{"id":24877,"date":"2019-04-04T16:19:49","date_gmt":"2019-04-04T20:19:49","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=24877"},"modified":"2019-04-24T17:22:33","modified_gmt":"2019-04-24T21:22:33","slug":"safari-link-tracking-can-no-longer-be-disabled","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2019\/04\/04\/safari-link-tracking-can-no-longer-be-disabled\/","title":{"rendered":"Safari Link Tracking Can No Longer Be Disabled"},"content":{"rendered":"

Jeff Johnson<\/a> (tweet<\/a>):<\/p>\n

Notice that when you hover over the “Ping Me” link, you only see the href<\/code> URL, you don’t see the ping<\/code> URL, so you don’t even know that the attribute exists unless you look at the HTML page source. When you click the link, it loads the page http:\/\/lapcatsoftware.com\/<\/code> as expected. But it also sends an HTTP POST request to http:\/\/underpassapp.com\/<\/code> without any visible indication to the user. You can only see it if you do a packet trace. It should come as no surprise that the primary usage of hyperlink auditing is for tracking of link clicks.<\/p>

[…]<\/p>

Apple shipped Safari 12.1 last week to the public with no way to disable hyperlink auditing. I hope to raise awareness about this issue, with the ultimate goal of getting hyperlink auditing disabled by default in Safari. Apple claims that Safari is supposed to protect your privacy and prevent cross-site tracking, but hyperlink auditing is a wide open door to cross-site tracking that still exists.<\/p><\/blockquote>\n

Eric Jacobsen<\/a>:<\/p>\n

\n

If anyone is curious why this attribute was introduced: it’s supposed to be an alternative to those chains of redirects that publishers often put in front of outbound links.<\/p>\n

User gets a direct link to destination instead of redirects (good), publishers and advertisers still get their data async (creepy, but arguably better than the alternative)<\/p>\n

Imo is fine as long as there’s an opt-out, which chrome and ff have but oddly Safari just dropped.<\/p>\n<\/blockquote>\n\n

Is Apple’s reasoning that making it an option would prevent sites from using ping<\/code>? It’s better to have access to the real URL with a compulsory ping<\/code> than to be forced to use a redirect chain that’s slower and no more private.<\/p>\n\n

Previously:<\/p>\n