linklog.tiagorangel.com: privacy

[lilmuncher]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

Request for Patch on Commit: 6ac6e05

while redirecting from spoo.me url tracking shortener to linklog.tiagorangel.com it sends tracking data using POST method onto https://linklog.tiagorangel.com/api/exchange?id={id}

A specific URL where the issue occurs.

https://linklog.tiagorangel.com/api/exchange?id={id}

Steps to Reproduce

1. Go to https://linklog.tiagorangel.com/
2. Paste or Enter a Redirecting URL eg. example.com then click Track
3. Click Create Link, tap the captcha
4. click for spoo.me shortener, it will redirect to POST method of https://linklog.tiagorangel.com/api/exchange?id={id} so it will bounce back as track session

Expected behavior

It will record data even the /script.outbound-links.pageview-props.tagged-events.js is block but the POST method on https://linklog.tiagorangel.com/api/exchange?id={id} will send a data

Actual behavior

Successful tracking of user, includes sensitive data like IP, Location, CPU ID, GPU ID, Canvas ID, Composite ID, Browser and Viewport Size

uBO version

1.65.0

Browser name and version

Firefox for Desktop 64bit v142 Stable

Operating System and version

Windows 10/11

[gorhill]

Wrong repo, there is no 6ac6e05f23ca2c301f59f0ea30d0cc5564f2c904 commit in uBO. I see one in uAssets: 6ac6e05.

Filter issues are to be reported using the chat icon in the popup panel, so that they are reported to the proper repo, with the proper troubleshooting information.

[uBlock-user]

Fingerprinting script found in https://linklog.tiagorangel.com/api/script.js

[stephenhawk8054]

@gorhill If I block the above script, there's an error with userInfo variable because it needs to execute

userInfo().then((x) => {
  data = x;
});

I tried with different set values and as combinations but can't bypass that, for example

linklog.tiagorangel.com##+js(set, userInfo, noopFunc, as, resolved)

Test link is https://linklog.tiagorangel.com/9vlgo . It redirects to https://example.com.

[gorhill]

as, resolved returns a promise which is resolved. What you are asking with your filter is for userInfo to be a function which returns a promise which resolves to undefined, it's not currently supported by set-constant.

From what I see in the site's code, a fetch() to the server is required for the redirect to take effect, so this works:

linklog.tiagorangel.com##+js(trusted-set, data, {})

This way, the fetch() still occurs but no data is sent.

---

Correction: ... with your filter is for userInfo to be a promise which resolves to noopFunc

[uBlock-user]

linklog.tiagorangel.com##+js(set, data, true) also works(you have to click on Proceed to link button)

[tiagozip]

hi there! i run linklog, would it be possible and, if so, what features being removed/added would it take for it to get off the blocklist?

while i fully respect the original decision to block it, it's fully open-source and i don't personally collect data for tracking.