Live data from Hacker News

URL shorteners set ad tracking cookies

ylukem.com

61–70 of 213 posts

Re: URL shorteners set ad tracking cookies

#61
How is this news in 2021?

I remember going to talks by tech people at link-shortener companies (bit.ly, IIRC) in like 2012 where they were talking about all the fancy analytics and tracking they offered and why it was so great that you should route all your links through them to get more "insight" into visitors.

Re: URL shorteners set ad tracking cookies

#63
post #50

Not particularly surprising. I was building a url shortner some 12-13 years ago but eventually abandoned it. But this was exactly how I planned to monetize it.

This headline might be the biggest "duh!" I've ever read on the site. In this day, and in this surveillance market economy, you must assume that you WILL be tracked wherever you CAN be tracked.

I understand the downvotes, given this is HN, but while this is "duh", lots of people don't actively think about it whenever they see a shortened link. Posts like this are okay now and again to remind people that they can and will be tracked wherever possible.

Re: URL shorteners set ad tracking cookies

#64

I currently host https://femto.pw/ - A URL shortener I've kept up for ~4 years and intend to indefinitely. It doesn't do anything with regards to tracking cookies or other dark patterns. It just redirects you using a 302 redirect.

FYI that your site is blocked by this list: https://gitlab.com/The_Quantum_Alpha/the-quantum-ad-list HN post for that list here: https://news.ycombinator.com/item?id=25512273

That list is questionable at best.

There are many claims the list author makes without any source code at all, though a lot of buzzwords. The reddit r/pihole moderator pulled the post: https://www.reddit.com/r/pihole/comments/kh5dit/the_quantum_... . The thread was more entertaining before the list author deleted every downvoted comment they made.

Re: URL shorteners set ad tracking cookies

#66
post #21

Wow! https://preview.tinyurl.com/examplezoom really shows https://zoom.us/j/123456789 link whereas Chrome network inspector confirms the viglink.com redirect. uBlock origin blocks the latter via Dan Pollock’s hosts file and Peter Lowe’s Ad and tracking server list.

As someone who uses a whitelist approach, I am curious whether people ever experience false positives or missing entries with these lists? I have little experince with those lists except for going through one of them once and being shocked at what was in there.

The setup I use is customised for me, i.e., Rube Goldberg would be proud. I can view and manipulate all traffic from outside the application and outside the origin computer. I can strip cookies based on IP, domain or URL very easily. I also control DNS so only domains I approve would even return an IP address.

Re: URL shorteners set ad tracking cookies

#67

Earlier quoted context omitted.

Hm, well I've got to work out how to get off that list! Thanks for giving me the heads up. EDIT: I'm not sure quite how to deal with being put on ad lists. Sure, people can upload any file to our host so it's plausible that someone, at some point, has uploaded an advert. Someone could also redirect to an advert domain and we'd have no way to really deal with that unless it was reported. Ideas are welcome for solution…

Just some thoughts: 1. Reach out to the list maintainer to see why your site was added. 2. Create a blocklist comprised of those ad lists. Don’t redirect to sites on the blocklist. 3. (Of dubious practical value) Create a Terms of Service that says users may not use your to link to advertisements.

> 3. (Of dubious practical value) Create a Terms of Service that says users may not use your to link to advertisements.

That seems entirely unenforceable. Aren't ALL websites ultimately advertisements?

Re: URL shorteners set ad tracking cookies

#68

This is really interesting. I suppose tiny url gets a kicked back from their ad network for this. I'm the creator of the URL shortener (T.LY) and a Link Unshortener tool. I spend most of my development time fighting bad actors. My goal is to have a legitimate competitor to bitly that people benefit from. We do not set any cookies on redirects but do use cookies for authentication for users. T.LY: https://t.ly/ Link U…

It is a shame that T.LY displays only the footer without JavaScript enabled instead of degrading gracefully. Surely a plain HTML form that POSTs should suffice?

I'm not sure how much work it would require for you to support this, but it would help cement your place as a good web actor if you're so inclined!

Re: URL shorteners set ad tracking cookies

#69
post #21

Wow! https://preview.tinyurl.com/examplezoom really shows https://zoom.us/j/123456789 link whereas Chrome network inspector confirms the viglink.com redirect. uBlock origin blocks the latter via Dan Pollock’s hosts file and Peter Lowe’s Ad and tracking server list.

Tried in a new profile and didn't see any viglink.com.

Edit: the link should be https://tinyurl.com/examplezoom (which does have viglink.com).

For some reason you wrote the preview link, https://preview.tinyurl.com/examplezoom, which does not have the tracker.

Re: URL shorteners set ad tracking cookies

#70
post #21

Wow! https://preview.tinyurl.com/examplezoom really shows https://zoom.us/j/123456789 link whereas Chrome network inspector confirms the viglink.com redirect. uBlock origin blocks the latter via Dan Pollock’s hosts file and Peter Lowe’s Ad and tracking server list.

As someone who uses a whitelist approach, I am curious whether people ever experience false positives or missing entries with these lists? I have little experince with those lists except for going through one of them once and being shocked at what was in there. The setup I use is customised for me, i.e., Rube Goldberg would be proud. I can view and manipulate all traffic from outside the application and outside the o…

What is the user interface for your setup like? It sounds attractive but possibly prohibitively frictious to be workable for me.

I currently use a combination of uBlock Origin blacklisting, NoScript whitelisting, and Little Snitch alerting, if you need a baseline to compare. I've also run a Pihole instance in the past to loop my phone in, but that's not running as of today.

Post reply on HN