Hacker News new | ask | show | jobs
by EE84M3i 1830 days ago
>In those cases where the destination URL is embedded into a tracking link, it’s possible to avoid tracking by decoding the destination URL and navigating to it directly. This is true for ConvertKit and could be true for Mailgun retailers like Substack (when or if I eventually work out the decoding).

What stops a tracking link from using a different url in the get params than it actually returns? I don't think this is workable.

2 comments

Exactly? I mean, let's say a link was:

https://mycompany.co/my-product-name?affiliate=12345678

That's obvious and easy to filter out, but let's say they changed it to:

https://myproduct.co/my-product-name/12345678

That's less obvious because it's part of the URL to resolve instead of a variable. You could filter out the "12345678" now to instead direct you to:

https://mycompany.co/my-product-name

OK, but let's say the company (through plausible deniability) didn't use permalinks, or (again through plausible deniability) used model numbers as their address. They could disguise the tracking link with

https://mycompany.co/12345678

Which could again be detected, but then you'd just get sent to

https://mycompany.co/

instead of the actual page you wanted to visit.

The point is, that if you try to filter out affiliate links, you will invariably get to a point where all you can do is send them to the homepage of the website in this cat-and-mouse game of disguising affiliate links as product pages. And while sending you to the homepage is theoretically completely private, I think marketing folks and actual end-users would understandably complain.

Wouldn't something like https://example.com/correct/horse/battery/staple look like a real link and be very trackable?

Or even, https://correct.horse.battery.staple.example.com/

I mean, you could add rules, but the second your rules turns something like Slacks "magic link" into a thing that can't be used, users will rightfully be upset.

Nothing in theory, but he has shown what they do today.

The problem here is that it will probably work on a small scale. But if someone like Apple or Google adjusted to it, places like MailChimp would notice immediately, and "fix the glitch" as you describe.