8 ms·
Report: YouTube adding user-traceable ID tag to links shared off-platform
- pdimitar 3y agoEver since the first time I spotted this I've been removing it manually. Any browser addons to help with this, anyone? The fact that Google has to resort to this is amusing. To me it means they can't do it any other way and are now leaving themselves wide open for us the techies to strip that tracking ID; which we absolutely will do. Things must be getting desperate somewhere in HQ. Good.
- WendyTheWillow 3y agoThey can obviously generate indistinguishably unique urls for video sharing links if they wanted, this is just easier to implement (though not by much). Also there’s no treachery afoot here… go ahead and remove it, the stakes here are very low.
- pdimitar 3y agoWell exactly, they are outright adding an URL parameter and of course I'll remove it. Doesn't mean that they don't rely on less tech-inclined people to never even notice, and I am sure that's a core part of their strategy anyway. As for the indistinguishable URLs, you have a solid point there but I'd think there would be a lot of outrage because people want those URLs to generate previews when pasted in pages, social media comments etc. Not to mention all the false positives generated by people embedding such URLs. So I think for now we're safe on that front, they would poison their own well if they went ahead with encoded URL identifiers, happily. But again, I am very amused that they just outright added "?si=..." -- to me that reeks of desperation and I have to admit that I enjoy it when Google is struggling.
- WendyTheWillow 3y agoIf this "reeks to you of desperation", then you're putting a lot more emotional energy into the situation than is necessary. There is no world in which this is desperation on the part of YouTube, that's not a reasonable view.
- kevin_thibedeau 3y agoBetter to keep the ID and change it to 31337.
- NamTaf 3y agoClearURLs is the one I use: https://addons.mozilla.org/en-US/firefox/addon/clearurls/ https://addons.mozilla.org/en-US/firefox/addon/clearurls/
- woodruffw 3y ago> The fact that Google has to resort to this is amusing. To me it means they can't do it any other way and are now leaving themselves wide open for us the techies to strip that tracking ID; which we absolutely will do. I don't think it means that (although I wish it did): it's just another connecting datapoint, and more connecting datapoints are always good from their perspective. (I think it's helpful to think about these things from Google's perspective: they're running a service that ~billions of people access and share daily. 95% or more of those people won't know how to strip those identifiers; the 5% or so that do are put on the slightly-less-happy-path for social graph discovery.)
- pdimitar 3y agoOh I am sure it will have positive impact on their tracking; that much is guaranteed. What I am saying is that they chose a very lame way to do it and this robs them of very valuable data they could get from those 5% and I'd argue that they really would want to know how you and me are moving and discovering stuff when we're outside YouTube. Trying hard not to have the protagonist syndrome here but I'd think they are more interested in how the non-couch-surfers do stuff. Though a very good counter-argument would be that they can now target ads better and probably gain slightly higher conversation regardless of us the 5% stripping the tracking parameter, and that would still be a huge financial win for them. All in all, my stance is: let them have it, but I still find it reassuring that they are not even covert about it which gives us a lot of options on how to deny them. Finally, there's the possibility of various browsers and addons to start automatically removing the tracking parameter, though such movements usually take years.
- eichin 3y agoThe same group of people that are doing the best job of avoiding their advertising? I would expect them to prefer that we went away quietly :-)
- pdimitar 3y agoYeah but we will not go away. Let them keep trying, they will have to start banning IPs and they will be taken them to court because I pay for Premium and I can share links to their videos however I wish.
- schiffern 3y agoClearURLs is a great "set it and forget it" addon. Don't leave home without it. If you want power and customizability, check out Request Control. uBlock Origin can also block this by adding the following rules (Dashboard > My Filters tab): ! tracking param https://twitter.com/OldRowSwig/status/1732112446943269347 ||youtube.com^$removeparam=si ||youtu.be^$removeparam=si
- dhx 3y agoClearURLs implemented the rule to remove the si attribute on November 5th[1]. I think a better approach though is to whitelist allowed attributes rather than blacklist disallowed attributes. For example, if you get a URL starting "https://www.youtube.com/watch https://www.youtube.com/watch?" then the only allowed attributes are v, t, etc and everything else would be stripped. [1] https://github.com/ClearURLs/Rules/commit/f4d52da5902640d4d00613424b7428912e9eafff https://github.com/ClearURLs/Rules/commit/f4d52da5902640d4d0...
- schiffern 3y agoRequest Control[0] can do this. Create a rule with the following settings: Host: *.youtube.com Path: /watch* Types: Document Action: Filter Check "Filter URL Redirection" List of Trimmed Query Parameters: v t list index time_continue Check "Invert trimming" 'time_continue' is used when you navigate to Youtube from an embedded video. 'index' is used in playlists. [0] https://addons.mozilla.org/en-US/firefox/addon/requestcontrol/ https://addons.mozilla.org/en-US/firefox/addon/requestcontro...
- deleted 3y ago[deleted]
- MiguelX413 3y agolc should be allowed in addition to v and t, as link to specific comments under a video!
- judge2020 3y ago> they can't do it any other way This is purely an extra data point; without it, there is 0 attribution for which user is responsible for a link to a video causing that video to go viral, besides the referrer header. They have experimented with other ways to do this in the past. For example, they used to have a direct friends list on YouTube where you could share videos to specific friends or groups of friends at once.
- lathiat 3y agoThe theory has been at some point they'll remove the separate ID and have a single ID that encompasses both. Due to things such as Apple's automatic tracking link removal (but also many others): https://9to5mac.com/2023/06/08/ios-17-link-tracking-protection/ https://9to5mac.com/2023/06/08/ios-17-link-tracking-protecti...
- lazycouchpotato 3y agoFacebook started doing this a while ago https://www.schneier.com/blog/archives/2022/07/facebook-is-now-encrypting-links-to-prevent-url-stripping.html https://www.schneier.com/blog/archives/2022/07/facebook-is-n... Reddit too, but I don't have a news source for it. I can only share a link I came across: https://reddit.com/r/dataisbeautiful/s/LCv7yIwiVF https://reddit.com/r/dataisbeautiful/s/LCv7yIwiVF If you click on the link, you can see all the tracking parameters in the URL bar. Whosever link this is used the official Reddit iOS app to generate the unique URL.
- sphars 3y agoNot a browser extension, but an Android app. URLChecker[0]. You can "share" to this app, and can clean the URLs (uses ClearURLs database) and check for redirects. You can also do more advanced URL rewrites (such as Twitter -> Nitter) and open URLs in specific browsers [0]: https://github.com/TrianguloY/UrlChecker https://github.com/TrianguloY/UrlChecker
- fudged71 3y agoI just noticed today that Arc Browser cleans URLs for sharing
- user3939382 3y agoThey have a bazillion dollars and I’m sure complete control over Congress to the extent they need it. I doubt they’re desperate.
- aaron695 3y ago[dead]
- GauntletWizard 3y agoI have been fixing this manually since I noticed it a few weeks ago; I just option+del to remove the value, and it still works with an empty parameter. I've got so far as to look briefly into writing a clipboard-watcher application to strip it for me. It's obnoxious and obvious.
- jokoon 3y agoHum, other platforms have been doing this for ages Tracking copy pasted like is an old techniques that also allows them to build a unofficial friend graph between cookie profiles.
- dietr1ch 3y agoAnd it was very nice of YouTube to not follow this
- ilrwbwrkhv 3y agoIn Firefox you can right click and choose to copy links without tracking. Another reason why every hacker should switch to Firefox.
- dietr1ch 3y agoRight, but nothing prevents YouTube to get rid of public video IDs and simply share an opaque version of (user, video) whenever possible. It'd be awful, but Google nowadays is willing to do shitty stuff like this and atrocious stuff like engage with the military too (because obviously the only flaw of project maven was being discovered)
- chimeracoder 3y ago> Right, but nothing prevents YouTube to get rid of public video IDs and simply share an opaque version of (user, video) whenever possible. Instagram and TikTok have already been doing this for years.
- nothrowaways 3y agoTimtok does the same since long time ago.
- dukeofdoom 3y agoFBI making lists.
- judge2020 3y agoWhy is this coming up today? This behavior has been a thing when sharing videos from the Mobile app since at least early October. Edit: found a you.be link of mine with the `si` param from August 23rd.
- figmert 3y agoPretty sure it's way older than that. My YouTube ReVanced version is installed early March and it has this behaviour. I'm quite sure I've seen it also last year too.
- adamomada 3y agoIt’s only about three or four months old for the website at most; the app might have been doing it earlier (but I doubt it) When it became news https://old.reddit.com/r/webdev/comments/15ukrpi/what_is_the_si_parameter_in_a_youtube_share_link/ https://old.reddit.com/r/webdev/comments/15ukrpi/what_is_the...
- zlg_codes 3y agoWe need anti-surveillance and data subject laws.
- mgarciaisaia 3y agoI'm as surprised with how long it took Youtube and Twitter to add tracking IDs to their links, as with the fact that Instagram and TikTok still have proper URLs at all instead of generating a new unique URL each time you load some content.
- fragmede 3y agoThose TikTok urls aren't proper. They weren't before. They might be better now but don't think TikTok is new to the idea of tracking you to that level.
- mahdi7d1 3y agoDamn. I noticed this happening a while back and I didn't think much of it. I just deleted the si= part because I knew it's not necessary for a Youtube link to work! I was curious about why this has been added and figures there's been something nefarious going down.
- deleted 3y ago[deleted]
- slashtab 3y agoSame thing I've noticed for Instagram links and many other different apps. Most of them have started tagging the link, to track the user, or check who interacts who, I think. Those who don't want clean link manually, can use link cleaner apps or uBlock origin in browser.
- iforgotpassword 3y agoI kept using the app (with ads) because despite my hate for Google I still thought it was the right thing to do. And using YouTube in a browser on mobile felt clunky. But I noticed that identifier in the shared url too and that, plus the increase in ads, finally pushed me to ditch the official app and go with NewPipe. No more ads, no tracking in the URL, sharing the URL can be done with timestamp, when tapping a yt Link in another app, I get asked if I want to play it right away, enqueue it, play it in the background or play it in a little floating window.
- jackjeff 3y agoNewpipe and Yattee are awesome. I don’t regret the couples of evening I spent setting up a local sever. I used to see ads occasionally on YouTube before they tried to crack down. The irony lol.
- nntwozz 3y agoAnother vote for Yattee (works wirh tvOS too), I use it with Invidious as the backend. Pure bliss.
- Lio 3y agoThis kind of behaviour is why I would never pay for YouTube premium. Google are relentless with their surveillance and are always looking for sneaky new ways to track people.
- est 3y agoWhen Unique Resource Locator becomes Unique User Tracker. I believe Douyin is the most notorious of them all. Each video doesn't expose unique ID at all. Every link is a short link uniquely bond to your device/app/browser.
- popcalc 3y agoDoes anyone know of a generic reverse proxy solution that does this? Say an nginx module?
- porridgeraisin 3y agoYeah YouTube music specifically has been doing this for many many months, I'm fairly certain. I always removed it before sending songs to friends. Until then it was just &feature=share but now its a full ID. Yikes.
- meta_goblin 3y agoThe comments section mentioned TikTok, of course, because it's a Chinese company! Chinese tech giants have long been ahead of the curve in terms of privacy infringement compared to various Western countries. The practices of YouTube are already outdated in China. For instance, China's largest video platform, Bilibili, prefers to compress video links containing a large number of tracking parameters into short links, making it impossible for you to use something plugins to remove tracking parameters.
- rldjbpin 3y agothis has been the case for all fb-owned social media and spotify for better part of the year. i am yet to come across it for youtube, but unsurprised. i wonder why there was no reporting on the other cases.
- WirelessGigabit 3y agoWhile I'm not sure if it's user tracable, Reddit also started changing the link that is produced when you share a link to a post. It is a /s/<id>, which I absolutely despise. I share links to things when I'm logged in, but I want to ensure that the receiver has no way of tracing back the sent link to my Reddit identity.
- moose44 3y agoI believe TikTok does this as well?
- teraflop 3y agoSo does Stack Overflow, although they tell you very clearly that your user ID is embedded in the link, right in the "share" box (and it's not obfuscated in any way). SO goes so far as to give you little notifications and achievements whenever a certain number of unique visitors follow one of your shared links.
- brobinson 3y agoAnd Spotify.
- theshrike79 3y agoTikTok generates a fully unique share URL for every person. If you click that link and it opens in the TikTok app, it'll tell you exactly who shared it and asks you to follow them...
- collegeburner 3y agoyeah also means you can't just delete a utm parameter to avoid being tracked. devilishly clever
- simonw 3y agoThankfully you can fix that by following the share link yourself, which will redirect to a full URL to that video, which you can then strip the tracking parameter from. Very annoying to have to remember to do that though.
- Hbruz0 3y agoThat's so clever and a data analyst's dream
- xnx 3y agoCame here precisely to comment this. YouTube is hustling to catch-up to TikTok features is ways large ("Shorts") and small (unique share links).
- behnamoh 3y agoThis is why I like Brave's "Clean Copy" feature.
- woudsma 3y ago'Copy clean link' in Brave doesn't (yet) seem to remove the `?si=` URL parameter though.
- weikju 3y agoFirefox has it too these days (or at least in the Developer edition, not sure about the "stable")
- greenyoda 3y agoI have the latest Firefox (non-developer), and it has the "Copy Without Site Tracking" option in the right-click menu on the URL bar. Is that what you mean?
- TRiG_Ireland 3y agoUnfortunately, it's always there, whether or not the URL includes site tracking.
- weikju 3y agoSoo this seems to be when you use the "share" button on Youtube rather than doing the simple universal old-as-www thing of.. copying the URL from the URL bar. Of course, people these days have no idea what a URL or URL bar is, as it's often hidden anyway... :( https://nitter.net/OldRowSwig/status/1732112446943269347 https://nitter.net/OldRowSwig/status/1732112446943269347
- tech234a 3y agoIf you use the mobile app, the Share button is the only way to get the video ID.
- iseanstevens 3y agoThis pattern has led me to avoid apps and use the websites on mobile.
- satvikpendem 3y agoYouTube Revanced is awesome though, even if parts can be replicated via mobile web with extensions.
- Fatnino 3y agoRevanced still has ?feature=shared tacked on to the end of links created with the share button. But no user identifying ID.
- WD40forRust42 3y ago[dead]
- userbinator 3y agoOf course, people these days have no idea what a URL or URL bar is, as it's often hidden anyway ...and if you didn't think this wasn't one of the goals of that trend, now you do. Those in power hate it when people can consume information from and communicate outside of their sanctioned methods. We saw it coming when they started dumbing down browsers and hiding things from users --- not because the majority wouldn't use them, but to deliberately make users less inclined to learn. Nearly 10 years ago(!) when that started happening, I made a comment here about how many YouTube users at the time realised what was the important part of the URL (the video ID) and began to use that in comments: https://news.ycombinator.com/item?id=7678729 https://news.ycombinator.com/item?id=7678729
- xnx 3y agoI'm kind of surprised that YouTube does this in a way that is visible and removable instead of using fully unique ids through a redirect service.
- SllX 3y agoURL obscuring gives a URL a shelf life that URL parameters don’t. The URL only ends up functioning as long as the redirect service is functional whereas a URL will work no matter what garbage parameters you throw in after the ? in a URL. If the page can do something with the parameters it will, but if it can’t, it just gets ignored.
- runlevel1 3y agoTrue, but that redirect service can be stupid simple if the URL has all the information it needs to do the redirect encrypted in the URL. So no new DBs. The URL gets a little longer, but a format-preserving encryption scheme might be able to help a bit. Not that I want to give them any ideas.
- jameshart 3y agoCan't keep encryption keys around forever, and that means encrypted URLs have a time limit on them.
- runlevel1 3y agoSure you can. Even if the key is rotated monthly for 20 years, we're talking ~4 KB of memory for all the keys. But remember that this isn't being done for security; it's just adding a minor barrier to casual removal of the tracking information. And if users really want to circumvent it on the links they generate all they'd need to do is copy the regular URL instead of using the Share button. (Again, not that I want to see them do any of this.)
- SllX 3y ago
- TRiG_Ireland 3y agoI've been changing it to `&si=no+tracking` since first I saw it.
- MitPitt 3y agoSo you changed nothing because it still builds a friend graph
- deleted 3y ago[deleted]
- physicles 3y agoI wonder if that shows up in some error log of failed &si= lookups in their tracking database. Maybe some random engineer at Google will see it and be amused for about 10 seconds.
- montag 3y agoCopy that. It was about 3 seconds though