Facebook has started to encrypt links to counter privacy-improving URL Stripping

https://www.ghacks.net/2022/07/17/facebook-has-started-to-encrypt-links-to-counter-privacy-improving-url-stripping/

by ColinWright • 4 years ago

399 120 4 years ago

dimitrios15• 4 years ago

Easily defeated by having a secondary server access the url, strip any remaining parameters, then returning the URL to the user. You will have to really trust your browser, however. A gambit I am willing to take. It is Facebook we are talking about, after all.

The game of cat and mouse continues.

Spivak• 4 years ago

Nobody is gonna go through that effort though, and it’s not possible to translate the params back because only the server decrypts them. This seems like the tipping point where cat wins for all but like 5 people.

I’m actually kinda surprised this hasn’t happened earlier.

dimitrios15• 4 years ago

I used to go through the effort of manually stripping tracking params out of my URLs until the browsers integrated it.

I will go through this effort until browsers integrate it, or until there is a secondary service that's easily runnable. This would just be pi-hole but for the internet instead of your local network.

stargrazer• 4 years ago

Wouldn't it just be easier to 'not use facebook'?

Bud3• 4 years ago

No. I imagine you already know why.

camkego• 4 years ago

This brings up an interesting point. If you have a secondary server do this operation as opposed to the browser, the only thing that has changed from the receiver's point of view is the source IP.

So maybe privacy protecting browsers will start to do double loads: 1. First to get the real URL 2. Next to do the browsing with the association information stripped from the URL/cookies/etc

dimitrios15• 4 years ago

Yep.

anonymoushn• 4 years ago

FB still gets to know whose shared URL is being accessed how much and when.

j0057• 4 years ago

The secondary server can cache the result, so that only the first time there's a signal to FB.

dimitrios15• 4 years ago

They will not be able to reliably tell their users if the end user landed on the page, and most importantly, specific users. They will only be able to guess. Today, the tracking mechanism works in tandem with the facebook pixels or tracking scripts on the receiving end to give full E2E campaign clarity. This will break that, or at least introduce heavy uncertainty that will definitely impact their revenue model.

rolph• 4 years ago

so instead of being able to opt out, by editing extraneous commands, face book is locking you into accepting commands with the link.

stretch that out a bit and it will fit - facebook controls your browser by infiltrating commands packed into an encrypted string.

that looks alot like what C&C servers do, the next step would be dropping a bot into users systems

kareemsabri8• 4 years ago

The ideal solution here is to stop using Facebook.

ColinWright7• 4 years ago

Regrettably, I have family members with whom I really must stay in touch, but who think that FB is the internet. No matter what I've said, what I've shown them, and what I've encouraged them to do, there is nothing to replace it.

They can post photos, statuses, chat with friends, reply to other friends' posts ... what can replace FB for them?

Nothing. So I'm forced to stay on FB.

Vile platform, no alternative.

kareemsabri8• 4 years ago

Yeah, that's fair. There's a cost. I've deleted it a couple years ago. I miss out on some stuff for sure. I have an iMessage group chat with my family as a replacement, but of course not the extended family and certainly not the more distant friends.

FrenchDevRemote• 4 years ago

What about SMS and phone calls?

It's like saying I need alcohol to stay in touch with my alcoholic friend. No you don't.

BiteCode_dev3• 4 years ago

I traveled all around the world before Facebook was a thing, and it never prevented me from keeping in touch with the people that mattered.

What you realy mean is that you value more the convenience it offers that the price to pay for using it.

root_axis• 4 years ago

Photos and statuses are nice, but not essential. Though conversely, I'd say that getting tracked online isn't really a big deal either.

jancsika• 4 years ago

Your last two sentences don't pass the smell test.

There's even graceful degradation in your set of solutions:

1. You drop FB. Now you just look on your spouse's Facebook when necessary, and your family learns to tell your spouse to show you stuff on FB. Annoying? Yes. Unworkable? No.

2. Your entire immediate family drops Facebook. At least one (if not all of you) can still communicate with the rest over text. And the rest of your family knows how to send a photo over text on an Iphone. Annoying to extended fam? Maybe. Unworkable? Definitely not. (In fact, I'd be willing to bet that it cuts out extended family spam and makes those moments of connection more meaningful.)

3. You attempt a quixotic adventure to switching your entire extended family over to some half-baked decentralized alternative to Facebook that will be usable in forever minus a day. Impossible? Yes. So choose #1 or #2 above.

ratww3• 4 years ago

My family replaced FB with WhatsApp. So have most of my friends (although with friends it's mostly Signal).

Sure, it's a completely different kind of platform, but it serves well. People post their travel pictures there, people ask random stuff and the group can discuss, we can have private discussions by clicking one name.

Sure, it's still Meta, and there's still a lot of bullshit groups, but at least I don't have to be exposed by it, nor do baby/kid pictures are exposed to the world, nor do I give money to Meta.

Of course, maybe by "Facebook" you mean "Messenger", which is more popular than it should in the US. Replacing FB with WhatsApp or Signal is possible because my family and friends are around Latin America, Europe and Asia, where nobody uses Messenger anyways.

bastardoperator• 4 years ago

So they don't understand email, phones or text messaging where people have been doing what they're doing now for years? I have some family that are like your, I shutdown my Facebook profile, and now I just call them on the phone now and we actually communicate more frequently and have better conversations.

jamiek88• 4 years ago

It’s whatsapp for me. Can’t get away from it. I tried for 3 years. I ended up basically unintentionally ostracized by family and friends.

It’s a chore for people to forward to my preferred communication method and easy to occasionally forget. Which snowballs into only hearing about events afterwards.

Eventually you basically become a weirdo with no mates.

I’m not prepared to make that sacrifice any more. I honestly gave it my best shot and still don’t use FB and Insta but have to use WhatsApp.

djmips• 4 years ago

Perhaps the best strategy is to use Facebook but never click on links. At least that solves the particular tracking that this post is about.

endorphine• 4 years ago

I've just deleted my Messenger account. Won't lie, that felt good. Good thing my friends/family from there are on the other two alternatives I use.

krupan• 4 years ago

And like all ideals, that's easier said than done

kareemsabri8• 4 years ago

Yeah most things involve tradeoffs.

Barrin922• 4 years ago

privileged solution. In many countries Facebook is the de facto communication infrastructure. They own four of the five largest communication platforms in the world.

The ideal solution is to hit them with the hammer until morale improves. Regulators need to wake up and just start fining them absurd amounts of money and keep it vague until Facebook et al. are scared enough to comply and then some.

kareemsabri8• 4 years ago

Facebook is facebook.com, that's what the article is about. I don't know what other communication platforms aside from WhatsApp you're referring to, but they aren't relevant to the discussion.

If you think it's necessary to caveat that if you rely on facebook.com as your "communication infrastructure" (not that many countries would fit that bill) then you shouldn't delete it, I'm happy to do so.

FabHK• 4 years ago

Just like the ideal solution for climate change is to stop eating meat, stop flying, stop driving, stop heating, stop air conditioning, and, for good measure, stop using computers.

Heaven forbid that we seek a political/regulatory solution.

kareemsabri8• 4 years ago

Seek whatever you like. I don't think those are comparable examples.

anigbrowl2• 4 years ago

That's like saying 'stop being poor.' I'm not personally invested in FB, but people with large extended families, businesses, political campaigns etc. don't have the option of just ignoring it.

Every HN thread about social media has one sub-thread like this, and it never produces anything of value because the premise is trite.

kareemsabri8• 4 years ago

It's not like saying that at all.

God I wonder what people with large extended families did before Facebook was invented! Surely they were all isolated and out of touch, how sad.

This comment was not directed at people running Facebook business accounts or political campaigns. The reason this thread produces nothing of value is because of pedantic comments such as yours bringing up irrelevant edge cases.

googlryas• 4 years ago

Has anyone checked if it is just a serialized+base64 encoded swift proto with the original URL?

There could be other reasons for this, but evading firefox rewriting links seems most likely - some gateways strip too-long query strings for example, but will leave the rest of the URL alone.

Volker_W• 4 years ago

some gateways strip too-long query strings for example

Uhm. What?

grishka• 4 years ago

    $ echo "0RjTS7KpBAGt9FHp5vCNmRJsnmBudyqRsPC7ovp8sh2EWFxve1Mk2HaGTKoRSuVKpl" | base64 -D | xxd
    00000000: d118 d34b b2a9 0401 adf4 51e9 e6f0 8d99  ...K......Q.....
    00000010: 126c 9e60 6e77 2a91 b0f0 bba2 fa7c b21d  .l.`nw*......|..
    00000020: 8458 5c6f 7b53 24d8 7686 4caa 114a e54a  .X\o{S$.v.L..J.J

    $ echo "AZXT7WeYMEs7icO80N5ynjE2WpFuQK61pIv4kMN-dnAz27-UrYqrkv52_hQlS_TuPd8dGUNLawATILFs55sMUJvH7SFRqb_WcD6CCOX_zYdsebOW0TWyJ9gT2vxBJPZiAaEaac_zQBShE-UEJfatT-JMQT5-bvmrLz7NlgwSeL6fGKH9oY9uepTio0BHyCmoY1A" | base64 -D | xxd
    00000000: 0195 d3ed 6798 304b 3b89 c3bc d0de 729e  ....g.0K;.....r.
    00000010: 3136 5a91 6e40 aeb5 a48b f890 c37e 7670  16Z.n@.......~vp
    00000020: 33db bf94 ad8a ab92 fe76 fe14 254b f4ee  3........v..%K..
    00000030: 3ddf 1d19 434b 6b00 1320 b16c e79b 0c50  =...CKk.. .l...P
    00000040: 9bc7 ed21 51a9 bfd6 703e 8208 e5ff cd87  ...!Q...p>......
    00000050: 6c79 b396 d135 b227 d813 dafc 4124 f662  ly...5.'....A$.b
    00000060: 01a1 1a69 cff3 4014 a113 e504 25f6 ad4f  ...i..@.....%..O
    00000070: e24c 413e 7e6e f9ab 2f3e cd96 0c12 78be  .LA>~n../>....x.
    00000080: 9f18 a1fd a18f 6e7a 94e2 a340 47c8 29a8  ......nz...@G.).

This doesn't look to me like unencrypted serialized data. Serialization would usually have some visible structure to it and possibly visible ASCII strings. Also notice that the lengths of both strings are aligned to 16 bytes — this might mean AES block encryption.

RKearney• 4 years ago

Previous Discussion: https://news.ycombinator.com/item?id=32117489

cuteboy19• 4 years ago

Amazing that they noticed it this quickly. Most people are used to see all those URLs with encoded garbage to notice this change

niutech• 4 years ago

There is a solution how to get the old Facebook post URL posted in this thread: https://news.ycombinator.com/item?id=32118095

neilv• 4 years ago

I've had background projects working on Web privacy measures since the Junkbuster days in the 1990s.

Pretty much any practical measures I've thought of, I think of (usually obvious) ways they can be countered, and assume it's only a matter of when that measure is on the adversary's radar and worth their time.

userbinator2• 4 years ago

Junkbuster --- now that's a name that takes me back! MITM proxies for filtering were far more common back then, but the "security" industry managed to scare most people out of using one, ironically causing them to only remain on corporate networks. I still use Proxomitron for this purpose.

LightG• 4 years ago

“A strange game. The only winning move is not to play.”

1vuio0pswjnm7• 4 years ago

If the author edits their post and the reader then follows the "View Edit History" URL, then the reader can see in the address bar the story_fbid= and the (author) id= URL parameters without the obfuscation.

If the reader follows the "People who reacted" URL, then the reader can see the story_fbid= and (author) id= paramaters, without obfuscation.

If the reader follows the "Comment" URL, then the reader can see the story_fbid= and (author) id= paramaters, without obfuscation.

If the reader follows the "React" URL, then the reader can see the story_fbid= and (author) id= paramters, without obfuscation.

Those are just four ways to discover the unobfuscated story_fbid number. There are probably others.

Tested with mbasic.facebook.com.

I have always stripped everything but the story_fbid and (author) id parameters when sharing URLs pointing to posts on Facebook. Anything else in the URL is unnecessary. On the desktop/laptop/RPi, this stripping can be automated using a localhost forward proxy.

Another issue that seems to fly under the radar with Facebook users is the prefixing and proxying of external URLs with https://lm.facebook.com/l.php?u=.

darkstar999• 4 years ago

What about it? They end up at the same url.

plorg• 4 years ago

I haven't used Facebook in quite a while, but when I did I had a set of userscripts to defuse this tracking. It worked similarly to Google link stripping, by defusing the JavaScript that rewrote the link between the time you clicked it and when your browser opened it. Initially I built it because the free wireless internet in my apartment was unreliable and the redirects could be enough to prevent a page from opening. My method was pretty blunt - I removed element entities that held the target URL, and that broke the listener function. A later iteration would actually unset the listener event. This all worked because it seemed important to FB that you be able to see where the link would take you (e.g. by hovering). I wouldn't be surprised if Facebook's paternalism (and Google's for that matter, but I haven't seen it from them, though I mainly use DDG now) now led them to add this "protection" directly to links as they're served up. I can't tell from the article whether that's the case, and at this point I'm not going to log in to FB to figure it out.

userbinator2• 4 years ago

IMHO this was totally expected and is an argument for "browser neutrality" --- I believe a browser shouldn't be doing this or many other things by default.

Modifying URLs and filtering page content should be the responsibility of extensions and the like. I personally use a filtering proxy.

cypress66• 4 years ago

Firefox is not doing this by default I'm pretty sure

jefftk2• 4 years ago

My understanding is that Firefox, and eventually all the other browsers, intend to do something like this by default. They are all working to prevent cross site tracking, linking your activity on one site to your activity on another. For example, Chrome has: "In parallel to that we will aggressively combat the current techniques for non-cookie based cross-site tracking, such as fingerprinting, cache inspection, link decoration, network tracking and Personally Identifying Information (PII) joins." -- https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

WorldMaker• 4 years ago

Though "Enhanced Tracking Protection" is easy to opt-in.

AinderS• 4 years ago

Since there's zero chance that websites and ad companies will stop their spying and manipulation (let's call it "webpage neutrality"), what you're proposing is unilateral disarmament. To require a lot of know-how and tech savvy to get privacy, while leaving the common user to the mercy of a hostile web.

This is like the argument that the Do Not Track flag was illegitimate if the browser defaulted it to 'on'. An argument that is never applied to tracking or the countless "by visiting this webpage you consent to.."

ev1• 4 years ago

This is opt in, not enabled by default, and requires you to intentionally pick 'Strict' which has a warning as its first line of text that says some sites may break.

int_19h2• 4 years ago

Why can't I as a user have a browser that's privacy-enabled out of the box without any extensions?

Bud3• 4 years ago

It's called Safari.

agluszak2• 4 years ago

That should be illegal.

doodlesdev• 4 years ago

No it shouldn't. It's unethical, sure, but the correct way to fight this is to not give money (or your time) to companies that engage in these behaviors.

agluszak2• 4 years ago

At this point it is barely possible to ignore Facebook (Twitter, Instagram etc. also). I'm a great proponent of the fediverse, but FB without regulation will simply eat all the ethical alternatives.

int_19h2• 4 years ago

The company we're talking about here is, if not an outright monopoly, a dominant market player that actively abuses their dominance to the detriment of both competitors and customers. The correct way to fight that is to make such a thing not exist anymore.

Dylan168074• 4 years ago

A test: if it was illegal by default, would there be a reason to make it legal?

squarefoot• 4 years ago

Aside stopping the use of Facebook, which of course is the best solution but not doable for many, the AdNauseam (.io, browser extension) approach to pollute their tracking data might be inspirational. The gist is: can't eliminate ad links? Then have an app "click" all of them randomly so that counters become irrelevant. So there is this link that identifies user X?, well then write an extension that distributes and "clicks" it around on say 1000 other machines in a p2p way so that it becomes meaningless.

I have no idea if it's doable in this FB context, but usually when links can't be anonymized, the next move is to make them produce irrelevant data by adding noise.

im3w1l• 4 years ago

For many years I was against AdNauseam, as by my reckoning it would be counterproductive and just end up hurting the the most privacy and freedom oriented voices, but now that Facebook is upping the stakes it's starting to seem like a reasonable countermeasure.

zozbot234• 4 years ago

Aside stopping the use of Facebook, which of course is the best solution but not doable for many

But quite doable for a content provider like Ghacks. Users should be able to share links to web content in a way that does not create privacy risks, and this whole URI encryption business makes that quite a bit harder.

matthewfcarlson• 4 years ago

When you can't get rid of signal, add noise.

gruez2• 4 years ago

the AdNauseam (.io, browser extension) approach to pollute their tracking data might be inspirational. The gist is: can't eliminate ad links? Then have an app "click" all of them randomly so that counters become irrelevant. So there is this link that identifies user X?, well then write an extension that distributes and "clicks" it around on say 1000 other machines in a p2p way so that it becomes meaningless.

Except if you look at the documentation for AdNauseam, their fake click technique seems trivially filterable. The fake clicks are made as XHR requests, so all you have to do is look at the appropriate headers to filter them out. At best the only adtech companies that are getting fooled by this are upstarts that haven't added fraud detection yet.

https://github.com/dhowe/adnauseam/wiki/FAQ#how-does-adnause...

Klonoar• 4 years ago

Unless I'm missing something, headers here can also be set to appear as another request type.

(And to be clear - I could be missing something. Does the browser allow replacing e.g Sec-* headers on XHR requests?)

summerlight• 4 years ago

I guess this kind of efforts will be largely mitigated by the existing fraud detection systems. You'll probably need to devise much more sophisticated attacks to achieve such goal. And the attack should be also economical, which makes it a really challenging problem against FB-level targets.

dang• 4 years ago

Recent and related:

Ask HN: What is with the new URLs on facebook.com? - https://news.ycombinator.com/item?id=32117489 - July 2022 (249 comments)

2-718-281-828• 4 years ago

considering that FB did and does serve a purpose beyond meaninglessly scrolling through your timeline and liking pictures - f.x. organising and advertising events or managing group interactions. is there a new FB - something that could replace it or maybe even did? I'm off FB now for about six years but sometimes I wonder if I'm missing out sometimes. I really don't want to move back in.

knife1nhead• 4 years ago

Same sentiments here. I have heard that the marketplace is great for selling second hand goods locally. But I still think the benefits of not being on facebook outweigh what I'm missing out but curious on reevaluating my stance.

nonrandomstring2• 4 years ago

Replace the word "facebook" with "alcohol" or "heroin" and re-read every comment in this thread. We have a real problem, don't we?

salawat• 4 years ago

No stuff. I'm beginning to wonder whether I want to even work in the tech sector anymore. Nothing but exploitation.

Kaze404• 4 years ago

It’s interesting because the (in my opinion valid) comments of “but I have friends and family that I can only contact through Facebook” also somewhat translate to that analogy. It’s not uncommon to hear stories of people who quit drinking for example and soon after lose all their friends because their friendship really only existed in contexts where alcohol is present (maybe even mandatory to some extent).

nonrandomstring2• 4 years ago

It’s not uncommon to hear stories of people who quit drinking for example and soon after lose all their friends

And (crucially) then go back to drinking.

Human attachment patterns are a primary factor in dependency problems. Addicts get into groups who mutually support each other's habit. Leaving the drug means leaving the only group who "understand" you. It's the same for cults. There's a chapter on this in Digital Vegan. Social media companies shamelessly and aggressively leverage that psychology.

SnowHill9902• 4 years ago

It can be subverted: make Firefox touch the “encrypted” URL to see what it links to, then serve the cleartext URL.

jefftk2• 4 years ago

That still gets them their cross-site analytics, since the encrypted URL is only accessed when you're visiting the page.

askvictor• 4 years ago

Depends on how many URLs on are on the page; if there are 20 (encrypted) urls, and the browser touches each of them, but the user only follows one of them, the data FB gets is much less useful.

mihaic3• 4 years ago

I would love to stop using Facebook, Instagram or Whatsapp, but I would really need to criple my social life if I'd give up on any of these. And I'm not even a very active person, it's just that so many people I want to engage with have a huge chunk of their lives tied to one of these.

I can't understand the people saying there is a free market choice here, this can only be solved with simple regulation that targest large platforms.

If the SEC can use its judgement on what constitutes a security, than we can have a social media comission to oversee Facebook.

peterkelly• 4 years ago

If someone is important enough in your life, you'll both find ways to make it work.

The mental health benefits of leaving Facebook are worth it.

ptudan• 4 years ago

I think one thing this discounts is that you form loose connections and sometimes those loose connections become stronger later.

If you have a friend of a friend who you add on socials, and then you see their updates, and then you see them at a mutual party, despite not being well acquainted you are reasonably up to date with their lives. This can make the conversation flow better and you may form a meaningful connection.

aembleton• 4 years ago

What about a local running group that organises everything through Facebook?

discardable_dan• 4 years ago

Out of curiosity, do you use Google for search?

mihaic3• 4 years ago

I use mostly Duckduckgo for search, Google when in desperation (once per week probably).

parkingrift• 4 years ago

You could try calling them or seeing them in person. If they refuse to interact with you unless it’s documented on Facebook are they really people worth interacting with?

mihaic3• 4 years ago

Arguably for 1-on-1 relationships, but even then it would mean losing some not so close friends, that I still enjoy seeing once every 1-2 years.

But at times it's impossible in practice: my friends will create Whatsapp groups for instance to plan vacations/batchelor parties/random events, and I need to use that if I want any meaningful involvment in the event.

I've sometimes been passive and just showed up, but I'm losing a part of the shared experience.

ansh_nanda• 4 years ago

I had this same problem so I made an app that allows me to use Instagram without using the Instagram app. It also blocks ads + suggest posts, removes all tracking, removes read receipts in DMs and when viewing stories, and also allows me to create custom feeds like Twitter lists.

Turns out a lot of people had this problem, so I made it into a company.

I don't want to blatantly advertise but let me know if you'd like me to link the website.

Cameri• 4 years ago

Firefox and Brave should warn the user that they are going to be tracked by accessing URLs like these if tracking protection is enabled.

klabb3• 4 years ago

At this point a full-screen spyware warning with the only option to continue being a tiny "allow once/i know what I'm doing" would be appropriate. The lengths these companies go to to map your every move is beyond comprehension. And sure, there are bad actors and there always will be, but that they're the biggest companies in the world with a top notch reputation, in most circles, is absolutely insane.

theden• 4 years ago

The irony of now fb having more encryption in their URLs than a standard .onion URL...

_nhynes2• 4 years ago

You will please forgive me for being pedantic, but an onion URL contains no encryption. Per the spec [0]:

    onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion"
    CHECKSUM = H(".onion checksum" | PUBKEY | VERSION)[:2]

[0]: https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.... (section 6)

Dylan168074• 4 years ago

Public keys count as encryption to me.

prezjordan• 4 years ago

Weird to think someone (or a team, really) built this. Why?

FateOfNations2• 4 years ago

Because the cross site referral data is valuable to the company.

shmerl• 4 years ago

This should be illegal.

aqfamnzc2• 4 years ago

I've always assumed that "shortened" shared links that things like the youtube app provides do something similar - no way to remove a tracking param when you have something like `https://youtu.be/KLEH8RJsYg`.

DoctorOW• 4 years ago

Except the only tracking info the YouTube shortener adds is the referrer.

https://youtu.be/KLEH8RJsYg => https://www.youtube.com/watch?v=KLEH8RJsYg&feature=youtu.be

The only data in that short url is the unencrypted YouTube video ID

aqfamnzc2• 4 years ago

Could you explain how one would go about determining what you explained here? Is the "KLE..." part of the shortened URL just compressed somehow and you can decompress it? I guess I always assumed the browser just requested the shortened url and the black-box google server opaquely serves up the destination page, allowing it to do whatever with the (I assumed, incorrectly it would seem) unique string in the URL. Unique to the user sharing and video being shared, I mean.

mouzogu• 4 years ago

simple solution would be to stop using FB.

i feel the majority of fb audience probably don't care about this enough to change their habits.

Facebook has started to encrypt links to counter privacy-improving URL Stripping

Related Stories