5 ms·

Unverified vanity URLs and interest tracking catalyze fraud online

36 points by Sephr 3y ago

lcnPylGDnU4H9OF 3y ago
I used to get emails from a particular recruiter which would include a link to a job listing on their employer's website. I'd always remove some extraneous tracking information from it, landing on a single identifier which I believe was unique to me but still showed the job listing. I believe the job-listing identifier was always unique because I eventually got an email from this recruiter which instead contained a bit.ly link, presumably because it rendered me unable to remove the tracking information. I did not click on that link. That was also the last email I received from that person, cementing the idea in my mind that he was "on to me" affecting their recruitment analytics. Sometimes I think back on that time and smile, knowing that I caused some difficulty -- however small -- for someone working in business intelligence with my dumb anti-tracking antics. Admittedly, they did successfully track some of my behavior but they had to do it manually with a human thinking critically so I'll call it a win. Anyway, the point of the story is that I didn't click the URL-shortened link because they're shady AF and often used for the specific purpose of hiding details about the URL. Tracking is a rather benign "abuse" of this but there are other practical concerns with malicious domains.
- dylan604 3y ago
  It's funny to me that a 140 char limit to a post drove the wide use of URL shortening services to the point people just accept them as normal.
  - nocoiner 3y ago
    I think this was mostly just my personal slightly-paranoid aversion to political risk, but it always astounded me that someone was willing to use the Libyan TLD during the days of Gaddafi to build a link-shortening business.
    - seszett 3y ago
      > during the days of Gaddafi Well, although a rather harsh dictatorship, Libya was at the time one (bit.ly was registered in 2008) of the more stable and prosperous countries of the region, and had been normalizing its international relations for some time. That was just after he had been received in France, erecting his tent on the lawn of the state guesthouse next to the French presidential palace. I don't think many people expected the dramatical events that occurred soon after. But it's true, I personally think one should never use the TLD of a dictatorship or unstable country for obvious ethical reasons and for future-proofing a business.
      - nocoiner 3y ago
        Yes, this is an excellent point. I guess I’m old enough where I primarily associate Gaddafi with “mercurial dictator” than the chaos after he was toppled. And 100% agree with your last paragraph. Cool visualizations on your site, by the way.
- ehPReth 3y ago
  fun trick with bit.ly (and bit.ly-hosted shorteners): add a + to the end of the URL to see where it leads. in past times you could also see stats, but they killed that :/
  - guessmyname 3y ago
    > bit.ly/FOOBAR+ That, or add “.info” at the end, e.g. goo.gl/FOOBAR.info Many other URL shorteners copied Google and Bitly’s approach so adding “+” or “.info” at the end of short URLs usually reveals the hidden redirection without hitting the final website.
- DeathArrow 3y ago
  Even a simple link like site.com/jobs/id can be used for tracking as id can contain both the job ID and a person's ID.
  - lcnPylGDnU4H9OF 3y ago
    Yeah, I’m pretty sure that was the case. There was always a redirect to the job posting which had a different identifier in the end URL. I didn’t expect to have an effect on their analytics; it was just gravy that I seemed to.
- japanman185 3y ago
  [dead]
- nyanpasu64 3y ago
  On Firefox you could set network.http.redirection-limit to 0, and check the response headers in F12 for the redirect target (which the browser doesn't load for you).
  - caseyh 3y ago
    Or use curl.
Sephr 3y ago
Hi, I'm the author of this post. I'm curious to hear about your experiences with link fraud and interest tracking, and opinions on how the issues surrounding these techniques should be addressed by the adtech industry.
- turnsout 3y ago
  Just a note—I had to turn my ad blocker (1Blocker) off to get your site to load. May want to look into it.
  - Sephr 3y ago
    Was this on iOS or Mac OS? I was unable to reproduce on Mac OS Safari with 1Blocker installed and don't have any iOS devices on hand.
    - turnsout 3y ago
      It was indeed on iOS
amadeuspagel 3y ago
> Being able to differentiate on interests such as ‘holidays’ and ‘cars’ as compared to ‘fast food’ enables advertisers to weaponize link fraud and provide a similar product or service at different prices to different socioeconomic groups. Meaning, at cheaper prices to poorer people? Seems good.
- Sephr 3y ago
  It can also mean more-expensive prices to wealthier people, or lower-quality scam products for people too poor to complain (poverty can significantly decrease one's energy and available free time) once they get them. The discrimination cuts both ways.
  - amadeuspagel 3y ago
    > lower-quality scam products for people too poor to complain This seems like a contrived example. Wikipedia has a long list of examples of price discrimination, which mostly benefit poor people: https://en.wikipedia.org/wiki/Price_discrimination#Examples https://en.wikipedia.org/wiki/Price_discrimination#Examples
- the_gipsy 3y ago
  Yes! We have solved world hunger since the invention of advertisements.
- Jiro 3y ago
  "Cheaper prices to poorer people" is the exact same thing as "more expensive prices to richer people". Even if the item is "kept at the same price" and poor people get a "discount", the market will still determine which price produces maximum profit. In the long run, it will be more profitable to raise the rich man's price than it would have been if they had to raise a price that was paid by everyone. So in the long run they'll converge on a value which means that the rich pay more, not just that the poor pay less. (And yes, this applies to coupons, sales, and other forms of price discrimination as well. If coupons were made illegal, and having the coupon actually helped the retailer in the first place, the non-coupon price would be too high for maximum profit and retailers would be forced by the market to lower prices.)
8bitsrule 3y ago
>Interest-targeted advertising is another area where adtech is negatively affecting society. => advertising is negatively affecting society.

36 points by Sephr 3y ago

I used to get emails from a particular recruiter which would include a link to a job listing on their employer's website. I'd always remove some extraneous tracking information from it, landing on a single identifier which I believe was unique to me but still showed the job listing. I believe the job-listing identifier was always unique because I eventually got an email from this recruiter which instead contained a bit.ly link, presumably because it rendered me unable to remove the tracking information. I did not click on that link. That was also the last email I received from that person, cementing the idea in my mind that he was "on to me" affecting their recruitment analytics. Sometimes I think back on that time and smile, knowing that I caused some difficulty -- however small -- for someone working in business intelligence with my dumb anti-tracking antics. Admittedly, they did successfully track some of my behavior but they had to do it manually with a human thinking critically so I'll call it a win. Anyway, the point of the story is that I didn't click the URL-shortened link because they're shady AF and often used for the specific purpose of hiding details about the URL. Tracking is a rather benign "abuse" of this but there are other practical concerns with malicious domains.

dylan604 3y ago
It's funny to me that a 140 char limit to a post drove the wide use of URL shortening services to the point people just accept them as normal.
- nocoiner 3y ago
  I think this was mostly just my personal slightly-paranoid aversion to political risk, but it always astounded me that someone was willing to use the Libyan TLD during the days of Gaddafi to build a link-shortening business.
  - seszett 3y ago
    > during the days of Gaddafi Well, although a rather harsh dictatorship, Libya was at the time one (bit.ly was registered in 2008) of the more stable and prosperous countries of the region, and had been normalizing its international relations for some time. That was just after he had been received in France, erecting his tent on the lawn of the state guesthouse next to the French presidential palace. I don't think many people expected the dramatical events that occurred soon after. But it's true, I personally think one should never use the TLD of a dictatorship or unstable country for obvious ethical reasons and for future-proofing a business.
    - nocoiner 3y ago
      Yes, this is an excellent point. I guess I’m old enough where I primarily associate Gaddafi with “mercurial dictator” than the chaos after he was toppled. And 100% agree with your last paragraph. Cool visualizations on your site, by the way.
ehPReth 3y ago
fun trick with bit.ly (and bit.ly-hosted shorteners): add a + to the end of the URL to see where it leads. in past times you could also see stats, but they killed that :/
- guessmyname 3y ago
  > bit.ly/FOOBAR+ That, or add “.info” at the end, e.g. goo.gl/FOOBAR.info Many other URL shorteners copied Google and Bitly’s approach so adding “+” or “.info” at the end of short URLs usually reveals the hidden redirection without hitting the final website.
DeathArrow 3y ago
Even a simple link like site.com/jobs/id can be used for tracking as id can contain both the job ID and a person's ID.
- lcnPylGDnU4H9OF 3y ago
  Yeah, I’m pretty sure that was the case. There was always a redirect to the job posting which had a different identifier in the end URL. I didn’t expect to have an effect on their analytics; it was just gravy that I seemed to.
japanman185 3y ago
[dead]
nyanpasu64 3y ago
On Firefox you could set network.http.redirection-limit to 0, and check the response headers in F12 for the redirect target (which the browser doesn't load for you).
- caseyh 3y ago
  Or use curl.

Sephr 3y ago

Hi, I'm the author of this post. I'm curious to hear about your experiences with link fraud and interest tracking, and opinions on how the issues surrounding these techniques should be addressed by the adtech industry.

turnsout 3y ago
Just a note—I had to turn my ad blocker (1Blocker) off to get your site to load. May want to look into it.
- Sephr 3y ago
  Was this on iOS or Mac OS? I was unable to reproduce on Mac OS Safari with 1Blocker installed and don't have any iOS devices on hand.
  - turnsout 3y ago
    It was indeed on iOS

amadeuspagel 3y ago

> Being able to differentiate on interests such as ‘holidays’ and ‘cars’ as compared to ‘fast food’ enables advertisers to weaponize link fraud and provide a similar product or service at different prices to different socioeconomic groups. Meaning, at cheaper prices to poorer people? Seems good.

Sephr 3y ago
It can also mean more-expensive prices to wealthier people, or lower-quality scam products for people too poor to complain (poverty can significantly decrease one's energy and available free time) once they get them. The discrimination cuts both ways.
- amadeuspagel 3y ago
  > lower-quality scam products for people too poor to complain This seems like a contrived example. Wikipedia has a long list of examples of price discrimination, which mostly benefit poor people: https://en.wikipedia.org/wiki/Price_discrimination#Examples https://en.wikipedia.org/wiki/Price_discrimination#Examples
the_gipsy 3y ago
Yes! We have solved world hunger since the invention of advertisements.
Jiro 3y ago
"Cheaper prices to poorer people" is the exact same thing as "more expensive prices to richer people". Even if the item is "kept at the same price" and poor people get a "discount", the market will still determine which price produces maximum profit. In the long run, it will be more profitable to raise the rich man's price than it would have been if they had to raise a price that was paid by everyone. So in the long run they'll converge on a value which means that the rich pay more, not just that the poor pay less. (And yes, this applies to coupons, sales, and other forms of price discrimination as well. If coupons were made illegal, and having the coupon actually helped the retailer in the first place, the non-coupon price would be too high for maximum profit and retailers would be forced by the market to lower prices.)

8bitsrule 3y ago

>Interest-targeted advertising is another area where adtech is negatively affecting society. => advertising is negatively affecting society.