Monday, July 18, 2022

Facebook Encrypting Links to Prevent URL Stripping

Bruce Schneier:

Some sites, including Facebook, add parameters to the web address for tracking purposes. These parameters have no functionality that is relevant to the user, but sites rely on them to track users across pages and properties.

Martin Brinkmann:

Mozilla introduced support for URL stripping in Firefox 102, which it launched in June 2022. Firefox removes tracking parameters from web addresses automatically, but only in private browsing mode or when the browser’s Tracking Protection feature is set to strict. Firefox users may enable URL stripping in all Firefox modes, but this requires manual configuration. Brave Browser strips known tracking parameters from web addresses as well.


Facebook could have changed the scheme that it is using, but this would have given Facebook only temporary recourse. It appears that Facebook is using encryption now to track users.


The main issue here is that there it is no longer possible to remove the tracking part of the URL, as Facebook merged it with part of the required web address.


Comments RSS · Twitter

Leave a Comment