Hacker News Reader

Comment by ape4 | Hacker News Reader

I suppose Firefox could remove this new encoding too

Not that easy, unless the URL pbfid thingy can be easily parsed into separate "post id" and "tracking id" parts — which I bet it cannot.

One alternative, which would require significant effort and investment but would be a brilliant way to outsmart Facebook's crap, would be to accumulate pbfids in a common pool such that, if a given pbfid points to post X, fetch a different random pbfid that points to post X. If the initial pbfid is not recognised, add it to the pool once the post is determined, either as a new alternative for a known post, or as a novel entry.

Of course, FB would hate it and would either try to expire old pbfids (and risk breaking "legitimate" links) or use legal threats, which would require them to openly admit that they don't give a shit about people's privacy preferences.

Smart but now there’s another third entity you have to trust to aggregate all this personal information from a slew of users just to… avoid the same situation initially? Sort of seems like only a marginal improvement.

The third party can’t really do much with this data.

The third party can still see which users decode the exact same string, thus derive relationship networks. (If i regularily share links to my friends they all resolve it at the third party to te "canonical" form, that third party then knows that all those are my friends)

Assuming you can even decode it. Could just be an encrypted string.

It doesn't even need to be that. If I were facebook, that string would just be an index in some internal Facebook key-value store.

Problem, I think, is that only Facebook can know the X such a url points to without accessing it.

So, upon seeing a new one, you’ll have to resolve it. Only then would you be able to tell what other URLs it’s equivalent to.

One way to gain anonymity there is to do that from a proxy, but such proxies would be detectable from the amount of pages they request from Facebook.

It also looks like they already thought about replays of URLs. For me, https://www.facebook.com/VICE/posts/pfbid02XdVziPTwhmPU9XzBq... currently says:

“It looks like you were misusing this feature by going too fast. You’ve been temporarily blocked from using it.

If you think that this doesn't go against our Community Standards, let us know.”

So, chances are they also thought about users exchanging URLs (e.g. by having each running instance of Firefox read Facebook URLs for other instances). It is possible that (a part of) your Facebook user ID also is encoded in each URL.

So create an extention which feeds the URL to FB when it is first requested, find the canonical URL, and return that to the clipboard / share dialogue.

> try to expire old pbfids (and risk breaking "legitimate" links)

Or encode some versioning scheme, and keep trying various versions until one comes up with a valid link. If we can think of these things in seconds, so can the engineers at FB.

Not really. pbfid needn't be a hash. You can take the plain text url, which can be ".../random.user/post/post_number", happened a random salt, and encrypt it using a key which is a function of "f(random.user)". That way you get unique encodings for each shared URL and every time you decrypt just discard the random bit. Defeats all pooling/reverse engineering efforts and offers perfect user isolation (each user has their own key).

presumably they've encrypted/MAC'ed it, so you can't without breaking the link

Sounds like this calls for some browser extensions

Beyond privacy I'm interested in generally a browser extension that disables things that provide free labor to for-profit enterprises, such as hiding the moderation queue (which even has an annoying persistent badge) on StackExchange sites, the one that asks me to provide unpaid labor to private equity and has various rules that sound nice if it were a public utility but primarily work to improve their SEO.

Most likely can’t be fixed by an extension and also to the parent poster, Firefox can’t strip this info out because the encoded string (how I read the original question) includes the actual metadata about what’s to be displayed. Looks like fb won this round.

I was actually wondering why the big trackers haven't implemented this yet and how much time it will take them to switch. I mean, the tracking part of the URL is so obvious it's just sitting there and asking to be removed. Most tech people do that, also some extensions, and now Firefox. So it was just a question of time.

At least for now, facebook has an endpoint that converts from new to old.

https://www.facebook.com/plugins/post.php?href=URL_ENCODED_N...

Returns references to the older style url in the returned html.

I also noticed it's calling that new style base64 string a "story_token" in places, and uses it in conjunction with "page_token" set to "VICE" in this case.

Thanks for digging this up! Looks like a path forward

Nit picky but isn't this action actually illegal in some jurisdictions ?

For example in France: « Obstructing or distorting the operation of an automated data processing system is punishable by five years' imprisonment and a fine of €150,000. »

maybe! lots of reasonable anti-capitalist action is illegal. it's good to be aware but nothing to be respectful of

But fetching data from an http server by giving it a URL is what it's for; how can that be "Obstructing or distorting" it?

Not true if people just choose to stop or slow their use of Facebook. Most of my friends there are barely active. I never use the app, only desktop with ad blocking, but still, nothing there is really interesting to me, so I'm rarely on FB at all. Across the web I never use it to authenticate, and if a private company asks me for any personal info, it's usually inaccurate info that I enter.

I have remembered a fake birth date, fake home address, and other details that I use for all these sites, unless they're related to commerce or legally justified purposes. We do not need to provide accurate info to private companies that mis-use our data (provided it is not required for our own reputational purposes).

the point isn't the one individual service or actor, these behaviors are incentivized and enabled systematically and will repeat

Golly is Facebook extremely boring, dull, and utterly a user experience nightmare... I miss all my friend's birthdays frequently because the experience is so undesirable and unenjoyable on it.

Twitter is also fast becoming my least favorite thing to use as well because of a habitually botched user experience.

By your same logic, participating on HN is free labor to a VC firm. I don't see how you can draw the line with a general-purpose extension other than simply actively avoiding things you don't want to do through your own volition.

I agree with the logic, and am free to criticize even if I engage as an individual without power

I think a good place to start would be with user awareness

That's called hypocrisy :)

I'm well aware and don't give a shit, I'm not the one as an individual causing the problems in the first place and have no individual power to correct it. But you're free to go spend your time and energy attacking victims of these behaviors as complicit, like a "gotcha" for why these powers deserve to go unchecked

"And yet, I see you participate in society."

Sorry about the quote marks; from memory, so probably not an exact quote.

https://news.ycombinator.com/item?id=32118404

Isn't answering on questions providing free labor to StackOverflow too? Providing way more value to their company? Do you draw a line between answering and reviewing?

yeah I would like to have a public space to help my peers and am trying to build that in adjacent spaces

free labor lol, they're providing a service. For free where free = no money, They give user a way to share with each other, ways to organize events, ways to sell things, ways to send messages with each other, ways to make calls to each other, ways to have video chat with each other, all for free (again free = no money). In return they put ads in your face and to make those ads more relevant they look at whatever data they can gather.

I don't like be spied on but gees, they aren't getting free labor. They're paying like crazy. As someone that once at a > $1000 phone bill it's amazing to me I can video chat with friends all over the world via FBs services and pay no direct money to do it and that to keep up with them I can now just post to fb instead of send out a newsletter or write each individual person

I don't care, there are ways to build public goods services

Many sites offer these things for free without the need to track you around the internet. Facebook's business model breaks social expectations of privacy. They make a lot of money because they sell other people your data through ad targeting.

Facebook controls the barely tech literate crowd by offering an aol type experience.

These services are popular with the masses. No one cares that they give data to facebook so they can be sold more things and leave them poorer.

You end up paying facebook no direct money but you have less money and spent when you didn't need to.

The only time I fill out pop-up surveys is when I want to enter wildly inaccurate data bout myself. That time back when Facebutt forced everyone to use their government names (as if it was an authentic requirement) I was shocked at how many people caved into entering their full name.

Companies are having a field day with all this data collection. I hope they get real karma for the deception.

there'll be no karmic payback or redemption story without organized action against the root of these behaviors. there's certainly no hope in a market solution

FB costs each family of four in the US, EU, Japan, and other wealthy nations roughly $468/year whether they use the survice or not.

https://news.ycombinator.com/item?id=32118404

The extension would likely need some sort of FB proxy in order to decode the provided URL to its canonical source.

That is, when copying a FB URL, you'd take the supplied value, feed that to the proxy, get the translated (and presumably canonical OR), and feed that to the clipboard buffer or share dialogue.

Needless to say, a fucking PITA.

Facebook could also just make it completely opaque, and just add random data to their urls(by which I mean a+b=c, not a+b=ab), and then subtract it on their end. Then you literally might not be able to see anything, not even the webpage directory.

So: pass the URL to FB to decode to canonical value, and return that for further operations (share, copy/paste, etc.).

This would have to be through an extension or an internal browser function.

The canonicalisation request would have to be w/o the initial person's FB identifiers as part of the request (e.g., cookies, etc.). FB might cotton on to immediate re-requests after URL provision, though that would be an interesting approach and yet further signs of expressly violating expressed intent.

Here is a good way to do it, block the entire domain :)

Piece of s**

They literally just announced they were doing it.

https://gizmodo.com/firefox-update-stop-url-tracking-chrome-...

That's the old encoding (fbclid), not the new one (pfbid).

Wouldn't be the first time they implemented direct anti Facebook features.

Even if it can, it won't the next one. Which fb simply encrypts to url (assuming it is not encrypted already)

Reply on news.ycombinator.com