Nitpick: > The idea is to use zero-width and space characters of UTF-8 such as U+200B, U+200C, U+200D That must be Unicode, not UTF-8.
Fixed it, thanks!
Invisible Click Tracking Using “Empty” UTF-8 Characters
11–20 of 38 posts
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#12Anyone have a suggestion of how this would be used in practice for uniquely identifying something? So there are a certain number of non-width space characters. As far as I can find in the links in the OP, U+FEFF, U+180E, U+200B, U+200C, U+200D would make 5. So we have at least 5 values to work with, which would make... 120 combinations if they're ordered differently? Surely we would need more if we want to uniquely i…
Surely you could put as many of them in there as you wanted? So you have an alphabet of 5 characters to make an infinite number of words from.
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#13Isn't this exploiting the same kind of Unicode ambiguity that allowed phishing sites to impersonate trusted domains by substituting certain latin characters with identical-looking cyrillic equivalents? I would expect this capability to last long in the wild.
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#14Anyone have a suggestion of how this would be used in practice for uniquely identifying something? So there are a certain number of non-width space characters. As far as I can find in the links in the OP, U+FEFF, U+180E, U+200B, U+200C, U+200D would make 5. So we have at least 5 values to work with, which would make... 120 combinations if they're ordered differently? Surely we would need more if we want to uniquely i…
Surely you could put as many of them in there as you wanted? So you have an alphabet of 5 characters to make an infinite number of words from.
Good point. 0-9 work the same way. Glad I asked :)
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#15Anyone have a suggestion of how this would be used in practice for uniquely identifying something? So there are a certain number of non-width space characters. As far as I can find in the links in the OP, U+FEFF, U+180E, U+200B, U+200C, U+200D would make 5. So we have at least 5 values to work with, which would make... 120 combinations if they're ordered differently? Surely we would need more if we want to uniquely i…
120 are the combinations if you only use 5 characters and just modify the order. However, if you allow the amount of characters to vary, and allow duplicates, you can represent any number you want. As it's a 5-bit number system, the count of distinct possibilities is 5^n for amount of numbers, or with just 10 digits, you can fit any 32-bit integer there. Plenty good enough for tracking.
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#16Anyone have a suggestion of how this would be used in practice for uniquely identifying something? So there are a certain number of non-width space characters. As far as I can find in the links in the OP, U+FEFF, U+180E, U+200B, U+200C, U+200D would make 5. So we have at least 5 values to work with, which would make... 120 combinations if they're ordered differently? Surely we would need more if we want to uniquely i…
55555 if you limit to a 5 character word!
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#17Just to point out that hovering over the link shows URL-encoded codepoints, i.e. %u200B (in Firefox, for me, at least). I do think it's a better solution than the existing approach with GET parameters which does look clumsy.
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#18Isn't this exploiting the same kind of Unicode ambiguity that allowed phishing sites to impersonate trusted domains by substituting certain latin characters with identical-looking cyrillic equivalents? I would expect this capability to last long in the wild.
Interestingly, none of those "zero-width" characters are allowed in IDN domain names http://unicode.org/faq/idn.html#22
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#19Just to point out that hovering over the link shows URL-encoded codepoints, i.e. %u200B (in Firefox, for me, at least). I do think it's a better solution than the existing approach with GET parameters which does look clumsy.
Interesting. Chrome on Windows doesn't.
Re: Invisible Click Tracking Using “Empty” UTF-8 Characters
#20[deleted]