Hacker News Reader

Comment by dimitrios1 | Hacker News Reader

Easily defeated by having a secondary server access the url, strip any remaining parameters, then returning the URL to the user. You will have to really trust your browser, however. A gambit I am willing to take. It is Facebook we are talking about, after all.

The game of cat and mouse continues.

View on HN

This brings up an interesting point. If you have a secondary server do this operation as opposed to the browser, the only thing that has changed from the receiver's point of view is the source IP.

So maybe privacy protecting browsers will start to do double loads: 1. First to get the real URL 2. Next to do the browsing with the association information stripped from the URL/cookies/etc

Yep.

Nobody is gonna go through that effort though, and it’s not possible to translate the params back because only the server decrypts them. This seems like the tipping point where cat wins for all but like 5 people.

I’m actually kinda surprised this hasn’t happened earlier.

I used to go through the effort of manually stripping tracking params out of my URLs until the browsers integrated it.

I will go through this effort until browsers integrate it, or until there is a secondary service that's easily runnable. This would just be pi-hole but for the internet instead of your local network.

FB still gets to know whose shared URL is being accessed how much and when.

They will not be able to reliably tell their users if the end user landed on the page, and most importantly, specific users. They will only be able to guess. Today, the tracking mechanism works in tandem with the facebook pixels or tracking scripts on the receiving end to give full E2E campaign clarity. This will break that, or at least introduce heavy uncertainty that will definitely impact their revenue model.

The secondary server can cache the result, so that only the first time there's a signal to FB.

Then the game of cat and mouse will continue in this fashion: facebook will generate unique URLs for each user (if they aren't planning to do so already)

Wouldn't it just be easier to 'not use facebook'?

No. I imagine you already know why.

Reply on news.ycombinator.com