Hacker News Reader

Comment by purpleblue | Hacker News Reader

I wonder what companies will do now, probably embed the tracking information within the URL without using parameters, like dynamic URLs that are unique to a particular user/cookie?

View on HN

There's not a whole lot that can be done to combat this, but I suppose Apple could do something like keep a database of known tracking URL patterns and when encountering such URLs, "unwrapping" them in an isolated background webview which is fully generic across machines and doesn't have the user's cookies or other data, which would limit the information gathered, and then finally passing the untracked URL back to the user's webview instance.

EDIT: They could also do something similar to what they've done with Content Blocking Extensions, maybe call them "URL Cleaning Extensions", which allow third parties to maintain tracking URL pattern lists which Safari can then follow to do its unwrapping.

Yeah, all you need is to encrypt the URL (which includes tracking query parameters), and then the URL you give out is the encrypted blob.

When the web server gets a request, it can validate & decrypt, update any tracking values, and redirect to the real URL.

Historical patterns with Mail.app on iOS suggests that Apple will simply code something that fetches all such links in order to collect a preview, whether or not the preview is ever shown to the user, just as they do with Mail.app images today when iCloud Private Relay is enabled. At which point the tracking value becomes less than zero, because it pollutes the core dataset attribution “a human saw this”.

Tiktok does this. If you share anything on Tiktok, and someone clicks on the URL they get an alert "purpleblue shared this video with you!" and you can leak your private account to someone.

There is a TikTok setting to disable this. It still tracks you as the origin of the share action (naturally), but it’s hidden from the receiver.

I could see the writing on the wall. Offerup I think does this. If you click through an item in a search the URL has a UID in it. Then if you click on the seller and find the item from there, its an integer (which is likely a database index).

I often remove tracking parameters from URLs and I notice that some services/websites return an error if you visit it without a tracking parameter. If a service does this, apple can't remove the tracking parameter from the URL any more.

Catchall subdomains?

They're already doing it. I stopped clicking on links the second I realized this.

Already ahead of you. They're already generating custom links with all the tracking parameters embedded. Tumblr, TikTok and Facebook have done it for a while now.

Reply on news.ycombinator.com