9 ms·
Google Docs adds tracking to links in document exports
- wslh 3y agoI have not tried yet but, is this including documents exported from paid accounts in Google Workspace?
- aquir 3y agoAccording to the Mastodon thread, it's the same for paid accounts as well
- jokoon 3y agoFor years, copying a result link in Google was copying a redirect. When you hovered, it was the actual link. When you right clicked, it changed to a redirect.
- huhtenberg 3y agoThere are trivial browser add-ons that fix that, but, yeah, this behavior is annoying, distasteful and borderline deceitful. Not that it'd be shocking though given its origin.
- matkoniecz 3y ago> borderline deceitful why borderline? It is entirely deliberate deceit.
- tmpX7dMeXU 3y agoI don’t see it as deceitful and I’d eat my hat if most other users didn’t agree with me. I expect that when I click a search result link, that Google will be tracking that I’ve done this. I also appreciate being able to search for something, right-click-copy a link, and send it to someone, without it being covered in tracking cruft.
- lxgr 3y ago> right-click-copy a link, and send it to someone, without it being covered in tracking cruft. That’s exactly the use case Google breaks, though: The link gets covered in tracking cruft and it gets very hard to tell where it even leads from just looking at it.
- jasonlotito 3y agoJust tried it. It worked as expected: right-click, copy a link, and it's the link to the source, not Google or a redirect.
- jraph 3y agoThey must have fixed it, it wasn't like this in the past. I remember being annoyed by this when I was still using Google.
- huhtenberg 3y agoHere, in a fresh Firefox profile - https://i.imgur.com/RKvnJoq.gif https://i.imgur.com/RKvnJoq.gif
- tech234a 3y agoThis may be a Chrome vs Firefox issue, as Firefox doesn’t support the ping attribute for a (link) elements in HTML. The ping attribute allows sending a POST request in the background to arbitrary URLs when a link is clicked. [1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a
- vineyardmike 3y agoSlightly more benignly, the links seem to trigger a redirect notice and open in a new tab, which seems like good behavior for inside the Google docs editor. I can’t know for sure, but there is probably also tracking in there. What else would an opaque string of text in the query params be for? I assume the link rewrites come from this, and weren’t added just for the exported version. It is disappointing it isn’t stripped out, but I’m guessing it’s just such a corner case no one is paying attention on the team. Also, if it does contain tracking, we dont know how/when that gets updated - eg is it vestigial behavior or was it updated in export, do unique users get unique tracking numbers when exporting the same doc?
- londons_explore 3y agoThis is because google docs is now widely used as a malware vector. Send the user to a google docs page, and because it is on the google domain it is trusted by corporate firewalls and AV scanners. The 'tracking' is in fact this page: https://www.google.com/url?q=https://wikimediafoundation.org/ https://www.google.com/url?q=https://wikimediafoundation.org... And that alerts the user to the fact they are leaving google and ending up on another site - which hopefully reduces the effectiveness of using google docs to distribute malware.
- nemetroid 3y agoThe complaint is about documents exported from Google Docs.
- londons_explore 3y agoBut thats still a malware vector right?, especially if you can get the victim to export it themselves?
- deleted 3y ago[deleted]
- wslh 3y agoThe malware vector still exists because you can just edit the file exported and change the links... bad actors laugh out loud at these issues.
- srazzaque 3y agoI'm pretty sure the stated intent of the redirect is to prevent phishing (that is, provide an opportunity for Google to warn users about visiting a known dodgy site). The ability to track is just an added bonus! Microsoft does this too with Teams. Links that my colleagues and I share with one another to _internal company sites_ get link checked then redirected. Microsoft must have a treasure trove of data about external company employee browsing habits as a result. I would have infinitely more respect for companies that are upfront about their intentions, no matter how nefarious: "we're doing this to help protect you from phishing. But also, 99% of links are probably not phishing. So this feature really enables us to collect data to track what you do, and perform analytics to improve our bottom line". Why sugar-coat it?
- diogenes4 3y agoWhy is this added to exported documents tho? It should only add the redirect in the browser.
- hackideiomat 3y agoAnd there it is not needed. You could implement this in JS.
- tmpX7dMeXU 3y agoHow does the fact that most links aren’t phishing links play into anything? Maybe we don’t need AV because most files aren’t viruses? You had enough of a point without this.
- TeMPOraL 3y ago> Maybe we don’t need AV because most files aren’t viruses? Since you used that example... How would you feel if everyone in their neighborhood got assigned a private security officer that sits in their apartment doorway all day and notes who comes and goes? The company argues that it's to protect from the thieves and fraudsters, and indeed there are always some break-ins or grandparents scammed somewhere. Oh, and everyone gets an officer free of charge - it's paid for by the ads they wear on their vests and that play regularly on their walkie-talkies. Would you trust the security company that all the notes, taken by a person in the privileged position of observing everything in your home, will only be used to prevent crime and nothing else, ever? Back to your example - AV companies are quite shady these days, and their products not all that useful relative to costs/damage and snooping they do.
- sneak 3y agoGoogle also rewrites URLs in emails at Gmail accessed via IMAP to use the Google URL redirector service if you have Advanced Protection turned on. This means that the PGP signatures break, etc, because they are rewriting the message body. It's terrible. FAA702 was enough, but if for some reason warrantless surveillance of all data held at Google wasn't for you personally, the terrible behavior of Google since their government mandated backdoors were installed should be. It's time to de-google your life.
- hedora 3y agoI routinely receive email messages from gmail that do not render in standard html mail clients and with attachments that are hosted on google servers (where they presumably expire and are available for easier bulk-surveillance use cases). It also bears repeating that the big cloud vendors all supported mandating the government backdoors you mention. As far as I can tell, it was a regulatory capture move, where they wanted to have the power that comes from spying on + selectively informing on their customers, but they wanted to make sure that no companies that serve the US market could provide meaningfully better privacy or security: > The CLOUD Act received support from Department of Justice and of major technology companies like Microsoft, AWS, Apple, and Google.[12][13] The bill was criticized by several civil rights groups, including the Electronic Frontier Foundation, the American Civil Liberties Union, Amnesty International, and Human Rights Watch. These groups argued that the bill stripped away Fourth Amendment rights against unreasonable searches and seizures, since the government could enter into data rights sharing agreements with foreign countries and bypass U.S. courts, and affected users would not have to be notified when such warrants were issued.[13][14] Some of these groups feared the government would not fully review requests from foreign countries for their citizens' stored on servers in the U.S., potentially allowing such data to be used in bad faith in those countries.[15] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- jraph 3y agoShameless plug. The company I work for has a team developing CryptPad, which can be seen as an open source (AGPL) [a], E2EE alternative to Google Docs. You can edit documents with multiple people in realtime, and the server does not have access to your content. You can self-host of course, but the team also provide an instance [1], and several other people also provide theirs. It does not have such misfeatures. It has sheets, documents (using an ONLYOFFICE fork running in the browser), Diagrams (using Draw.io), forms, polls, a kanban module, pads, among other things. There's some storage too (a "drive"). It obviously does not provide all the features of Google Docs and its office suite is not as complete, but it can still be useful for a whole host of use cases. (edit: btw CryptPad has been mentioned in several replies in this thread, it's not us so far but I've sent the link to our chat, they might chime in as well) [1] https://cryptpad.fr/ https://cryptpad.fr/ [a] https://github.com/cryptpad/cryptpad https://github.com/cryptpad/cryptpad
- pratio 3y agoCame here to mention cryptpad. I selfhost it and it's quite good.
- hedora 3y agoWow! Thank you. I noticed a few annoyances in the demo flow: How do I make a new slide? I had to rtfm to find out about "---" What language does code want? I eventually correctly guessed "HTML". I want it to have a little dropdown menu in the style of godbolt.org for code snippets. That would be great for collaboration flows like: "This high-level code compiles to an integer increment, so don't worry about the lambdas". Godbolt also does a good job of populating pages with hello-world examples. It might make sense to do that, at least the first few times a document of a given type was created. For it to be my daily-driver backend dev environment, it would need git integration and the ability to ssh to a dev environment that I configured in the style of okteto. That feels like a different product. If I was going to use this on a day-to-day basis, I'd want to be able to back up the data (in case your E2EE blew up, or I lost my password). My next question would be how to use it while disconnected (For three reasons: (1) I want to host your backend server on a LAN that isn't exposed to the internet, and still use it for things like bank account info, and (2) I want to store travel itineraries in it, and be able to access them if my cell plan doesn't work overseas, (3) if the server dies, I have the data on my device, and would want to "copy" it all to a new server). Anyway, I've been looking for something like this for years, and it looks like you hit most of my requirements. How does conflict resolution work? CRDT's? Something else?
- dangoodmanUT 3y agoYeah wow just tested this with html export
- DeathArrow 3y agoI like that when I sit on toilet surfing the web, Google likes to oblige and shows me ads to all kinds of toilet paper. It's great to have a big brother, even if you were born without one.
- not_enoch_wise 3y agoI CANNOT believe google would do this to paying customers! Oh, right.
- makingstuffs 3y agoI’m surprised that anyone is shocked by the depths to which Google will sink in order to hoover up more of that delicious data.
- yafbum 3y agoI don't think this is for tracking. If this was just for tracking, there are much simpler and discreet ways to do it (just add a background ping). I think this is to allow intercepting the user if Google determines that the link destination is harmful (eg malware distribution).
- lern_too_spel 3y agoThis has been there from the start. It's to hide the referer from the page you land on. It used to be standard practice for anyone writing a web application to avoid inadvertently leaking user information in the referer header. There are better ways to do this if the user is on a modern browser. https://duckduckgo.com/duckduckgo-help-pages/results/rduckduckgocom/ https://duckduckgo.com/duckduckgo-help-pages/results/rduckdu...
- hackideiomat 3y agoReferrer-Policy is such a way https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
- WirelessGigabit 3y agoReddit does the same now when you share something.
- shortformblog 3y agoThis post really highlights what happens when a user with a set bias against a company notices a common feature and presumes the worst of that company by default.
- JAlexoid 3y agoCorrect. Adding a feature to scrub "You're leaving the enclosed ecosystem" to the export function is not free. Complaining about "Google is evil" is free, though. It's a typical case of "we'll equate laziness to malice"
- tiffanyh 3y agoHasn't this existed for quite some time? I can't find a reference to it, but I thought this has been around for a few years now.
- deleted 3y ago[deleted]
- tamimio 3y agoI don’t think anyone is using any google products should still be concerned about privacy or tracking their activities, it’s like using Facebook, these companies business is built around mining your/users data, stop using them.
- Serhyl01 3y agoSalak toto