Report: YouTube adding user-traceable ID tag to links shared off-platform | Hacker News Reader

Report: YouTube adding user-traceable ID tag to links shared off-platform

twitter.com

222 pointshammock121 comments

Soo this seems to be when you use the "share" button on Youtube rather than doing the simple universal old-as-www thing of.. copying the URL from the URL bar. Of course, people these days have no idea what a URL or URL bar is, as it's often hidden anyway... :(

https://nitter.net/OldRowSwig/status/1732112446943269347

When I share links, I often want a timestamp in it. Adding that is pretty annoying without the share button.

If you right click on the progress bar at the bottom of the video, one of the options is: "Copy video URL at current time". (Although YouTube might also start adding extra IDs to that URL in the future.)

You can do that right click anywhere on the video

How do you right click on your mobile device?

That's like asking how to right click on a television. Mobile devices are designed primarily for mindless content consumption and personal data collection so basic functionality is crippled by design

I get that "Use a real computer" isn't helpful though, so I'd recommend getting an app like NewPipe since you can use the "share" button there to copy the video's URL with the current timestamp included to your clipboard or paste it directly into apps of your choosing.

?t=4m20s

I may be mandela effecting, but was there a time you could do ?t=wadsworth or some other param to skip the first 30%.

https://knowyourmeme.com/memes/the-wadsworth-constant

Yeah, I remember that. Specifically what I remember is a discussion on reddit about how a lot of youtube videos have useless stuff in the first ~30% and someone who joined the comments -- wadsworth -- also happened to work at youtube. Apparently with enough freedom to have an extra parameter check deployed to production. Probably around 2012. The parameter I remember was wadsworth=1.

Edit: Got the story wrong. Wadsworth was just a commenter with an opinion and someone who worked at youtube had a sense of humor.

https://old.reddit.com/r/pics/comments/kxfxy/and_so_ends_20_...

Wadsworth's constant lives on in spirit via SponsorBlock blocking all the intro BS and allowing users to set a timestamp as a highlight with a button to skip to said highlight. I use that feature all the time.

Yes, this was possible before but doesn't seem like it works now.

Post on reddit by person who added this feature: https://old.reddit.com/r/wadsworth/comments/l461y/today_i_ma...

What a coincidence I was thinking about this feature just a couple of days ago and couldn’t remember the name of the Wadsworth Constant.

Slight nitpick: &t=4m20s

YouTube will have ?v=[SOME ID] so you can't reuse the question mark.

If you use the mobile app, the Share button is the only way to get the video ID.

This pattern has led me to avoid apps and use the websites on mobile.

YouTube Revanced is awesome though, even if parts can be replicated via mobile web with extensions.

Revanced still has ?feature=shared tacked on to the end of links created with the share button. But no user identifying ID.

Of course, people these days have no idea what a URL or URL bar is, as it's often hidden anyway

...and if you didn't think this wasn't one of the goals of that trend, now you do. Those in power hate it when people can consume information from and communicate outside of their sanctioned methods.

We saw it coming when they started dumbing down browsers and hiding things from users --- not because the majority wouldn't use them, but to deliberately make users less inclined to learn.

Nearly 10 years ago(!) when that started happening, I made a comment here about how many YouTube users at the time realised what was the important part of the URL (the video ID) and began to use that in comments: https://news.ycombinator.com/item?id=7678729

>Of course, people these days have no idea what a URL or URL bar is, as it's often hidden anyway... :(

The vast majority of users have no idea what an address or address bar is, let alone a Universal Resource Locator. Hell, most users don't understand files and folders in a computing context either.

As much as I hate how iOS, Android, MacOS, and presumably even Windows these days are obfuscating the file system and nearly everything pertaining to it, I do think it's a necessary step in the right direction. Most users do not address, and as computing hardware and software engineers, designers, and nerds we have an obligation to provide computers that all users can easily understand.

It is not a good idea to assume that users are stupid, uncurious and can’t learn. The end-state of this philosophy is that citizen can’t get informed and can’t vote properly, we need to tell them who to vote for, and do it instead of them.

What differenciated the Middle Ages from the Enlightenment periods is the understanding that people aren’t that stupid, we don’t have to hide the Bible behind Latin, we can translate it to the local language and they’ll learn by themselves instead of going through clercs, and the same goes for law, physics, sciences and philosophy.

And we’re much better off with populaces able to make decisions for themselves (ie copy from the URL and drop one letter by mistake) than dumbing down everything to have control over them.

But... people might come to conclusions I don't like! Or agree with!!

Knowing how to navigate to websites directly seems important for laypeople to understand.

There is point where dumbing down technology doesn't make it meaningfully more accessible but just serves to harm users. Hiding the URL bar is past that point.

I'm a computer nerd, I just use Google to look up and go to most websites I want these days.

Why? Because I'm not confident I can type their URLs properly and any typos are a one-way ticket to Scam City. Chances are reasonable Google has the correct website URL. Bookmarks, you say? Can't be arsed.

Between inconvenience, unintuitiveness, and "I ain't got time for this" mentality it's no surprise why file system structures are obfuscated away.

>URLs properly and any typos are a one-way ticket to Scam City. Chances are reasonable Google has the correct website

googles no1 spot has become scam city hundreds of times for big namens just this year alone

>Bookmarks, you say? Can't be arsed.

in the time you complained about this problem of your own creation you could habe bookmarked your top 20-50 visited sites.

off topic but i see more and more "I'm too lazy to do x" where the solution would be easier than just being "lazy"

Look boy, my time only becomes ever more valuable as I age. I literally ain't got time for 'puter nonsense anymore.

Did I really type in amazon.com correctly? Not amazn.com? amazon.cm? Or some other stupid typo that will send me straight to Scam City?

In that time I could have gone to Google (which is my browser home page), typed in something vaguely resembling "amazon", and the first or second link will be amazon.com 99% of the time.

I ain't got time.

What about almost any other website? Google aggressively abstracts away search terms and very often gives you something irrelevant.

Same, shaking my head. Your “users” are full grown adults with full time jobs and kids. They dont have time to understand nothing. iOS model of simplifying everything is far more intuitive and better.

Don’t get me wrong, I’m all in for a dev-switch which would enable scripting and open up everything in OSes. But tell me how you are gonna do that without scammers telling grandmas “Copy this thing to here, yeah…”. Currently the dev switch is e.g. a Mac and $99/year, for iOS.

Google has been working with great deal of effort for decades to stop people from using urls. From the integration of the search function in the address bar to the famous mangling of links returned by Google searches. It's why sites like urlclean exist.

I just looked at the full URI of very simple google search and it includes my browser for one thing... Why do they need those 387 characters beyond the original query...

No wonder Chrome wants to hide all that...

It's 100% so they can somehow correlate the data available in the adsense/adwords dashboards given to the site owners.

Damn. I noticed this happening a while back and I didn't think much of it. I just deleted the si= part because I knew it's not necessary for a Youtube link to work! I was curious about why this has been added and figures there's been something nefarious going down.

Same thing I've noticed for Instagram links and many other different apps. Most of them have started tagging the link, to track the user, or check who interacts who, I think.

Those who don't want clean link manually, can use link cleaner apps or uBlock origin in browser.

I kept using the app (with ads) because despite my hate for Google I still thought it was the right thing to do. And using YouTube in a browser on mobile felt clunky. But I noticed that identifier in the shared url too and that, plus the increase in ads, finally pushed me to ditch the official app and go with NewPipe. No more ads, no tracking in the URL, sharing the URL can be done with timestamp, when tapping a yt Link in another app, I get asked if I want to play it right away, enqueue it, play it in the background or play it in a little floating window.

Newpipe and Yattee are awesome. I don’t regret the couples of evening I spent setting up a local sever.

I used to see ads occasionally on YouTube before they tried to crack down. The irony lol.

Another vote for Yattee (works wirh tvOS too), I use it with Invidious as the backend.

Pure bliss.

Right, first I noticed Twitter doing it and then YouTube. I thought, someone sold those corporations new tracking tool or an existing one got a new feature.

But Twitter doesn’t appear to do it anymore.

Maybe it's just buried in a POST somewhere and no longer a urlparam?

That would defeat the whole purpose of the parameter for tracking links shared off-site.

Thanks for the correction.

Am I the only person who never clicks these "Share" buttons but just copies the link from the address bar? It's fast and easy - Ctrl+L, Ctrl+C.

The share button is the next step: Ctrl+V.

At least on Apple devices, it allows you to “paste” things in surprisingly unlikely places. With some finesse, you can even add custom actions on MacOS like passing it to a shell script that downloads and then pipes it into ffmpeg or whatever. Yeah I use it a lot

Thank you for introducing me to Ctr+L; I don't know how I've missed that all of these years.

Ever since the first time I spotted this I've been removing it manually. Any browser addons to help with this, anyone?

The fact that Google has to resort to this is amusing. To me it means they can't do it any other way and are now leaving themselves wide open for us the techies to strip that tracking ID; which we absolutely will do.

Things must be getting desperate somewhere in HQ.

Good.

They can obviously generate indistinguishably unique urls for video sharing links if they wanted, this is just easier to implement (though not by much).

Also there’s no treachery afoot here… go ahead and remove it, the stakes here are very low.

Well exactly, they are outright adding an URL parameter and of course I'll remove it. Doesn't mean that they don't rely on less tech-inclined people to never even notice, and I am sure that's a core part of their strategy anyway.

As for the indistinguishable URLs, you have a solid point there but I'd think there would be a lot of outrage because people want those URLs to generate previews when pasted in pages, social media comments etc.

Not to mention all the false positives generated by people embedding such URLs.

So I think for now we're safe on that front, they would poison their own well if they went ahead with encoded URL identifiers, happily.

But again, I am very amused that they just outright added "?si=..." -- to me that reeks of desperation and I have to admit that I enjoy it when Google is struggling.

If this "reeks to you of desperation", then you're putting a lot more emotional energy into the situation than is necessary. There is no world in which this is desperation on the part of YouTube, that's not a reasonable view.

Better to keep the ID and change it to 31337.

ClearURLs is the one I use: https://addons.mozilla.org/en-US/firefox/addon/clearurls/

> The fact that Google has to resort to this is amusing. To me it means they can't do it any other way and are now leaving themselves wide open for us the techies to strip that tracking ID; which we absolutely will do.

I don't think it means that (although I wish it did): it's just another connecting datapoint, and more connecting datapoints are always good from their perspective.

(I think it's helpful to think about these things from Google's perspective: they're running a service that ~billions of people access and share daily. 95% or more of those people won't know how to strip those identifiers; the 5% or so that do are put on the slightly-less-happy-path for social graph discovery.)

Oh I am sure it will have positive impact on their tracking; that much is guaranteed.

What I am saying is that they chose a very lame way to do it and this robs them of very valuable data they could get from those 5% and I'd argue that they really would want to know how you and me are moving and discovering stuff when we're outside YouTube.

Trying hard not to have the protagonist syndrome here but I'd think they are more interested in how the non-couch-surfers do stuff.

Though a very good counter-argument would be that they can now target ads better and probably gain slightly higher conversation regardless of us the 5% stripping the tracking parameter, and that would still be a huge financial win for them.

All in all, my stance is: let them have it, but I still find it reassuring that they are not even covert about it which gives us a lot of options on how to deny them.

Finally, there's the possibility of various browsers and addons to start automatically removing the tracking parameter, though such movements usually take years.

The same group of people that are doing the best job of avoiding their advertising? I would expect them to prefer that we went away quietly :-)

Yeah but we will not go away. Let them keep trying, they will have to start banning IPs and they will be taken them to court because I pay for Premium and I can share links to their videos however I wish.

ClearURLs is a great "set it and forget it" addon. Don't leave home without it.

If you want power and customizability, check out Request Control.

uBlock Origin can also block this by adding the following rules (Dashboard > My Filters tab):

  ! tracking param https://twitter.com/OldRowSwig/status/1732112446943269347
  ||youtube.com^$removeparam=si
  ||youtu.be^$removeparam=si

ClearURLs implemented the rule to remove the si attribute on November 5th[1].

I think a better approach though is to whitelist allowed attributes rather than blacklist disallowed attributes. For example, if you get a URL starting "https://www.youtube.com/watch?" then the only allowed attributes are v, t, etc and everything else would be stripped.

[1] https://github.com/ClearURLs/Rules/commit/f4d52da5902640d4d0...

Request Control[0] can do this. Create a rule with the following settings:

Host: *.youtube.com

Path: /watch*

Types: Document

Action: Filter

Check "Filter URL Redirection"

List of Trimmed Query Parameters: v t list index time_continue

Check "Invert trimming"

'time_continue' is used when you navigate to Youtube from an embedded video. 'index' is used in playlists.

[0] https://addons.mozilla.org/en-US/firefox/addon/requestcontro...

lc should be allowed in addition to v and t, as link to specific comments under a video!

> they can't do it any other way

This is purely an extra data point; without it, there is 0 attribution for which user is responsible for a link to a video causing that video to go viral, besides the referrer header.

They have experimented with other ways to do this in the past. For example, they used to have a direct friends list on YouTube where you could share videos to specific friends or groups of friends at once.

The theory has been at some point they'll remove the separate ID and have a single ID that encompasses both. Due to things such as Apple's automatic tracking link removal (but also many others): https://9to5mac.com/2023/06/08/ios-17-link-tracking-protecti...

Facebook started doing this a while ago https://www.schneier.com/blog/archives/2022/07/facebook-is-n...

Reddit too, but I don't have a news source for it. I can only share a link I came across: https://reddit.com/r/dataisbeautiful/s/LCv7yIwiVF

If you click on the link, you can see all the tracking parameters in the URL bar. Whosever link this is used the official Reddit iOS app to generate the unique URL.

Not a browser extension, but an Android app. URLChecker[0]. You can "share" to this app, and can clean the URLs (uses ClearURLs database) and check for redirects. You can also do more advanced URL rewrites (such as Twitter -> Nitter) and open URLs in specific browsers

[0]: https://github.com/TrianguloY/UrlChecker

I just noticed today that Arc Browser cleans URLs for sharing

They have a bazillion dollars and I’m sure complete control over Congress to the extent they need it. I doubt they’re desperate.

Why is this coming up today? This behavior has been a thing when sharing videos from the Mobile app since at least early October.

Edit: found a you.be link of mine with the `si` param from August 23rd.

Pretty sure it's way older than that. My YouTube ReVanced version is installed early March and it has this behaviour. I'm quite sure I've seen it also last year too.

It’s only about three or four months old for the website at most; the app might have been doing it earlier (but I doubt it)

When it became news https://old.reddit.com/r/webdev/comments/15ukrpi/what_is_the...

In Firefox you can right click and choose to copy links without tracking. Another reason why every hacker should switch to Firefox.

Right, but nothing prevents YouTube to get rid of public video IDs and simply share an opaque version of (user, video) whenever possible.

It'd be awful, but Google nowadays is willing to do shitty stuff like this and atrocious stuff like engage with the military too (because obviously the only flaw of project maven was being discovered)

> Right, but nothing prevents YouTube to get rid of public video IDs and simply share an opaque version of (user, video) whenever possible.

Instagram and TikTok have already been doing this for years.

If it's any consolation, Spotify has kept the old system.

Reddit has started to as well. Their app generates /s/ links which annoyingly require you to be logged in to resolve.

Another pattern that I hate is that Reddit will create an account for you if you are using a browser profile that does not have an associated Reddit account. It will then prompt you to 'personalise' the username and password.

I wonder if that factors into the # of accounts for their planned IPO. Does this also include new prive browsing sessions?

It's not just a tracking tag on Reddit; the shared links largely obfuscate the thread or comment, requiring one to go through the tracking link to find out what is behind it. An example for anyone curious:

Tracking /s/ link:

https://www.reddit.com/r/Blind/s/xxQGmFcPSS

Leads to the following:

https://www.reddit.com/r/Blind/comments/17atlg7/my_6_week_ol...

They might start giving us personalized hash URLs in the future, that would be akin to MIC (yellow tracking dots) on printers

I just tested this. "Copy without site tracking" does not strip the si= parameter (Firefox 120.0.1).

Yeah the "Copy without site tracking" isn't very good right now. I'm still using the ClearURLs extension to remove the tracking junk.

Ironically I've only seen it work best when removing tracking from Firefox's own links. https://mastodon.social/@lazycouchpotato/111480927753796790

It would be if it worked and were hackable, otherwise hackers should use extensions in any browser

Brave does this by default.

I'm kind of surprised that YouTube does this in a way that is visible and removable instead of using fully unique ids through a redirect service.

URL obscuring gives a URL a shelf life that URL parameters don’t. The URL only ends up functioning as long as the redirect service is functional whereas a URL will work no matter what garbage parameters you throw in after the ? in a URL. If the page can do something with the parameters it will, but if it can’t, it just gets ignored.

True, but that redirect service can be stupid simple if the URL has all the information it needs to do the redirect encrypted in the URL. So no new DBs.

The URL gets a little longer, but a format-preserving encryption scheme might be able to help a bit.

Not that I want to give them any ideas.

Can't keep encryption keys around forever, and that means encrypted URLs have a time limit on them.

Sure you can. Even if the key is rotated monthly for 20 years, we're talking ~4 KB of memory for all the keys.

But remember that this isn't being done for security; it's just adding a minor barrier to casual removal of the tracking information. And if users really want to circumvent it on the links they generate all they'd need to do is copy the regular URL instead of using the Share button.

(Again, not that I want to see them do any of this.)

You can stop giving them ideas while YouTube is still a service I genuinely like.

> And if users really want to circumvent it on the links they generate all they'd need to do is copy the regular URL instead of using the Share button.

At that point, why even replace it with something common? Just use the uniqe urls always.

Rotating a key involves retiring the old one.

If 20 year old keys remain valid and URLs encrypted with them still work, you’re not getting any value out of key rotation. If an old key leaks or is cracked, the entire system is useless.

Remember the point of encryption here is basically integrity - to verify that the parameters were generated by the site’s own share capability.

I only claimed a minor barrier to unmotivated tracker stripping. By that I mean a hurdle, not tamper resistance. So in the worst case you're no worse off than what the existing unencrypted system affords you.

Indeed, rotating the key here serves very little benefit.

Thinking out loud: I suppose if they strayed further from the light and started restricting timestamp linking to share button URLs they might want to rotate the key to frustrate anyone looking to generate anonymous timestamp links. In that case, you could do something like include some indicator of which key was valid on the day it was uploaded. That limits the blast radius of a leaked/cracked key to the ability to generate timestamp links for all videos created during that period. Still low stakes, but now we need care more about integrity. Also, I wouldn't be surprised if updating the video ID scheme is a huge ask, so at that point a new DB might be the easier solution.

Not even that, I'm surprised they don't just encode it into the actual uri and dynamically generate those on share and decode when someone clicks it. I'm not seeing why they need this as a parameter in the query string to begin with.

yep, tiktok hides it via unique url shortening.

I've been changing it to `&si=no+tracking` since first I saw it.

So you changed nothing because it still builds a friend graph

I wonder if that shows up in some error log of failed &si= lookups in their tracking database. Maybe some random engineer at Google will see it and be amused for about 10 seconds.

Copy that. It was about 3 seconds though

Hum, other platforms have been doing this for ages

Tracking copy pasted like is an old techniques that also allows them to build a unofficial friend graph between cookie profiles.

And it was very nice of YouTube to not follow this

This kind of behaviour is why I would never pay for YouTube premium.

Google are relentless with their surveillance and are always looking for sneaky new ways to track people.

We need anti-surveillance and data subject laws.

When Unique Resource Locator becomes Unique User Tracker.

I believe Douyin is the most notorious of them all. Each video doesn't expose unique ID at all. Every link is a short link uniquely bond to your device/app/browser.

Does anyone know of a generic reverse proxy solution that does this? Say an nginx module?

I believe TikTok does this as well?

TikTok generates a fully unique share URL for every person.

If you click that link and it opens in the TikTok app, it'll tell you exactly who shared it and asks you to follow them...

Thankfully you can fix that by following the share link yourself, which will redirect to a full URL to that video, which you can then strip the tracking parameter from.

Very annoying to have to remember to do that though.

That's so clever and a data analyst's dream

yeah also means you can't just delete a utm parameter to avoid being tracked. devilishly clever

Came here precisely to comment this. YouTube is hustling to catch-up to TikTok features is ways large ("Shorts") and small (unique share links).

So does Stack Overflow, although they tell you very clearly that your user ID is embedded in the link, right in the "share" box (and it's not obfuscated in any way).

SO goes so far as to give you little notifications and achievements whenever a certain number of unique visitors follow one of your shared links.

And Spotify.

I have been fixing this manually since I noticed it a few weeks ago; I just option+del to remove the value, and it still works with an empty parameter. I've got so far as to look briefly into writing a clipboard-watcher application to strip it for me. It's obnoxious and obvious.

I'm as surprised with how long it took Youtube and Twitter to add tracking IDs to their links, as with the fact that Instagram and TikTok still have proper URLs at all instead of generating a new unique URL each time you load some content.

Those TikTok urls aren't proper. They weren't before. They might be better now but don't think TikTok is new to the idea of tracking you to that level.

The comments section mentioned TikTok, of course, because it's a Chinese company!

Chinese tech giants have long been ahead of the curve in terms of privacy infringement compared to various Western countries.

The practices of YouTube are already outdated in China. For instance, China's largest video platform, Bilibili, prefers to compress video links containing a large number of tracking parameters into short links, making it impossible for you to use something plugins to remove tracking parameters.

While I'm not sure if it's user tracable, Reddit also started changing the link that is produced when you share a link to a post. It is a /s/<id>, which I absolutely despise.

I share links to things when I'm logged in, but I want to ensure that the receiver has no way of tracing back the sent link to my Reddit identity.

This is why I like Brave's "Clean Copy" feature.

Firefox has it too these days (or at least in the Developer edition, not sure about the "stable")

I have the latest Firefox (non-developer), and it has the "Copy Without Site Tracking" option in the right-click menu on the URL bar. Is that what you mean?

Unfortunately, it's always there, whether or not the URL includes site tracking.

'Copy clean link' in Brave doesn't (yet) seem to remove the `?si=` URL parameter though.

Yeah YouTube music specifically has been doing this for many many months, I'm fairly certain. I always removed it before sending songs to friends.

Until then it was just &feature=share but now its a full ID. Yikes.

this has been the case for all fb-owned social media and spotify for better part of the year.

i am yet to come across it for youtube, but unsurprised. i wonder why there was no reporting on the other cases.

Timtok does the same since long time ago.

FBI making lists.

Reply on news.ycombinator.com