4 ms·

I wonder what companies will do now, probably embed the tracking information within the URL without using parameters, like dynamic URLs that are unique to a par

I wonder what companies will do now, probably embed the tracking information within the URL without using parameters, like dynamic URLs that are unique to a particular user/cookie?

jalgos_eminator 3y ago
I could see the writing on the wall. Offerup I think does this. If you click through an item in a search the URL has a UID in it. Then if you click on the seller and find the item from there, its an integer (which is likely a database index).
williamcotton 3y ago
Catchall subdomains?
kitsunesoba 3y ago
There's not a whole lot that can be done to combat this, but I suppose Apple could do something like keep a database of known tracking URL patterns and when encountering such URLs, "unwrapping" them in an isolated background webview which is fully generic across machines and doesn't have the user's cookies or other data, which would limit the information gathered, and then finally passing the untracked URL back to the user's webview instance. EDIT: They could also do something similar to what they've done with Content Blocking Extensions, maybe call them "URL Cleaning Extensions", which allow third parties to maintain tracking URL pattern lists which Safari can then follow to do its unwrapping.
Avamander 3y ago
Already ahead of you. They're already generating custom links with all the tracking parameters embedded. Tumblr, TikTok and Facebook have done it for a while now.
ipsin 3y ago
Yeah, all you need is to encrypt the URL (which includes tracking query parameters), and then the URL you give out is the encrypted blob. When the web server gets a request, it can validate & decrypt, update any tracking values, and redirect to the real URL.
- altairprime 3y ago
  Historical patterns with Mail.app on iOS suggests that Apple will simply code something that fetches all such links in order to collect a preview, whether or not the preview is ever shown to the user, just as they do with Mail.app images today when iCloud Private Relay is enabled. At which point the tracking value becomes less than zero, because it pollutes the core dataset attribution “a human saw this”.
sergiotapia 3y ago
Tiktok does this. If you share anything on Tiktok, and someone clicks on the URL they get an alert "purpleblue shared this video with you!" and you can leak your private account to someone.
- graftak 3y ago
  There is a TikTok setting to disable this. It still tracks you as the origin of the share action (naturally), but it’s hidden from the receiver.
est31 3y ago
I often remove tracking parameters from URLs and I notice that some services/websites return an error if you visit it without a tracking parameter. If a service does this, apple can't remove the tracking parameter from the URL any more.
matheusmoreira 3y ago
They're already doing it. I stopped clicking on links the second I realized this.

I wonder what companies will do now, probably embed the tracking information within the URL without using parameters, like dynamic URLs that are unique to a particular user/cookie?

jalgos_eminator 3y ago

I could see the writing on the wall. Offerup I think does this. If you click through an item in a search the URL has a UID in it. Then if you click on the seller and find the item from there, its an integer (which is likely a database index).

williamcotton 3y ago

Catchall subdomains?

kitsunesoba 3y ago

There's not a whole lot that can be done to combat this, but I suppose Apple could do something like keep a database of known tracking URL patterns and when encountering such URLs, "unwrapping" them in an isolated background webview which is fully generic across machines and doesn't have the user's cookies or other data, which would limit the information gathered, and then finally passing the untracked URL back to the user's webview instance. EDIT: They could also do something similar to what they've done with Content Blocking Extensions, maybe call them "URL Cleaning Extensions", which allow third parties to maintain tracking URL pattern lists which Safari can then follow to do its unwrapping.

Avamander 3y ago

Already ahead of you. They're already generating custom links with all the tracking parameters embedded. Tumblr, TikTok and Facebook have done it for a while now.

ipsin 3y ago

Yeah, all you need is to encrypt the URL (which includes tracking query parameters), and then the URL you give out is the encrypted blob. When the web server gets a request, it can validate & decrypt, update any tracking values, and redirect to the real URL.

altairprime 3y ago
Historical patterns with Mail.app on iOS suggests that Apple will simply code something that fetches all such links in order to collect a preview, whether or not the preview is ever shown to the user, just as they do with Mail.app images today when iCloud Private Relay is enabled. At which point the tracking value becomes less than zero, because it pollutes the core dataset attribution “a human saw this”.

sergiotapia 3y ago

Tiktok does this. If you share anything on Tiktok, and someone clicks on the URL they get an alert "purpleblue shared this video with you!" and you can leak your private account to someone.

graftak 3y ago
There is a TikTok setting to disable this. It still tracks you as the origin of the share action (naturally), but it’s hidden from the receiver.

est31 3y ago

I often remove tracking parameters from URLs and I notice that some services/websites return an error if you visit it without a tracking parameter. If a service does this, apple can't remove the tracking parameter from the URL any more.

matheusmoreira 3y ago

They're already doing it. I stopped clicking on links the second I realized this.