[HN Gopher] Google Docs adds tracking to links in document exports
       ___________________________________________________________________
        
       Google Docs adds tracking to links in document exports
        
       Author : riffraff
       Score  : 331 points
       Date   : 2023-10-05 09:21 UTC (13 hours ago)
        
 (HTM) web link (fosstodon.org)
 (TXT) w3m dump (fosstodon.org)
        
       | shortformblog wrote:
       | This post really highlights what happens when a user with a set
       | bias against a company notices a common feature and presumes the
       | worst of that company by default.
        
       | DeathArrow wrote:
       | I like that when I sit on toilet surfing the web, Google likes to
       | oblige and shows me ads to all kinds of toilet paper. It's great
       | to have a big brother, even if you were born without one.
        
       | lern_too_spel wrote:
       | This has been there from the start. It's to hide the referer from
       | the page you land on. It used to be standard practice for anyone
       | writing a web application to avoid inadvertently leaking user
       | information in the referer header. There are better ways to do
       | this if the user is on a modern browser.
       | https://duckduckgo.com/duckduckgo-help-pages/results/rduckdu...
        
         | hackideiomat wrote:
         | Referrer-Policy is such a way
         | 
         | https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
        
       | tamimio wrote:
       | I don't think anyone is using any google products should still be
       | concerned about privacy or tracking their activities, it's like
       | using Facebook, these companies business is built around mining
       | your/users data, stop using them.
        
       | londons_explore wrote:
       | This is because google docs is now widely used as a malware
       | vector.
       | 
       | Send the user to a google docs page, and because it is on the
       | google domain it is trusted by corporate firewalls and AV
       | scanners.
       | 
       | The 'tracking' is in fact this page:
       | 
       | https://www.google.com/url?q=https://wikimediafoundation.org...
       | 
       | And that alerts the user to the fact they are leaving google and
       | ending up on another site - which hopefully reduces the
       | effectiveness of using google docs to distribute malware.
        
         | hackideiomat wrote:
         | You can implement this without tracking?
        
         | hn_throwaway_99 wrote:
         | But I had my pitchfork out and everything...
         | 
         | Seriously, 9 times out of 10 when I see stuff like this, I'm
         | happy I can go to the HN comments and see what the real deal
         | is. I don't think Google deserves a free pass in their
         | decisions, and lots of times I see them push things for "user
         | safety" or "better user experience", oh and oh yeah it also
         | happens to allow Google to better track you. But still, Google
         | has tons of competing issues they need to balance, and I loath
         | it when people pretend like _their_ need is the only one that
         | matters.
         | 
         | It's like the debate over Google requiring 2FA for logins.
         | "People losing their 2FA device" is a valid concern, but so is
         | the 10 or 100x the people who get hacked with bad passwords.
         | Not arguing there is a single solution, but you can't argue in
         | good faith by pretending the problem Google is trying to
         | address doesn't exist.
        
           | tomjakubowski wrote:
           | Unfortunately in this case you've gone to the HN comments and
           | been misinformed. GP misunderstood the problem. This issue is
           | about Google adding tracking links to links in _HTML exports_
           | of Google docs.
        
             | hn_throwaway_99 wrote:
             | I'm not misinformed. There are other comments here that
             | make that point, and I think
             | https://news.ycombinator.com/item?id=37779383 is a
             | reasonable rejoinder.
             | 
             | I think it's fair to argue that exported files should not
             | have redirect links enabled, but as a software engineer I
             | can imagine the complexity involved, or that there are
             | still reasonable malware concerns. Perhaps the decision to
             | have the exports include the redirects should be re-
             | evaluated, but I certainly wouldn't attribute it to malice.
        
         | sbarre wrote:
         | Yeah this is all nice and good except that's not what the URL
         | is...
         | 
         | There's a bunch more after the q parameter:
         | 
         | &sa=D&source=editors&ust=16965233434352076&usg=
         | Ade5344w26X85-pHzoD-rVkkdfdfBQnJ7B
         | 
         | That sure looks like tracking data to me.
        
           | lern_too_spel wrote:
           | That's a signature, so scammers can't send people trusted
           | google.com links and be redirected to a malware site unless
           | the signature verifies with the timestamp. This was standard
           | practice circa 2005.
        
             | sbarre wrote:
             | Fair enough, TIL. Do you have any details on the signature
             | spec? Is this something anyone can generate or only Google?
        
             | aftbit wrote:
             | Um, except, they can? As clearly shown in the example link
             | in the GP post:
             | 
             | https://www.google.com/url?q=https://example.com/
             | 
             | Google has had this open redirect forever afaict. I guess
             | they don't consider that a serious threat.
             | 
             | I think the better answer is that this is tracking, just
             | like they do on all of the search results, to see which
             | links are most popular. There still might be a malware
             | surveillance use case but that's not the only one.
        
               | lern_too_spel wrote:
               | If there is a verified signature, it skips the
               | confirmation page. Your link does not. The user has to
               | manually confirm that they want to visit a non-Google
               | URL.
        
               | thibautg wrote:
               | I'm not seeing a confirmation page, it redirects
               | transparently. So it seems that YMMV.
        
         | cryptonector wrote:
         | > This is because google docs is now widely used as a malware
         | vector.
         | 
         | Sending the user via Google is fine when the user is using the
         | google doc as a google doc. It's _NOT_ fine when you export to
         | some file format to share with others as not-a-google-doc. The
         | moment you exit the Google ecosystem is the moment when this
         | sort of protective feature becomes a tracking feature.
        
         | type0 wrote:
         | [flagged]
        
           | eclipxe wrote:
           | Why?
        
           | salil999 wrote:
           | Google Docs has helped so many people and companies move
           | forward with collaborative document writing and editing. How
           | is that malicious?
        
         | nemetroid wrote:
         | The complaint is about documents _exported_ from Google Docs.
        
           | londons_explore wrote:
           | But thats still a malware vector right?, especially if you
           | can get the victim to export it themselves?
        
             | [deleted]
        
             | cryptonector wrote:
             | You can write HTML (or Word, or whatever) yourself w/o
             | Google's help. This "feature" isn't going to stop malware
             | links on exported google docs.
        
             | wslh wrote:
             | The malware vector still exists because you can just edit
             | the file exported and change the links... bad actors laugh
             | out loud at these issues.
        
               | ceejayoz wrote:
               | The person doing the export isn't necessarily the bad
               | actor.
        
               | wslh wrote:
               | That's for sure, but what attack vectors do you imagine?
               | If the bad actor, for example, is the owner of the
               | document it can easily put a link to a malware that
               | Google will not detect.
        
             | negus wrote:
             | It is not. There is no sense at all: you could use manually
             | crafted HTML page with malicious links, there is no benefit
             | in using Google Docs export for this.
        
               | judge2020 wrote:
               | The benefit is as OP said: it bypasses corporate
               | firewalls because it's a google doc.
               | 
               | Although I can only reproduce this redirect page in a
               | published doc page[0], not in a pdf export (unless
               | there's another way to download pdf via url trickery)
               | 
               | 0: https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvU
               | PNOcwH...
        
               | afandian wrote:
               | I could reproduce on HTML ZIP export but not PDF.
        
               | crtasm wrote:
               | A HTML file exported from google docs is not a google doc
               | and I don't see how or why a firewall would see it as
               | one?
               | 
               | The URL to download the export can't be shared as far as
               | I can tell.
               | 
               | edit: you _can_ reuse the URL to download the export.
               | tested on another network. it expires fairly quickly
               | though, within a couple minutes it seems.
        
               | darkwater wrote:
               | > edit: you can reuse the URL to download the export.
               | tested on another network. it expires fairly quickly
               | though, within a couple minutes it seems.
               | 
               | (thanks for the test) So it's clearly not a possible real
               | vector, and actually they thought about it being a
               | possible vector, otherwise they would not have put the
               | expiration.
        
             | cosmojg wrote:
             | Oh, you're right! And by that logic, Hacker News is a
             | malware vector, too, with all these random links hanging
             | around. Maybe we should petition the moderators to
             | integrate Google's tracking links here as well!
        
           | Chabsff wrote:
           | Expecting an exported document to behave as close as possible
           | as the hosted version is not exactly unreasonable in general.
        
         | hedora wrote:
         | So, this helps users that understand what the redirect page is
         | saying to them, but don't know that clicking hyperlinks in
         | documents takes you to a web page, and also don't know what the
         | address bar is?
         | 
         | I'd like to see a flow (screenshots or video or something?) of
         | an actual attack where the redirect page helps people that are
         | actually capable of understanding what the redirect says.
        
         | LeifCarrotson wrote:
         | I run the ClearURLs extension [0], so when I click that link -
         | or most Amazon affiliate links, or an O365 tracking link, or
         | many other tracking links, it sends me straight to the
         | destination without hitting Google's servers.
         | 
         | A feature request/complaint is that it doesn't support hovering
         | to see the target URL/check if the particular tracking domain
         | is supported, for example Tom's Hardware uses a "georiot.com"
         | tracker that embeds GR_URL=https%3A%2F%2Fwww.amazon.com%2Fdp...
         | %3Dtomshardware-us-1038331347314950500-20... and doesn't
         | successfully parse out the raw amazon.com/dp/[product ID] link.
         | 
         | [0]: https://github.com/ClearURLs/Addon
        
         | hnburnsy wrote:
         | Nice of them to put the redirect under google.com, so you
         | cannot easily block it, unlike MS which uses
         | https://nam01.safelinks.protection.
        
         | afandian wrote:
         | But if you visit these they give themselves a free pass.
         | 
         | https://www.google.com/url?q=https://www.google.com/
         | 
         | https://www.google.com/url?q=https://www.youtube.com/
         | 
         | Doesn't seem fair does it? Is this about "leaving your chosen
         | office suite" or "leaving Google".
         | 
         | Here's an interesting one. It gets allowed even though the HTTP
         | cert has lapsed.
         | 
         | https://www.google.com/url?q=https://www.keyhole.com/
        
           | Rastonbury wrote:
           | If I present links on my site and show phishing warnings on
           | click, why would I warn users about sites I own or know to
           | not be fakes. It just ruins their experience
        
             | afandian wrote:
             | It's not your site, it's my document on my hard drive.
        
             | cma wrote:
             | Amazon.com is not known to not to be fake?
        
           | salil999 wrote:
           | > Doesn't seem fair does it? Is this about "leaving your
           | chosen office suite" or "leaving Google".
           | 
           | How is it unfair if they allow their own websites which they
           | maintain and develop to have no malware?
           | 
           | > Here's an interesting one. It gets allowed even though the
           | HTTP cert has lapsed.
           | 
           | I doubt any human is going through and vetting every website.
           | It's not a perfect system - I'm sure there will be websites
           | through the cracks.
        
             | afandian wrote:
             | This article is about exported documents, i.e. the point at
             | which you say "I am leaving the ecosystem of my chosen
             | tool".
             | 
             | The wording of the interstitial page says "If you do not
             | want to visit that page..." i.e. it's about whether you
             | expected to visit one website or another. Surely google.com
             | is as 'surprising' to the user as any other page.
             | 
             | BTW keyhole.com is an old Google-owned domain. From
             | https://infogalactic.com/info/List_of_Google_domains
             | 
             | EDIT:
             | 
             | From my own experiment exporting a docuemnt it renders
             | links as
             | 
             | https://www.google.com/url?q=https://example.com&sa=D&sourc
             | e...
             | 
             | I changed some param values, I don't know what they do. But
             | with the original values it remembered my preference. So it
             | seems like they're tracking and storing clicks.
        
               | TobyTheDog123 wrote:
               | >Surely google.com is as 'surprising' to the user as any
               | other page.
               | 
               | The metric isn't how surprising it is, but how
               | potentially malicious it is. The entire point of the
               | redirect is so the user can make a conscious decision not
               | to visit a potentially-malicious page.
               | 
               | Google.com and Youtube.com, operated by the same people
               | who made the docs tool, make the entirely-fair assumption
               | that neither contain malware.
               | 
               | That being said, I also think it's the wrong argument to
               | make. It makes very little sense that an exported
               | document needs these interstitials. It would make more
               | sense if it applied them to hosted Google Docs, but not
               | things that are self-hosted by an end-user.
        
             | aftbit wrote:
             | It would be one thing if they had an allowlist or denylist
             | of sites that were not just their org. It's another thing
             | entirely when they allow all Google sites through but not
             | their competitors. I can imagine there being abuse of
             | monopoly powers claims to be made here. Links to YouTube
             | videos in a Google spreadsheet will take half as many
             | clicks as links to Vimeo videos, which will result in fewer
             | lost conversions.
        
       | sneak wrote:
       | Google also rewrites URLs in emails at Gmail accessed via IMAP to
       | use the Google URL redirector service if you have Advanced
       | Protection turned on. This means that the PGP signatures break,
       | etc, because they are rewriting the message body.
       | 
       | It's terrible.
       | 
       | FAA702 was enough, but if for some reason warrantless
       | surveillance of all data held at Google wasn't for you
       | personally, the terrible behavior of Google since their
       | government mandated backdoors were installed should be. It's time
       | to de-google your life.
        
         | hedora wrote:
         | I routinely receive email messages from gmail that do not
         | render in standard html mail clients and with attachments that
         | are hosted on google servers (where they presumably expire and
         | are available for easier bulk-surveillance use cases).
         | 
         | It also bears repeating that the big cloud vendors all
         | supported mandating the government backdoors you mention.
         | 
         | As far as I can tell, it was a regulatory capture move, where
         | they wanted to have the power that comes from spying on +
         | selectively informing on their customers, but they wanted to
         | make sure that no companies that serve the US market could
         | provide meaningfully better privacy or security:
         | 
         | > _The CLOUD Act received support from Department of Justice
         | and of major technology companies like Microsoft, AWS, Apple,
         | and Google.[12][13] The bill was criticized by several civil
         | rights groups, including the Electronic Frontier Foundation,
         | the American Civil Liberties Union, Amnesty International, and
         | Human Rights Watch. These groups argued that the bill stripped
         | away Fourth Amendment rights against unreasonable searches and
         | seizures, since the government could enter into data rights
         | sharing agreements with foreign countries and bypass U.S.
         | courts, and affected users would not have to be notified when
         | such warrants were issued.[13][14] Some of these groups feared
         | the government would not fully review requests from foreign
         | countries for their citizens ' stored on servers in the U.S.,
         | potentially allowing such data to be used in bad faith in those
         | countries.[15]_
         | 
         | https://en.wikipedia.org/wiki/CLOUD_Act
        
       | srazzaque wrote:
       | I'm pretty sure the stated intent of the redirect is to prevent
       | phishing (that is, provide an opportunity for Google to warn
       | users about visiting a known dodgy site). The ability to track is
       | just an added bonus!
       | 
       | Microsoft does this too with Teams. Links that my colleagues and
       | I share with one another to _internal company sites_ get link
       | checked then redirected. Microsoft must have a treasure trove of
       | data about external company employee browsing habits as a result.
       | 
       | I would have infinitely more respect for companies that are
       | upfront about their intentions, no matter how nefarious: "we're
       | doing this to help protect you from phishing. But also, 99% of
       | links are probably not phishing. So this feature really enables
       | us to collect data to track what you do, and perform analytics to
       | improve our bottom line".
       | 
       | Why sugar-coat it?
        
         | dacryn wrote:
         | funny you say that. Google is upfront about their intentions,
         | but nobody believes them that they are not data mining this for
         | behaviour tracking.
         | 
         | Can't win in that scenario
        
           | srazzaque wrote:
           | Interesting, I wasn't aware Google had actually stated "we
           | don't use this data for tracking, and we only use it for link
           | protection" (does it?).
           | 
           | Assuming true: you are right in that it's basically no-win.
           | The fact that Google draws so much revenue from advertising
           | makes it difficult to reconcile.
           | 
           | Nothing short of a third-party code audit of Google's code
           | against their asserted privacy policy would appease everyone.
           | And even then, there would be doubters.
        
             | TeMPOraL wrote:
             | If they did state that, this would probably be legally
             | binding in the EU under GDPR.
        
           | glimshe wrote:
           | They can't win as a result of their own actions. Once you
           | lose trust, it's hard to regain it.
        
           | nerdponx wrote:
           | Why would anyone believe that they aren't? Or that they won't
           | start doing it?
        
             | sneak wrote:
             | More importantly: Google is in a jurisdiction that can
             | mandate _warrantless_ surveillance orders that require
             | realtime surveillance of given selectors (i.e. IPs or
             | users). They comply or they go to jail.
             | 
             | Even if the stated and official policy of Google is to
             | never track these, and everyone at Google is 100% on board
             | with this and will never change, they are subject to being
             | Agent Smith'd at any time by the FBI/DHS and NSA and CIA
             | and the rest of the US IC, critically: without probable
             | cause or a search warrant. The US has abandoned the rule of
             | law and the constitutional protections against unreasonable
             | search. This applies to _every single US-managed services
             | vendor_.
             | 
             | The decision to track or not track is simply not in their
             | hands. If they get handed an NSL, a FISA order, or a
             | regular old search warrant, they have to start turning over
             | everything they have.
        
               | lern_too_spel wrote:
               | > The US has abandoned the rule of law and the
               | constitutional protections against unreasonable search
               | 
               | Those constitutional protections protect US citizens
               | anywhere and noncitizens while they are in the US.
               | Warrantless surveillance of communications affects
               | noncitizens outside the US. The US is still very much a
               | nation of laws.
        
               | sneak wrote:
               | Human rights to privacy do not hinge upon location or
               | citizenship.
               | 
               | Indeed, the declaration (written by British crown
               | subjects) makes it clear: "that all men are created
               | equal, that they are endowed by their Creator with
               | certain unalienable Rights".
               | 
               | It doesn't say "all americans". The constitution doesn't
               | grant the rights, it merely recognizes the existing
               | ones... but you already know this.
               | 
               | > _Warrantless surveillance of communications affects
               | noncitizens outside the US._
               | 
               | We have also learned, again and again, that it affects US
               | citizens, too, in violation of the law. The IC doesn't
               | care that much beyond keeping up appearances that they
               | comply with the law.
               | 
               | These are the same people who ran torture centers, lied
               | to Congress, got caught, and hacked Congressional
               | computers to delete evidence, then got caught doing that,
               | too. Nobody went to jail or was even charged.
               | 
               | The laws simply do not apply to the CIA.
        
               | [deleted]
        
               | Tijdreiziger wrote:
               | I would assume anyone trying to evade state-level actors
               | wouldn't be using Google Docs in the first place.
        
               | sneak wrote:
               | https://en.m.wikipedia.org/wiki/Petraeus_scandal
               | 
               | These secrets were kept in gmail drafts.
        
           | nonrandomstring wrote:
           | This old problem.
           | 
           | It's the word "win" that bothers me in this context.
           | 
           | Until one sees that conflicting models can make "security" a
           | zero sum game, in which your security is my insecurity and
           | vice versa, there is only psychological splitting, posturing
           | and clamour for the "moral high ground".
           | 
           | Indeed, even using the word "security" as a bare noun is a
           | mark of presumptuousness. One must always ask; Security for
           | whom? Security against whom or what? Security to what end?
           | 
           | Unilaterally imposing a harm (leaking of data) upon others is
           | disdainful, but then offering "security" as your
           | reason/excuse, is condescending, since you do not know what
           | my security needs are and how they are prioritised.
           | 
           | When it comes to messing with my data or devices "for my own
           | good" the only proper response is "I'll be the judge of
           | that!"
           | 
           | Many then respond that "people are too stupid and need a firm
           | hand", which is not a good look, and frankly cuts to the core
           | of so many problems in technology today.
           | 
           | Companies like Google need a better moral, sociological and
           | psychological map of reality before putting on their boots
           | and marching off down the road of good intentions in the
           | direction of Hell.
        
           | yafbum wrote:
           | You could say f-ck it, if nobody believes us anyways, let's
           | just track the sh-t out of everything then
        
         | JKCalhoun wrote:
         | Since U.S. public school districts and students under the age
         | of 18 use Google Docs pretty much exclusively these days, this
         | seems like a privacy lawsuit waiting to happen.
        
           | callalex wrote:
           | I'm sure they can just print out a little pamphlet to shove
           | in the Chromebook box that says "by being in the same room as
           | this computer you agree to blah blah blah". US consumer
           | protection laws are worthless.
        
         | [deleted]
        
         | userbinator wrote:
         | I encounter similar annoyances with things like "link previews"
         | (impossible for an internal site, or one which requires
         | authentication), and as a result have come to slightly
         | "obfuscate" all links I send through such software. Sometimes I
         | just don't send any links at all --- something like "HN item
         | 37776492" suffices.
        
           | jabroni_salad wrote:
           | Where I work the onboarding sheet instructs you to make a
           | custom search engine for servicenow because it's way faster
           | to bang in the record number than to use a link in Teams.
        
         | hnburnsy wrote:
         | Safelinks in Teams is a policy that your administrators can
         | manage...
         | 
         | https://learn.microsoft.com/en-us/microsoft-365/security/off...
        
         | diogenes4 wrote:
         | Why is this added to exported documents tho? It should only add
         | the redirect in the browser.
        
           | hackideiomat wrote:
           | And there it is not needed. You could implement this in JS.
        
         | agluszak wrote:
         | > I'm pretty sure the stated intent of the redirect is to
         | prevent phishing (that is, provide an opportunity for Google to
         | warn users about visiting a known dodgy site). The ability to
         | track is just an added bonus!
         | 
         | How do you know it's not the other way round?
        
         | nerdjon wrote:
         | I DESPISE these links from Outlook and Teams (not sure if it is
         | specifically the teams implementation or something else).
         | 
         | I don't know about your company but mine has us do these
         | phishing tests and training videos all the time and then we get
         | rid of one of the safety features that they keep hammering us
         | about.
         | 
         | I can't just look at the URL before clicking it. I once "fell
         | victim" to one of our phishing tests because I clicked the link
         | in the email. And its like... well we have been trained by our
         | own email system that the only way to actually see the validity
         | of the link is to click it.
        
           | hotnfresh wrote:
           | Our tests (outlook email) motherfucking _bypass user filters_
           | too. I wrote some so I'd never have to worry about these damn
           | things, but they go right through.
           | 
           | Guess I'm going to have to configure an actual user-agent
           | email client that won't screw me when someone else asks it
           | to.
        
           | open-paren wrote:
           | Those corporate phishing tests are often administered by
           | KnowBe4, and KnowBe4 identifies their phishing emails with
           | custom email headers (can't remember what it is off the top
           | of my head). So if you view the source code of an email and
           | look for the obvious KnowBe4 header, you can tell ahead of
           | time.
        
           | isoprophlex wrote:
           | lol yeah. I curled the url in a suspicious email once, to
           | investigate what it was. YOU FAILED THE TEST. ugh...
        
             | nerdjon wrote:
             | It just frustrates me that I have brought this up multiple
             | times, wondering why we are paying to do this training and
             | then we can't actually do the training.
             | 
             | Like it would be one thing if the URL then just had the
             | full URL in it and we could still see where it was going.
             | But no, it is a completely obfuscated URL.
             | 
             | The worst part is, it isn't like it takes you to a page to
             | verify you actually want to go to this link. It just takes
             | you right there assuming you are on a browser that has
             | approved that it can open links from your email.
             | 
             | I really really want to do know what good this does AT ALL
             | besides likely checking some checkbox for something.
        
             | mnw21cam wrote:
             | In their defence, curl isn't completely benign in this
             | case. You just confirmed to the person who sent you the
             | link that your email address is valid and reaches a person.
        
               | isoprophlex wrote:
               | You're completely right of course, and I hadn't
               | considered that.
               | 
               | However, there's apparently people scraping and reselling
               | (or bribing employees, dunno) corporate directories. In
               | my case everyone has firstname.lastname@corpo.com, so
               | judging by the high volumes of creepy ass, targeted
               | corporate spam I get on my work mail... this is hardly a
               | public secret.
        
               | saalweachter wrote:
               | Also, there's no reason to believe that you're curling
               | the same redirect as you get from clicking the link.
               | 
               | There's this thing compromised webservers do where, if
               | you type in www.example.com into your browser, and go
               | straight there, you get the normal web page. If you
               | _click a link from Google_ , and have a google.com
               | referrer in your request, you get a little bit of
               | JavaScript included that that redirects you to another
               | site to buy herbal remedies or fake watches or whatever.
               | 
               | If you are the business owner and go directly to your
               | home page to see what's what, you think everything is
               | fine; if you are a tech trying to debug it and you curl
               | the webpage, everything looks fine [unless you curl with
               | a referrer set]. You probably think Google has the wrong
               | URL or something.
               | 
               | Likewise -- I don't know what a click-through from an
               | email client looks like, but it wouldn't surprise me if
               | there's an identifiable header or referrer or something.
               | If that's the case, you could write your malicious URL
               | shortener to redirect you to www.example.com/ if you curl
               | it bare, or www.exam.ple.co/m/ if you have the redirect
               | header. Curling the URL in question doesn't necessarily
               | prove it's safe to click on.
        
               | isoprophlex wrote:
               | Christ, that's depressing. I'm not much of a web guy,
               | didn't know you could do this. Thanks for sharing...
        
         | tmpX7dMeXU wrote:
         | How does the fact that most links aren't phishing links play
         | into anything? Maybe we don't need AV because most files aren't
         | viruses? You had enough of a point without this.
        
           | TeMPOraL wrote:
           | > _Maybe we don't need AV because most files aren't viruses?_
           | 
           | Since you used _that_ example...
           | 
           | How would you feel if everyone in their neighborhood got
           | assigned a private security officer that sits in their
           | apartment doorway all day and notes who comes and goes? The
           | company argues that it's to protect from the thieves and
           | fraudsters, and indeed there are always some break-ins or
           | grandparents scammed somewhere. Oh, and everyone gets an
           | officer free of charge - it's paid for by the ads they wear
           | on their vests and that play regularly on their walkie-
           | talkies. Would you trust the security company that all the
           | notes, taken by a person in the privileged position of
           | observing everything in your home, will _only_ be used to
           | prevent crime and _nothing else, ever_?
           | 
           | Back to your example - AV companies are quite shady these
           | days, and their products not all that useful relative to
           | costs/damage and snooping they do.
        
             | gretch wrote:
             | This is a weird example you posed because it's a real
             | thing. It's called a doorman and it's very popular in new
             | york (it's considered a luxury to have one)
        
           | srazzaque wrote:
           | I see your point, but comparing this with an off-line AV
           | scanner with a regularly updated internal database (assuming
           | that's what you meant) is not an apt comparison.
           | 
           | The analog would be an AV scanner that sends a list of your
           | files/hashes to a centralised server somewhere, so that the
           | company can target ads related to your file contents (or sell
           | your data...), in addition to warning you about viruses.
           | 
           | Agreed that % true positive is not a factor in whether or not
           | to have a given security feature. But it is merely convenient
           | that the vast majority of the usage of this "link protection"
           | feature would benefit Google/MS and not the customer/user
           | (assuming that Google/MS are data mining, which is yet
           | unproven in this use case).
        
             | freedomben wrote:
             | I largely agree with you, but GP didn't specify they are
             | talking about an off-line AV scanner. In fact Google itself
             | has an online AV scanner that scans attachments in gmail,
             | files downloaded in Drive, etc.
        
       | wslh wrote:
       | I have not tried yet but, is this including documents exported
       | from paid accounts in Google Workspace?
        
         | aquir wrote:
         | According to the Mastodon thread, it's the same for paid
         | accounts as well
        
       | jokoon wrote:
       | For years, copying a result link in Google was copying a
       | redirect.
       | 
       | When you hovered, it was the actual link. When you right clicked,
       | it changed to a redirect.
        
         | huhtenberg wrote:
         | There are trivial browser add-ons that fix that, but, yeah,
         | this behavior is annoying, distasteful and borderline
         | deceitful. Not that it'd be shocking though given its origin.
        
           | matkoniecz wrote:
           | > borderline deceitful
           | 
           | why borderline? It is entirely deliberate deceit.
        
             | tmpX7dMeXU wrote:
             | I don't see it as deceitful and I'd eat my hat if most
             | other users didn't agree with me. I expect that when I
             | click a search result link, that Google will be tracking
             | that I've done this. I also appreciate being able to search
             | for something, right-click-copy a link, and send it to
             | someone, without it being covered in tracking cruft.
        
               | lxgr wrote:
               | > right-click-copy a link, and send it to someone,
               | without it being covered in tracking cruft.
               | 
               | That's exactly the use case Google breaks, though: The
               | link gets covered in tracking cruft and it gets very hard
               | to tell where it even leads from just looking at it.
        
               | jasonlotito wrote:
               | Just tried it. It worked as expected: right-click, copy a
               | link, and it's the link to the source, not Google or a
               | redirect.
        
               | jraph wrote:
               | They must have fixed it, it wasn't like this in the past.
               | I remember being annoyed by this when I was still using
               | Google.
        
               | huhtenberg wrote:
               | Here, in a fresh Firefox profile -
               | https://i.imgur.com/RKvnJoq.gif
        
               | tech234a wrote:
               | This may be a Chrome vs Firefox issue, as Firefox doesn't
               | support the ping attribute for a (link) elements in HTML.
               | The ping attribute allows sending a POST request in the
               | background to arbitrary URLs when a link is clicked.
               | 
               | [1]: https://developer.mozilla.org/en-
               | US/docs/Web/HTML/Element/a
        
       | not_enoch_wise wrote:
       | I CANNOT believe google would do this to paying customers!
       | 
       | Oh, right.
        
       | tiffanyh wrote:
       | Hasn't this existed for quite some time?
       | 
       | I can't find a reference to it, but I thought this has been
       | around for a few years now.
        
       | vineyardmike wrote:
       | Slightly more benignly, the links seem to trigger a redirect
       | notice and open in a new tab, which seems like good behavior for
       | inside the Google docs editor. I can't know for sure, but there
       | is probably also tracking in there. What else would an opaque
       | string of text in the query params be for?
       | 
       | I assume the link rewrites come from this, and weren't added just
       | for the exported version. It is disappointing it isn't stripped
       | out, but I'm guessing it's just such a corner case no one is
       | paying attention on the team. Also, if it does contain tracking,
       | we dont know how/when that gets updated - eg is it vestigial
       | behavior or was it updated in export, do unique users get unique
       | tracking numbers when exporting the same doc?
        
       | WirelessGigabit wrote:
       | Reddit does the same now when you share something.
        
       | jraph wrote:
       | Shameless plug.
       | 
       | The company I work for has a team developing CryptPad, which can
       | be seen as an open source (AGPL) [a], E2EE alternative to Google
       | Docs.
       | 
       | You can edit documents with multiple people in realtime, and the
       | server does not have access to your content. You can self-host of
       | course, but the team also provide an instance [1], and several
       | other people also provide theirs.
       | 
       | It does not have such misfeatures. It has sheets, documents
       | (using an ONLYOFFICE fork running in the browser), Diagrams
       | (using Draw.io), forms, polls, a kanban module, pads, among other
       | things. There's some storage too (a "drive").
       | 
       | It obviously does not provide all the features of Google Docs and
       | its office suite is not as complete, but it can still be useful
       | for a whole host of use cases.
       | 
       | (edit: btw CryptPad has been mentioned in several replies in this
       | thread, it's not us so far but I've sent the link to our chat,
       | they might chime in as well)
       | 
       | [1] https://cryptpad.fr/
       | 
       | [a] https://github.com/cryptpad/cryptpad
        
         | hedora wrote:
         | Wow! Thank you.
         | 
         | I noticed a few annoyances in the demo flow:
         | 
         | How do I make a new slide? I had to rtfm to find out about
         | "---"
         | 
         | What language does code want? I eventually correctly guessed
         | "HTML".
         | 
         | I want it to have a little dropdown menu in the style of
         | godbolt.org for code snippets. That would be great for
         | collaboration flows like: "This high-level code compiles to an
         | integer increment, so don't worry about the lambdas".
         | 
         | Godbolt also does a good job of populating pages with hello-
         | world examples. It might make sense to do that, at least the
         | first few times a document of a given type was created.
         | 
         | For it to be my daily-driver backend dev environment, it would
         | need git integration and the ability to ssh to a dev
         | environment that I configured in the style of okteto. That
         | feels like a different product.
         | 
         | If I was going to use this on a day-to-day basis, I'd want to
         | be able to back up the data (in case your E2EE blew up, or I
         | lost my password).
         | 
         | My next question would be how to use it while disconnected (For
         | three reasons: (1) I want to host your backend server on a LAN
         | that isn't exposed to the internet, and still use it for things
         | like bank account info, and (2) I want to store travel
         | itineraries in it, and be able to access them if my cell plan
         | doesn't work overseas, (3) if the server dies, I have the data
         | on my device, and would want to "copy" it all to a new server).
         | 
         | Anyway, I've been looking for something like this for years,
         | and it looks like you hit most of my requirements.
         | 
         | How does conflict resolution work? CRDT's? Something else?
        
           | jraph wrote:
           | Hey, very happy to see you so enthusiastic!
           | 
           | I'll be sure to transmit your feedback to the CryptPad team.
           | 
           | I'm not an expert myself so while I might know some stuff,
           | it'd be better to talk to them directly.
           | 
           | Come say hello on the Matrix #cryptpad-general channel [1],
           | don't hesitate to open issues on the bug tracker, and to
           | browse the CryptPad's website [2], and in particular its
           | documentation. About conflict resolution, you may want to
           | read part about ChainPad [3] which details this a bit.
           | 
           | [1] https://matrix.to/#/#cryptpad-general:matrix.xwiki.com
           | 
           | [2] https://cryptpad.org/
           | 
           | [3]
           | https://docs.cryptpad.org/en/dev_guide/client/chainpad.html
        
         | pratio wrote:
         | Came here to mention cryptpad. I selfhost it and it's quite
         | good.
        
       | makingstuffs wrote:
       | I'm surprised that anyone is shocked by the depths to which
       | Google will sink in order to hoover up more of that delicious
       | data.
        
       | yafbum wrote:
       | I don't think this is for tracking. If this was just for
       | tracking, there are much simpler and discreet ways to do it (just
       | add a background ping). I think this is to allow intercepting the
       | user if Google determines that the link destination is harmful
       | (eg malware distribution).
        
       | [deleted]
        
       | dangoodmanUT wrote:
       | Yeah wow just tested this with html export
        
       ___________________________________________________________________
       (page generated 2023-10-05 23:01 UTC)