have plenty of other options - even within FB.
- deleted 4y ago[deleted]
- jefftk 4y agoI don't think this is unethical, and while it isn't work that I've done I wouldn't have an objection to doing it. Facebook is able to provide their service free to users because we "pay with our data", and stripping the tracking parameters was one method people used to get the service without "paying". Facebook would prefer to offer this is a package deal, where you can only have the service if you accept the tracking. I don't think it is unethical to strip the parameters, but I also don't think Facebook has any obligation to make that easy. As an analogy, I think it's fine for users to run ad blocking software, but I also think it's fine for sites to attempt to only show content to users who view the ads.
- theden 4y agoThe irony of now fb having more encryption in their URLs than a standard .onion URL...
- _nhynes 4y agoYou will please forgive me for being pedantic, but an onion URL contains no encryption. Per the spec [0]: onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion" CHECKSUM = H(".onion checksum" | PUBKEY | VERSION)[:2] [0]: https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.... (section 6)
- Dylan16807 4y agoPublic keys count as encryption to me.
- deleted 4y ago[deleted]
- _nhynes 4y agoAnd you, too, will please forgive me for being pedantic. Check out line 540 of the link above (section 1.7): Master (hidden service) identity key -- A master signing keypair used as the identity for a hidden service. This key is long term and not used on its own to sign anything; it is only used to generate blinded signing keys as described in [KEYBLIND] and [SUBCRED]. The public key is encoded in the ".onion" address according to [NAMING]. You can then follow that to line 2292 (Appendix 2) which describes the aforementioned generation process. It's a bit too long to be pasted here, but it turns out to be elliptic curve multiplication and hashing. This is not encryption for any common definition thereof. In fact, you generally do not use public keys to do encryption at all. What often happens is that you use a key exchange algorithm like Diffie-Hellman to derive a shared secret, which you then use to do bulk encryption using your favorite cipher (some asymmetric cryptosystems permit encryption, but they're much slower than symmetric ciphers, which also benefit from strong hardware acceleration). You can also use keypairs for signing, key exchange (e.g., DH), key derivation (as used by Tor hidden services), and creating verifiable random functions. They definitely do not imply encryption.
- prezjordan 4y agoWeird to think someone (or a team, really) built this. Why?
- FateOfNations 4y agoBecause the cross site referral data is valuable to the company.
- shmerl 4y agoThis should be illegal.
- aqfamnzc 4y agoI've always assumed that "shortened" shared links that things like the youtube app provides do something similar - no way to remove a tracking param when you have something like `https://youtu.be/KLEH8RJsYg https://youtu.be/KLEH8RJsYg`.
- DoctorOW 4y agoExcept the only tracking info the YouTube shortener adds is the referrer. https://youtu.be/KLEH8RJsYg https://youtu.be/KLEH8RJsYg => https://www.youtube.com/watch?v=KLEH8RJsYg&feature=youtu.be https://www.youtube.com/watch?v=KLEH8RJsYg&feature=youtu.be The only data in that short url is the unencrypted YouTube video ID
- aqfamnzc 4y agoCould you explain how one would go about determining what you explained here? Is the "KLE..." part of the shortened URL just compressed somehow and you can decompress it? I guess I always assumed the browser just requested the shortened url and the black-box google server opaquely serves up the destination page, allowing it to do whatever with the (I assumed, incorrectly it would seem) unique string in the URL. Unique to the user sharing and video being shared, I mean.
- treesknees 4y agoThe KLE portion you're referring to is the video ID. It's how the video is uniquely identified. It's not compressed or storing any tracking information about anyone when it's shared. You can see that in both URLs it's the exact same value.
- deleted 4y ago[deleted]
- 5350-uiop-1130 4y agosimple solution would be to stop using FB. i feel the majority of fb audience probably don't care about this enough to change their habits.