hexbear

10143 readers

1 users here now

Now that the old Hexbear fork has been officially abandoned, this community will be used as a space for meta-discussion on the site itself.

founded 4 years ago

MODERATORS

[email protected]

132

We should get on top of the link tracking problem (hexbear.net)

submitted 10 months ago by [email protected] to c/[email protected]

32 comments fedilink hide all child comments

I've noticed a rise in people sharing links to YouTube, Instagram, Twitter, TikTok, and reddit that include tracking parameters in the URL.

It might largely be harmless for now, but it's not good to let companies build a web of links between users of this site, and to link the usernames of users on this site to their off-site accounts, which may include sensitive info.

SM	URL Part	Appearance in URL	Filtration technique
Youtube	Query	?si=*	Remove query string
Instagram	Query	?igshid=*	Remove query string
Twitter	Query	?t=	Remove query string
Tiktok	Subdomain and path	(vm/vt).tiktok.com/(random_string)	Block
reddit	Path	/(sub_name)/s/(random_string)	Block

This site should only allow canonical links to the content to limit the information exposed.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 14 points 10 months ago* (last edited 10 months ago) (1 children)

Tiktok links can be scrubbed of their tracking by resolving them one time, letting the 9-character random alphanumeric unique string be resolved out in a web browser upon visit to a 19-character numeric only video identifier plus separated tracking parameters, and then cleaning up the GET parameters that come out when you resolve it. See this post I made a while ago https://hexbear.net/post/216322?scrollToComments=false

[–] [email protected] 12 points 10 months ago (1 children)

Really good point, but in my opinion this should be left to the person doing the posting. If Hexbear implements this link resolution on the server, it could potentially be used to link the user to Hexbear itself. Again, very paranoid, but I think it's more pragmatic to just block. Alternatively, proxitok can be used to resolve the deobfuscated URL, thereby the user isn't linked back to Hexbear, but this is significantly more complicated and leaves Hexbear dependent on a third-party service.

[–] [email protected] 8 points 10 months ago

yeah it's probably best if we prevent submission of such links with a pointer to instructions on how to deobfuscate the url.