Prevent tracking based on link decoration via query string or fragment #4239
Comments
rebron
added
the
privacy/tracking
|
@snyderp found a comprehensive list of tracking parameters in https://greasyfork.org/en/scripts/10096-general-url-cleaner. |
|
A couple of questions / comments, only focusing on link decoration:
I could be missing something, but here are the reasons why I am asking:
Of course, not trying to talk anyone into not providing better tracking protection, but the above items came to mind and I want to check in here to see if they were being factored in for potential impact. |
|
@lukemulks the suggestion is not to remove all query string params, just those used specifically for tracking purposes. The ones in the link above would be a good starting point, but the list could grow or shrink depending on our boldness, measurement results, etc. So the worry is less FWIW, the Safari ITP approach is to block all query params set by known / labeled tracking domains. So in some senses more aggressive, some senses less. So I think the suggestion would steer clear of the concerns you mentioned, and that if we interfered with the use cases you mentioned, that'd be in most (if not all) cases a bug. WDYT? |
tildelowengrimm
added
the
priority/P4
tildelowengrimm
added
priority/P3
|
I'm so late in the game on this thread @snyderp, apologies; to answer your question, it sounds good to me. Thank you for addressing the concerns, and explaining the context clearly in your response. |
…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports
…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports
…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. We essentially apply the following to the query string: s/&(fbclid|gclid|msclkid|mc_eid)=[^&]+//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+&//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+$//g https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports
…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. We essentially apply the following to the query string: s/&(fbclid|gclid|msclkid|mc_eid)=[^&]+//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+&//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+$//g https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports
…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. We essentially apply the following to the query string: s/&(fbclid|gclid|msclkid|mc_eid)=[^&]+//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+&//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+$//g https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports
…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. We essentially apply the following to the query string: s/&(fbclid|gclid|msclkid|mc_eid)=[^&]+//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+&//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+$//g https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports
|
This is an often-overlooked form of tracking, so good job deciding to add this to the browser! At any case, if you wish to actually implement a solution for the type of tracking in this Issue's title for real, as was alluded to in this thread, many solutions exist that are comprehensive (for example, the ClearURLs extension for Chrome/Firefox, and their code or lists of used parameter filters are publicly viewable. |
|
@Vagmer gotta crawl before you walk ;) We're addressing what seem to be the heaviest hitters now, and can scale up as we gain confidence we're not busting things for users. That additional set of tracking-related query parameters looks very interesting, thank you for linking! From eyeballing though, it looks like at least some may be used for purely 1p purposes, which we don't target. More generally though, this list seems to address a site tracking a user, once the user lands on that site (e.g. how a user got to amazon.com), when the bigger concern (from our end) is people using query parameters to track users across a large portion on the web (e.g. social embeds and similar getting known query params across all sites). Do you know if there is a similar, expanded list that targets that second problem? |
Oh, definitely makes sense. I can understand and agree with that approach, it just struck me that both the immediate closure of this issue and the (inaccurate) inclusion of this as a general feature in the release notes seem to signal that this was considered done with.
That extension and its rules are expansive and they fulfill more than a singular purpose that fits under cleaning URLs, so that wouldn't be surprising... It strips various tracking parameters, other "junk" or extraneous parameters, even skips intermediate redirection URLs/pages, etc... It also endeavors to include exclusions or otherwise shape rules to avoid the rare associated breakage. Personally, I've faced no issues with it, though occasionally such breakages are fixed after user reports.
That list includes the ubiquitous ones as well (such as |
|
Is this configurable by Shields or enabled for everyone? |
|
FWIW I think this behaviour should be disabled when shields are down for a site. |
@Bonemeijer Have you found any breakage related to this? "Shields down" is an webcompat-related toggle and I'm not aware of any compatibility problems with this protection. |
|
If not anything else, it could confuse web developers using Brave. |
|
@fmarier I noticed that for sites which I'm working on, Brave removes You can try it yourself by
Now, this might be expected behaviour according to how it is programmed. But as an end-user, I would expect that the "shields down" functionality for a location would halt any blocking that might be done for that specific location. As an end-user who is also a webdeveloper I might even expect Brave sending it's own user-agent string. |
|
Not all of Brave's protections can be disabled via Shields. If we determine that a protection doesn't have any negative impact on our users, we don't necessarily provide a toggle. I can see how it can be surprising for developers who aren't expecting this behavior. Tying this feature to the toggle is certainly something we would consider for this feature if we discovered problems affecting our users. |
|
Sounds fair enough. Without knowing the full philosophy and background of the Brave project, as an end user I would expect that "shields down" means "I trust this site, allow them to show ads and gather statistics". And I would expect any alterations to the url or querystring would be included in that. Now I know of the behaviour, I know I have to work around it by using another browser. But it did have me chasing my own tail for a minute. |
|
Is there no way to disable this? I'm trying out Brave as a replacement to Chrome for my web development work, but just ran into the issue of |
|
@jdahdah Can you describe your use-case? |
|
@fmarier Being able to read the |
|
Thanks for expanding on your use case. I've filed #13242 to track this. The fact that it's been requested more than once suggests that many more developers are likely to want this too. |
|
is possible to find to msclkid in bing ads |
You'll still see a |
|
Any python api to find msclkid in bing ads |
ITP 2.2 is reducing the lifetime of cookies set via
document.cookiewhen the navigation came from a tracking-enabled page and the destination URL includes query string parameters or a fragment: https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/We already block the third-party scripts that would be extracting these IDs and setting a first-party tracking cookie, but we could in theory go further by:
gclid,fbclid,msclkidandmc_eid).The text was updated successfully, but these errors were encountered: