Hacker News Reader

Comment by SimeVidas | Hacker News Reader

Those tracking links are so annoying. They make it hard to see where the link is actually going. A newsletter could be linking to Wikipedia, but if you open the message in Gmail, there could be two or more layers of trackers in that URL.

Example: The Frontend Focus newsletter in Gmail

The link of the first news headline is something like

     https://www.google.com/url?q=https%3A%2F%2Ffrontendfoc.us%2Flink%2F109272%2Fc0daad1d97&sa=D&sntz=1&usg=AFQgCNFEh5TaNZpHqsqyBGWEaq2iL9MwCg

The actual URL is

     https://www.slashgear.com/safari-overhaul-includes-tab-groups-and-web-extensions-on-mobile-07676634/

View on HN

There is a Firefox extension that clears URL named, appropriately, ClearURLs :)

https://addons.mozilla.org/en-GB/firefox/addon/clearurls/

So this is nice but doesn't do what I'm looking for, which is: given an email with links like OP's (https://www.google.com/...), go over it, follow each link to its final redirect and then replace the href with that (in this case, https://www.slashgear.com/...), letting me (for example) preview the links on mouse-over before clicking.

I thought it might be possible to build something like this with curl -Ls -w %{url_effective}, but seems like it only handles HTTP 302 redirects, whereas this site seems to be using Javascript, so you probably need a real crawler.

But do note that if such a thing existed, the actual resolution leaks information about your actions (the fact you are reading it / hovering, etc)

Not if it's done by the mail server in receipt of any email, even spam.

In my experience, it breaks any links with url encoded data in it (like links that redirect you to a login page, or contain an encoded hash)

Of course, this does nothing to subvert the tracking services like mailchimp that bury the final destination behind their own link, but...

Ctrl+Alt+T

  $ python3
  >>> from urllib import parse
  >>> parse.unquote('https%3A//www.google.com/url%3Fq%3Dhttps%3A//www.example.com/foo.php%3Fp0%3Darg0%26p1%3Darg1%26p2%3Darg2%26yoursoul%3DaXNtaW5l')
  'https://www.google.com/url?q=https://www.example.com/foo.php?p0=arg0&p1=arg1&p2=arg2&yoursoul=aXNtaW5l'
  >>> from base64 import b64decode as bd
  >>> bd(b'aXNtaW5l')
  b'ismine'
  >>>

Copy into clipboard: https://www.example.com/foo.php

Ctrl+D

Why I even bother in 2021?

I don't know.

URL expanders may also be useful here, where expanding encoded URLs isn't sufficient.

I've found https://urlex.org/ useful (top DDG search result). You end up with the disambiguated link in most cases (Twitter, Bitly, and similar shorteners).

I've not looked to see how many levels of redirection/misdirection it will resolve.

What does thay actually achieve though? You've still given an 'opened' hit, even if urlex expands it on the server instead of client-side (which would be truly useless).

You're disguising location and device information, but that's about it?

Fair point, though there are some benefits:

- The "hit" comes from the resolver rather than your own IP. So long as there's no referrer pass-through of personal information, your location is minimised.

- Such links often come through other social media, in my case, rather than email. In the specific case of email this practice is of little use in protecting privacy. However if you're sanitising links pulled off social media shares or the like, you're at least preventing downstream contamination.

- Another practice is to randomly scramble any visible identifiers. This presumes longer URLs, rather than shortened ones.

- In practice, I scrub any "utm-medium" or similar URI attributes as a matter of course. URLEX is helpful for expanding shortened links ... which I've not encountered so much in email, though truth be told, I've largely abandoned email for numerous reasons, the present topic included.

At the least, a log hit from a different IP, I suppose. They're right, I totally forgot to mention the unshortener services, which are what I actually mostly use my Python routine (shared upthread) on. It's largely for self-amusement, admittedly.

For the Google links, I actually use an extension to automatically restore the original URL links.

I just had to deal with an annoying tracking link to unsubscribe from an unsolicited mailing list. uBlock even blocked the link click, I had to temporarily allow the tracker to unsubscribe.

Unsubscribe links have to have your identifier in them so you know who to unsubscribe when you click the link.

We used to ask people for their email address to unsubscribe them, but then they accused us of using a dark pattern to keep them subscribed. So letting people unsubscribe easier with fewer hoops to jump through seems like the lesser of two evils.

Yes and then if you use a content blocker the link will inevitably end up blocked.

It used to be always check the link before clicking to know it isn't a phishing email, now everyone is hiding the actual link

And that is in the emails. Now every social network / search engine modify the link on click so that you have the right link on hover but a tracking link once you click. Browsers should disallow this.

Reply on news.ycombinator.com