Hacker News Reader

Comment by jklinger410 | Hacker News Reader

Not every query string in a URL is about tracking. This will break some sites.

EDIT: Correction, they are very conservative with which strings are filtered out. See here: https://github.com/brave/brave-core/blob/master/browser/net/...

View on HN

It doesn’t strip every query string. It acts as if it has a list of known tracking params, but I haven’t investigated the exact mechanism.

I kinda wish it did remove all querystrings. The vast majority of querystrings are nothing more than tracking and marketing garbage, and I can handle the rare situation where one is needed manually. Stripping from a known list of values just means that marketers will start using random identifiers with clever ingestion code, making this mechanism less useful over time.

Stripping all querystrings would break tons of sites, such as this one we're on right now.

It's even worse than using random query strings. Last year, Facebook, Amazon and some other sites started using encrypted URLs that can't be decoded and modified before hitting the server. The good news is that this won't work with just an analytics JS snippet, but the technology will get easier to implement and spread over time. https://www.schneier.com/blog/archives/2022/07/facebook-is-n...

Unfortunately that won't help as it's perfectly possible to add tracking parameters in a static-looking portion of a URL.

Removing all query parameters might encourage that practice, and ultimately even push sites towards creating completely opaque, server-side resolved unique sharing URLs.

Very true. This is a nuclear arms race that I'm afraid users will ultimately lose. The kind of fingerprinting that has been used to determine TOR users is what the end-game ultimately looks like. It's already being done anyway. It's very difficult to avoid, and you will not be able to use 90% of the mainstream internet if you do.

Sort of. Adding an unexpected query variable is generally well handled, which allows Facebook to add fbclid to all outbound links without breaking most sites. Stuffing the tracker into the static part of the URL requires way more integration work.

Klipper (KDE's clipboard tool) lets you set up this sort of thing pretty easily. It can take actions when a certain type of content is copied. So, you can match on "^http[^?]*" and "echo %0" (you can call any program, builtins are provided for MIME types, so you can, for example, launch a browser when you copy a URL) as the action will allow you to replace the copied URL automatically/on-request.

I'll take a second attempt using Ctrl+C over always copying the tracking garbage for 90% of URLs.

Where did you read that it removes the whole query string?

You're right, after looking in their documentation I found that they are very conservative with which strings they filter out.

They only look for specific KNOWN user-level targeting strings to strip. This is actually a very nuanced route for them to take. Other plugins will just filter out everything following a query.

Here is the fine details for those interested: https://github.com/brave/brave-core/blob/master/browser/net/...

As a marketer, they do mention that they retain Campaign level parameters, however the click ID is more than just a user-level identifier. Many times a click ID is the only thing that survives different environments in order to provide any attribution at all.

In fact, a click ID is much more privacy aware and anonymous in every circumstance than a website giving you your own user ID. All good web platforms generate a unique ID for you, which is not anonymized for the web platform. Whereas the click ID is always anonymized for the web platform. When you combine the two, you get a very basic piece of information: this user clicked this ad. Now those websites will still know who you are as a user, and still know which campaign you came from, but not when you specifically clicked. Wow, what a privacy save!

Removing it does very little to reduce what Google knows about you. Google does not need your click ID. The only time it is used is for conversion attribution, and it is completely anonymized between the ad platform and the marketers who run the campaigns.

So this is mostly just sticking it to the little guy, as large data platforms don't need ad-level click IDs to track you. But if you want to make sure that no marketer ever gets credit for driving you to perform an action, then this is for you!

> All good web platforms generate a unique ID for you

I disagree. The good websites will not do this.

> But if you want to make sure that no marketer ever gets credit for driving you to perform an action, then this is for you!

Sounds good to me, and doubly so if I want to share the link with someone else.

Although I don't think this mechanism is good enough, actually. I'll just stick with manually editing the URLs.

Make sure you are always using TOR and a VPN. It's also best if you operate off of a linux live-cd environment and boot up a fresh one every day.

You'll also want to make sure you don't own a smart phone, or keep your money in a bank.

Probably best to have your house owned by an LLC shell corp. Also register your cars under that corp as well. Unfortunately, you still have to have a license, voting record, and social security number. But there are creative ways to get around some of that.

For the extra committed, probably good to burn off your finger prints, just for extra security.

I think the assertion that because you can't have total privacy, it's not worth having any privacy is fundamentally illogical.

There's nothing wrong with doing what you can to keep the bad actors away even if you can't keep them all away.

Reply on news.ycombinator.com