Ask HN: What is with the new URLs on facebook.com?

https://news.ycombinator.com/item?id=32117489

by thrusong • 4 years ago

275 254 4 years ago

news.ycombinator.com

Hi HN,

I've noticed recently Facebook has started using URLs which seem to include encoded information.

For example, this URL to Vice: https://www.facebook.com/VICE/posts/pfbid02XdVziPTwhmPU9XzBq...

It's a pretty URL with some kind of hash at the end beginning with "pfbid."

Whereas they used to look like basic sharded URLs: https://www.facebook.com/random.username/posts/1020832750980...

Is this for more targeted tracking on posts and links being shared, a new sharding scheme, a combination of both, or something else entirely?

Appreciate any insights the community can provide.

groffee• 4 years ago

Firefox recently started stripping out tracking URLs [0] and the most prevalent one is Facebook with it's ?fbclid= so it looks like they're encoding it straight into the URL now to bypass that, Medium does similar also.

[0] https://www.engadget.com/firefox-can-now-automatically-remov...

thrusong2• 4 years ago

Makes a lot of sense— thanks!

ape4• 4 years ago

I suppose Firefox could remove this new encoding too

nchudleigh2• 4 years ago

Wouldn't be the first time they implemented direct anti Facebook features.

wahnfrieden32• 4 years ago

Sounds like this calls for some browser extensions

Beyond privacy I'm interested in generally a browser extension that disables things that provide free labor to for-profit enterprises, such as hiding the moderation queue (which even has an annoying persistent badge) on StackExchange sites, the one that asks me to provide unpaid labor to private equity and has various rules that sound nice if it were a public utility but primarily work to improve their SEO.

blibble• 4 years ago

presumably they've encrypted/MAC'ed it, so you can't without breaking the link

Mordisquitos• 4 years ago

Not that easy, unless the URL pbfid thingy can be easily parsed into separate "post id" and "tracking id" parts — which I bet it cannot.

One alternative, which would require significant effort and investment but would be a brilliant way to outsmart Facebook's crap, would be to accumulate pbfids in a common pool such that, if a given pbfid points to post X, fetch a different random pbfid that points to post X. If the initial pbfid is not recognised, add it to the pool once the post is determined, either as a new alternative for a known post, or as a novel entry.

Of course, FB would hate it and would either try to expire old pbfids (and risk breaking "legitimate" links) or use legal threats, which would require them to openly admit that they don't give a shit about people's privacy preferences.

shultays3• 4 years ago

Even if it can, it won't the next one. Which fb simply encrypts to url (assuming it is not encrypted already)

bamboozled• 4 years ago

Here is a good way to do it, block the entire domain :)

Piece of s**

lwswl• 4 years ago

Facebook could also just make it completely opaque, and just add random data to their urls(by which I mean a+b=c, not a+b=ab), and then subtract it on their end. Then you literally might not be able to see anything, not even the webpage directory.

bencollier49• 4 years ago

They literally just announced they were doing it.

https://gizmodo.com/firefox-update-stop-url-tracking-chrome-...

nchudleigh2• 4 years ago

+1 this is likely the situation. I would bet that the rest of the url resolves to the old format with the search param after some decoding.

wahnfrieden32• 4 years ago

It's opt-in behavior. So Facebook is explicitly countering opt-in requests for privacy (without informing you)

ehnto• 4 years ago

See also: all the companies scrambling to circumvent App Tracking Transparency, in which they are not only being duplicitous, they're also breaking the new agreements formed with the app store and the customer.

Tracking has been a grey area in technology. Now that regulations and users are trying to scrape back some control over their privacy, it's going to be a lot clearer to see the line between moral and amoral behavior in companies.

akagusu3• 4 years ago

This is the kind of thing that should be illegal.

e-clinton• 4 years ago

So Facebook is explicitly countering opt-in requests for privacy (without informing you)

Facebook informs you of their tracking via the privacy policy you agree to when using their services

dom96• 4 years ago

Do you have any evidence to say that this is the case other than speculation? It's also possible that they just changed the URL format. FWIW `pfbid` seems to be a shortened version of "post fb id" so why would it include the "cl id"?

drexlspivey• 4 years ago

what's the reason to change from the old format if that's all it does?

aaomidi5• 4 years ago

Multiple other companies doing the same thing would point to a trend.

isametry• 4 years ago

Rule #n of the internet: If Meta does anything which doesn't explicitly protect the privacy of users, you can safely assume that it harms the privacy of users.

danijelb• 4 years ago

I went to Vice's fb page, found the same post that OP linked to and checked the URL. The pfbid part is exactly the same to me. The URL by default has some additional params attached like __cft__ and __tn__, which can be stripped, and those are probably tracking-related. Based on this, I don't think that pfbid is connected to tracking

zo1• 4 years ago

Facebook will Facebook, that's a given. But why aren't FB employees (anonymously) responding here and explaining how this "pfbid" thing can be circumvented or even what it contains? Where are the actual privacy activists that will do a grep through the FB sourcecode for pfbid and give us the scoop??

madeofpalk3• 4 years ago

Tiktok does the same thing when you get a URL to share a video

dawnerd2• 4 years ago

It’s really creepy too if you don’t know the share url can leak your account name (if you were trying to keep that private)

david_allison• 4 years ago

As does StackOverflow

benreesman8• 4 years ago

ByteDance has done a really good job making me reconsider whether I’d ever work for Big Tech again.

I have some serious reservations about social media generally, which is why I left to begin with, but between TikTok and Instagram I know hands down who I trust more.

tedmiston5• 4 years ago

Instagram does the same as well with your user ID as a query param when you share or copy a link.

shultays3• 4 years ago

That was such a naive move by firefox tbh

shultays3• 4 years ago

Perhaps a bit more explanation is needed considering the downvotes: https://news.ycombinator.com/reply?id=32118663&goto=item%3Fi...

This is an arms race firefox would lose. I think if anything, firefox trying to race it is now negatively affecting anyone that were able to manually remove tracking id themselves (or use a browser extension)

dredmorbius14• 4 years ago

First we had toggleable cookie and JS settings.

Sites blocked functioning without cookies or JS.

Then we had adblockers.

Sites blocked functionality with adblockers installed.

Then we had Do Not Track.

Sites LOLWUTFU

Then we had GDPR.

Sites: Multi-thousand-word EULAs, TOU, "Accept" vs. "Pound Sand" options, multi-hundred click "choice" dialogues, "your privacy is very important to us (to invade and violate)", and mass geoblocking.

Then we had UTM and FBPID URL tracking parameter stripping.

Sites: Encode tracking data directly into URL as a hash.

Firefox's action isn't simply meant to solve the problem. It's there to highlight the repeated and escallated violation and negation of express personal intent and preference.

No means no.

gnu8• 4 years ago

Why on earth would Facebook think it is ok to bypass that? This should be considered a violation of the CFAA. Start putting Facebook execs in federal prison.

autoexec8• 4 years ago

I'm all for throwing facebook execs behind bars, but what part of the CFAA would cover encoding tracking data in a URL?

wahnfrieden32• 4 years ago

This is Facebook actively circumventing their users' explicit requests to not be tracked :) They have no respect for you

daniel_iversen3• 4 years ago

It’s the price you pay to use the platform because it’s free.

wahnfrieden32• 4 years ago

I don't use the platform, and I don't accept that cost

sebazzz• 4 years ago

It is interesting you say that because there are other means of advertising than user tracking. Take context sensitive advertising for instance, you currently look at an article about harddrives it is likely you may be interested in computer hardware - so let's display computer ads.

hexo• 4 years ago

"free"

hdjjhhvvhga2• 4 years ago

FB is an advertising platform that depends on the number of eyeballs. This number is already dropping. The more user-hostile they become, the worse for their bottom line in the long term, in spite of potential short-term gains, if any.

tut-urut-utut• 4 years ago

They would not stop tracking you even if you pay. There are countless examples of this.

The only way to win is not to use term.

rockbruno• 4 years ago

Are you implying they would not do it if it was paid? The Samsung TV I paid for is filled with ads in the home screen. I pay $30 a month for cable tv and I'm still forced to see 30 minutes of ads for every mere 5 minutes of actual content. They would absolutely still do this even if Facebook was paid.

wintermutestwin• 4 years ago

It’s the price you pay to use the platform because it’s free.

? That doesn't make sense. It is most certainly not "free" and the real price is one that is far more than the costs of providing their services. The problem is that joe user doesn't understand the value of what they are paying so Facecrook is selling trinkets to the natives for land.

dredmorbius14• 4 years ago

Each family of four in the 1 billion population of the wealthiest nations (US, EU, Japan, Canada, Australia, NZ, ..) are paying on average $486 to Facebook through ad spend subsidised by their purchases, whether they use the site or not.

https://news.ycombinator.com/item?id=32118404

cainxinth• 4 years ago

The feeling is mutual

texasbigdata2• 4 years ago

Your annual cost is $0, tbf

googlryas5• 4 years ago

Having an extension or something that removes query string parameters is not an explicit request to not be tracked.

baby4• 4 years ago

Not sure why you're getting downvoted, but yeah there's no public API and promise of stability there.

NelsonMinar• 4 years ago

I have a feeling Facebook looks at URLs as an unfortunate requirement for running their walled garden in browsers. The more opaque, the better for their business.

tyingq3• 4 years ago

It appears the the old urls still exist, they are just sort of hidden.

Your VICE link is also here, for example:

https://www.facebook.com/VICE/posts/6037626766270531

Edit: To find the old style url, use /plugins/post.php with the new style url passed as a url encoded param value for "href", like: https://www.facebook.com/plugins/post.php?href=https%3A%2F%2...

Then, there's a timestamp like "10 minutes" ago in the returned page that leads to the old url.

I imagine you could make a browser plugin out of that.

thrusong2• 4 years ago

Cool find— thanks!

js2• 4 years ago

I wonder if this is related to why mbasic.facebook.com links are regularly breaking now.

cmg2• 4 years ago

Along these lines, someone else mentioned that Tiktok embeds direct tracking into URLs already.

Twitter recently started adding a 't=' param to their share links [0] as well, and I can only guess that it's some kind of similar tracking scheme. From watching browser traffic it appears to be generated when you click the share button, but I might be wrong about that.

[0] https://twitter.com/NanoRaptor/status/1548301612246249474?s=... - the first thing in my feed. Link works fine without any of the query params, of course.

propogandist• 4 years ago

the params are included when sourcing a shareable link from the website/app (direct links don’t have this). This is a move to mimic tktok’s aggressive tracking practices.

Twitter appears to be just analyzing who shares what with whom, but haven’t moved into using it for ‘growth hacking’ like tiktk yet (i.e. join cmg, who shared this link on Twtr)

tester756• 4 years ago

Cannot somebody reverse engineer it?

notriddle• 4 years ago

If Facebook engineered this competently, and I’m sure they have competent engineers, it’s either encrypted or totally opaque. If you can break this, you can probably break TLS.

saos• 4 years ago

People still use Facebook

ehPReth• 4 years ago

billions of people, yes.

baby4• 4 years ago

if that's a question: yes I do!

benreesman8• 4 years ago

I don’t have any super-special insight here, but FBID is facebook’s global integer ID namespace (fun fact: Zuckerberg’s account is 3, back in the day he was always getting random friend requests from people’s unit tests). Don’t know what a “p”-FBID is.

I know symmetric encryption is reasonably cheap these days, but anything times “Facebook edge requests” is a lot, I bet any of the cryptographers on here could find out pretty quickly what’s in that blob.

jaromir_• 4 years ago

4, not 3

benreesman8• 4 years ago

Haha that’s right, good catch. You can tell it’s been awhile since I tested in prod. :)

grishka3• 4 years ago

What are/were IDs 1, 2, and 3 for, then?

VKontakte, the Russian Facebook, has another ID system entirely: each namespace kinda gets its own ID sequence. Pavel Durov is unsurprisingly ID 1. Group 1 is the group for app developers, but no idea what it was initially. Other objects are identified by a (type, owner ID, object ID) triplet, the object ID is unique within the type and the particular database server that's chosen based on the owner ID. Really simple to work with once you get into it. Does Facebook use a single global ID namespace for everything?

sedatk• 4 years ago

"p-FBID" probably means "path FBID" in contrast to query string ones.

FollowingTheDao• 4 years ago

Oh it’s nothing, just something to make your life easier. Oh, and to make your life better as well. Just ignore it and keep using Facebook.

ynx• 4 years ago

I'm 90% certain the old number was an FBID. The new one looks like a different FBID encoding scheme - possibly with the type info included ('p') to reduce the overhead of a second data fetch.

FBIDs are a globally unique id system that they've been using for almost as long as they've been around, if not actually from the beginning.

accrual• 4 years ago

I noticed TikTok does something similar. For example, if you copy a link to a creator's page while logged in, your profile is encoded into the URL and your name and photo are displayed alongside the linked content. It's two steps to fix it - open the encoded link yourself, remove the extra data, then send the cleaned link.

cascada3• 4 years ago

I don't understand. If click on it.... and? How will that make me less private? Or how will it hurt me in any way?

steve_taylor• 4 years ago

Here's how a browser could counteract this privacy-busting measure:

When the user clicks one of these links, the browser could open it in a headless tab and wait for the URL to change to a non-facebook URL. The browser then remembers that URL, closes the headless tab, and navigates to the underlying URL with tracking parameters stripped.

evandrix• 4 years ago

https://www.ghacks.net/2022/07/17/facebook-has-started-to-en...

Ask HN: What is with the new URLs on facebook.com?

Related Stories