Stop adding email tracking links to phone numbers(shkspr.mobi)
shkspr.mobi
Stop adding email tracking links to phone numbers
https://shkspr.mobi/blog/2020/02/stop-adding-email-tracking-links-to-phone-numbers/
14 comments
Clickbait title that implies that tracking links are commonly added to phone numbers, while there's probably just that one bug he noticed.
[deleted]
From one of the comments, this FF add on rewrites links to remove tracking parameters:
https://addons.mozilla.org/en-GB/firefox/addon/remove-fbclid...
Too bad ssl makes it hard to this at the router level (similarly to Pi Hole, but for HTTPS, not DNS).
https://addons.mozilla.org/en-GB/firefox/addon/remove-fbclid...
Too bad ssl makes it hard to this at the router level (similarly to Pi Hole, but for HTTPS, not DNS).
There's this addon as well that Firefox marks as "recommended", for whatever reassurance that may give you:
https://addons.mozilla.org/en-GB/firefox/addon/clearurls/?sr...
"Recommended extensions are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status."
https://support.mozilla.org/en-US/kb/recommended-extensions-...
(presumably any extension like this has access to every URL you visit, which is enough to give me pause)
https://addons.mozilla.org/en-GB/firefox/addon/clearurls/?sr...
"Recommended extensions are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status."
https://support.mozilla.org/en-US/kb/recommended-extensions-...
(presumably any extension like this has access to every URL you visit, which is enough to give me pause)
Thank you for the recommendation! This will add some peace of mind.
It requires all kinds of weird permissions, which also gives me pause. I'll trust it because it's recommended, but ... why does it want access to all data on every website?
How else would it rewrite links on every website?
It just has to modify the links you follow. You could get most of the way with a regex in the URL bar.
I'm not sure about FF internals, but if you want to stop the tracker bits from being sent, doing in the URL bar might be after the link gets sent to the server, in which case they still get the tracking info.
So you need to rewrite it before it gets clicked.
So you need to rewrite it before it gets clicked.
Not really, just make your own CA and run squid.
Please do not do this. The previous comment does not take into account the huge security hole you're creating by doing this, in particular the importance of ensuring that whatever hosts you're signing certificates from does not get compromised, and the risk to things like online banking and online payments caused by your own personal MITM host being compromised.
As frustrating as tracking on the internet may be, you'll be a lot more resentful of your bank when they outright refuse to refund you any of your money, when it becomes clear that you opted to MITM your traffic, and your MITM host got compromised, resulting in the theft of your banking credentials.
There are many reasons why you should MITM your hosts, and there are many reasons why companies Bluecoat make large sums of money providing solutions to this problem. It is not a trivial problem and solution. In a much simpler space, "just run an FTP server" does not encompass what Dropbox does.
As frustrating as tracking on the internet may be, you'll be a lot more resentful of your bank when they outright refuse to refund you any of your money, when it becomes clear that you opted to MITM your traffic, and your MITM host got compromised, resulting in the theft of your banking credentials.
There are many reasons why you should MITM your hosts, and there are many reasons why companies Bluecoat make large sums of money providing solutions to this problem. It is not a trivial problem and solution. In a much simpler space, "just run an FTP server" does not encompass what Dropbox does.
> There are many reasons why you should MITM your hosts
Which is why I do it, although I didn't start until DoH came around. Your comments are very well taken, though -- doing this certainly does bring an entirely new collection of problems with it.
But for some people (at least, for me), the cost/benefit of properly implementing a MITM is lower than the cost/benefit of remaining vulnerable to marketers and other tracking ne'er-do-wells.
Which is why I do it, although I didn't start until DoH came around. Your comments are very well taken, though -- doing this certainly does bring an entirely new collection of problems with it.
But for some people (at least, for me), the cost/benefit of properly implementing a MITM is lower than the cost/benefit of remaining vulnerable to marketers and other tracking ne'er-do-wells.
You also have to make sure the machine your browsing from isn’t compromised.
IMO it changes very little unless you’re living with other people.
IMO it changes very little unless you’re living with other people.
From a technical perspective, I agree with both of your points.
From the perspective of dealing with my bank, my desktop being compromised by malware that results in bad things on my bank account, is something that could happen to a large number of their other customers. There will be policies in place, and there is a stronger defence that the money was stolen, and not that I was negligent in my security practices.
In the event that I opted to break the end to end encryption between my browser and their server with my own middleware, it will be argued that I am technically competent to manage my IT security properly, and that the bank cannot be faulted for my failures. They could try this defence on the first instance too, but given that one scenario impacts everyone, and the other only impacts people who have declared that they know better, I don't expect much sympathy for the latter group.
From the perspective of dealing with my bank, my desktop being compromised by malware that results in bad things on my bank account, is something that could happen to a large number of their other customers. There will be policies in place, and there is a stronger defence that the money was stolen, and not that I was negligent in my security practices.
In the event that I opted to break the end to end encryption between my browser and their server with my own middleware, it will be argued that I am technically competent to manage my IT security properly, and that the bank cannot be faulted for my failures. They could try this defence on the first instance too, but given that one scenario impacts everyone, and the other only impacts people who have declared that they know better, I don't expect much sympathy for the latter group.
[deleted]
Tracking links are why I never just click on links anymore. I copy/paste them so I can edit out the spying nonsense.
There are extensions that can help with this. First google result: https://chrome.google.com/webstore/detail/tracking-token-str...
Hooks into chrome.webRequest.onBeforeRequest.addListener(...) to rewrite the request url at request time.
Hooks into chrome.webRequest.onBeforeRequest.addListener(...) to rewrite the request url at request time.
For Firefox, I've been using the ClearURLs add-on.
https://gitlab.com/KevinRoebert/ClearUrls
Edit: Looks like it's available for Chrome as well.
https://gitlab.com/KevinRoebert/ClearUrls
Edit: Looks like it's available for Chrome as well.
Block trackers and the problem goes away. Very few companies track these types of links on the server, it's all easy to block front end JS.
For use cases where one wants to track calls, length or connection, the better way to do this is the click-to-call approach.
Have a button that says, "Call Me". If you have the user's number place a call to them and connect it to the destination number. If you don't have the user's number then collect it before placing the call.
There are much better tracking benefits and data collection for phone numbers.
If one is doing marketing and wants a person to call, there usually isn't much of a difference in conversion rate between a call to action like "Call 800-555-1212" and a form that will call you.
Source: An employer powered a metric shit-ton of advocacy call campaigns - like the STOP SOPA & PIPA stuff that took over the internet a few years ago.
Have a button that says, "Call Me". If you have the user's number place a call to them and connect it to the destination number. If you don't have the user's number then collect it before placing the call.
There are much better tracking benefits and data collection for phone numbers.
If one is doing marketing and wants a person to call, there usually isn't much of a difference in conversion rate between a call to action like "Call 800-555-1212" and a form that will call you.
Source: An employer powered a metric shit-ton of advocacy call campaigns - like the STOP SOPA & PIPA stuff that took over the internet a few years ago.
Is this common? Or is this a bunch of folks "doing it wrong" and not really getting anything out of it anyway?
It's most likely a bug. Some dev added tracking to all the href's and just didn't think about phone numbers.
The title of the article sounds like they did it on purpose, which i doubt.
I'd argue that it is not a bug - it is a wrong assumption (that all URLs are http/https) based on limited experience.
With a typical bug code works not as author intended it to work. Numbers of such bugs can be reduced by testing and better tooling. But software development as an industry creates incentive to be overconfident and not to question own assumptions: developers who don't stop to read documentation/standards/gather information in anther way deliver more features in less time.
With a typical bug code works not as author intended it to work. Numbers of such bugs can be reduced by testing and better tooling. But software development as an industry creates incentive to be overconfident and not to question own assumptions: developers who don't stop to read documentation/standards/gather information in anther way deliver more features in less time.
Yeah that's what it seems like to me. Just a case of doing it wrong.
It's a process breakdown, either manual or automated. Marketing teams tend to use a tagging worksheet like this[1] when creating new emails. They're just told to put all links through that process, and the topic of tel links don't really come up. I've handed off dozens of link generators like that to marketing and account management folks, and never thoguht to add any checking for tel links in the logic or to surface that edge case in the instructions.
So if they're going through the motions they were told to, but don't fully understand why (and don't QA properly) this is what you end up with.
Could also be a system using the same logic of surfacing every <a> tag link for tagging before deployment (based on the utm names, there's at least some type of semantic logic to the naming that indicates a person was involved at some level and knew it was a phone number they were tagging).
[1] https://docs.google.com/spreadsheets/d/1xDl9GdpuWB9kzXzWxKj3...
So if they're going through the motions they were told to, but don't fully understand why (and don't QA properly) this is what you end up with.
Could also be a system using the same logic of surfacing every <a> tag link for tagging before deployment (based on the utm names, there's at least some type of semantic logic to the naming that indicates a person was involved at some level and knew it was a phone number they were tagging).
[1] https://docs.google.com/spreadsheets/d/1xDl9GdpuWB9kzXzWxKj3...
To add to the parent: Most major marketing automation and email marketing tools are going to add these links automatically in the email builder.
Most WYSIWYG email builders built into these tools are pretty painful to begin with, and especially so when content with links is copied from one tool to another. (Think of the poor marketing person being given various blurbs in Word, Gmail, etc. and told to make a functional email out of them while having to use a shitty WYSIWYG.)
Beyond that, most marketers I know have absolutely zero input into what email platform they use. Many organizations are stuck using antiquated, broken tools (I'm looking squarely at you, Eloqua) because of complex existing integrations they have set up.
I don't see this changing any time soon. Few marketing orgs have the IT budget and/or on-staff knowhow to fix this problem. Nor are they likely to be aware of it. Nor, for that matter, are they likely to prioritize it over the many more pressing things they could be fixing that more directly affect revenue.
Most WYSIWYG email builders built into these tools are pretty painful to begin with, and especially so when content with links is copied from one tool to another. (Think of the poor marketing person being given various blurbs in Word, Gmail, etc. and told to make a functional email out of them while having to use a shitty WYSIWYG.)
Beyond that, most marketers I know have absolutely zero input into what email platform they use. Many organizations are stuck using antiquated, broken tools (I'm looking squarely at you, Eloqua) because of complex existing integrations they have set up.
I don't see this changing any time soon. Few marketing orgs have the IT budget and/or on-staff knowhow to fix this problem. Nor are they likely to be aware of it. Nor, for that matter, are they likely to prioritize it over the many more pressing things they could be fixing that more directly affect revenue.
> So, if you're writing link tracking software, please make sure only to add parameter to URls where it makes sense.
Also take a moment to consider if you to track what links people are clicking on at all.
Also take a moment to consider if you to track what links people are clicking on at all.
Internally at least I like to know how the web apps I write are being used.
Like if the first thing everyone does is open their "messages" ... maybe give them an option to just do that automatically.
Send that info to a third party ... no I'm not down with that.
Like if the first thing everyone does is open their "messages" ... maybe give them an option to just do that automatically.
Send that info to a third party ... no I'm not down with that.
So just look at the logs? Why is tracking link crap required?
I'm not sure it is "required".... depending on what you're talking about.
I was speaking more generally about what folks think of as "tracking" being a really wide topic that can involve totally innocuous "tracking" that is actually to their benefit, and far worse that is more of a dark pattern.
I was speaking more generally about what folks think of as "tracking" being a really wide topic that can involve totally innocuous "tracking" that is actually to their benefit, and far worse that is more of a dark pattern.
True. But tracking is so common and so widely abused that I think it's entirely reasonable to take the stance of blocking it all anyway.
if you want to track whether people are clicking on links, utm parameters are the wrong tool. since they're url parameters, they they really only work for internal links. if you want to track all links, you need to resort to onclick handlers + xhr/fetch or beacons.
I think you have it backwards.
utm parameters are generally for any time you control the url on a foreign site. You want to know that this variant of this ad on this website got this many clicks.
utm parameters are generally for any time you control the url on a foreign site. You want to know that this variant of this ad on this website got this many clicks.
Is there another example of a company doing this? The title seems to imply that this is a widespread problem.
As a marketer in a former life, I can't understand why somebody would do this. It's very cheap to get a separate phone number for each inbound channel and there's tons of software that will track which channels are working for you, starting at the low end with an intern and Excel.
It's just a bug. Somebody made a script that appends tracking codes to every <a href=".."> in the document.
For non-marketers here: you aren’t supposed to use utms for internal links anyways. Doing so will break your analytics and there are ways to track button/link clicks without utms.
Maybe just stop adding tracking links altogether.
Damn, you were faster. I was gonna write: "I can shorten the title: Stop tracking."
[deleted]
[deleted]
shhh.. if they figure it out they'll start to provision single use numbers (or LRU style churning) to track specific behaviors.
I would argue that it's your phone that is in the wrong. The dialer should know that a `?` is not a valid DTMF tone, and strip all invalid characters.
There are plenty of use-cases where having tracking metadata is useful. I can't think of a single one where having a dialer interpret a `?` is.
There are plenty of use-cases where having tracking metadata is useful. I can't think of a single one where having a dialer interpret a `?` is.
As the article says, the standard for tel: urls specifically forbids the behavior you’re describing.