Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filter out _openstat query string tracker out of URLs #11579

Closed
fmarier opened this issue Sep 3, 2020 · 5 comments · Fixed by brave/brave-core#6742
Closed

Filter out _openstat query string tracker out of URLs #11579

fmarier opened this issue Sep 3, 2020 · 5 comments · Fixed by brave/brave-core#6742

Comments

@fmarier
Copy link
Member

fmarier commented Sep 3, 2020

_openstat appears to be campaign-related but when we take an example from the wild:

https://moscow.petrovich.ru/catalog/7198/138090/?_openstat=ZGlyZWN0LnlhbmRleC5ydTs0MDY1MTc3Mzs2OTk3NDY3MzE2O3lhbmRleC5ydTpwcmVtaXVt&yclid=7597867600238632462&utm_source=yandex&utm_medium=cpc&utm_campaign=MSK%7CDSA%7C40651773&utm_content=cid%7C40651773%7Cgid%7C3683802495%7Caid%7C6997467316%7Ckid%7C966577%7Cpos%7Cpremium1%7Cadtarget%7C%D0%A1%D1%83%D1%85%D0%B8%D0%B5%20%D1%81%D1%82%D1%80%D0%BE%D0%B8%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5%20%D1%81%D0%BC%D0%B5%D1%81%D0%B8%20%D0%B8%20%D0%B3%D0%B8%D0%B4%D1%80%D0%BE%D0%B8%D0%B7%D0%BE%D0%BB%D1%8F%D1%86%D0%B8%D1%8F%7C%D0%93%D0%B8%D0%B4%D1%80%D0%BE%D0%B8%D0%B7%D0%BE%D0%BB%D1%8F%D1%86%D0%B8%D1%8F%7Cadtarget_id%7C966577%7Csrc%7Csearch_none%7Cdvc%7Cdesktop%7Cgoalid%7C1712089&utm_term=966577%7C%7Creg%7C%D0%9C%D0%BE%D1%81%D0%BA%D0%B2%D0%B0

and decode the _openstat base64 parameter, we get:

direct.yandex.ru;40651773;6997467316;yandex.ru:premium

This refers to Yandex Direct which has to do with conversion tracking.

It's not clear that all uses of OpenStat are user-identifying though since it depends on what the payload contains.

@fmarier fmarier added privacy priority/P3 The next thing for us to work on. It'll ride the trains. OS/Android Fixes related to Android browser functionality OS/Desktop privacy/query-filter labels Sep 3, 2020
@fmarier fmarier assigned fmarier and unassigned fmarier Sep 3, 2020
@fmarier
Copy link
Member Author

fmarier commented Sep 22, 2020

Also, it's not clear whether this service is still in operation: https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.openstat.ru%2F
Screenshot from 2020-09-22 16-50-00

@fmarier
Copy link
Member Author

fmarier commented Sep 29, 2020

According to Yandex documentation the _openstat parameter is also used by https://liveinternet.ru:

You can track ad campaign results in Yandex.Direct by using independent third-party statistics systems like Openstat or LiveInternet. Just add the special parameter (the _openstat tag) to your ad link.
and that company's analytics platform is still alive.

@fmarier fmarier self-assigned this Sep 29, 2020
@fmarier
Copy link
Member Author

fmarier commented Sep 30, 2020

Given that this parameter does include high-entropy values in the wild and that it appears to still be in use by one company, we will add it to the filter.

@btlechowski
Copy link

btlechowski commented Oct 14, 2020

Verification passed on

Brave 1.17.28 Chromium: 86.0.4240.75 (Official Build) nightly (64-bit)
Revision c69c33933bfc72a159aceb4aeca939eb0087416c-refs/branch-heads/4240@{#1149}
OS Ubuntu 18.04 LTS

Verified test plan from brave/brave-core#6742
image

Verified to Normal Window, Private Window and Private Window with Tor


Verification PASSED on macOS 10.15.7 x64 using the following build:

Brave | 1.17.42 Chromium: 86.0.4240.99 (Official Build) nightly (x86_64)
-- | --
Revision | 002668237e13d38aabd6d11c2d216dd22b736ff2-refs/branch-heads/4240@{#1229}
OS | macOS Version 10.15.7 (Build 19H2)
  • Verified the STR/Cases outlined via Add _openstat to the query filter brave-core#6742 and ensured that _openstat is being filtered out from the URL
    • ensured the above worked as expected using Tor Windows, Guest Windows, Private Browsing Windows
  • Verified that https://brave5t5rjjg3s6k.onion/?_openstat=foo was also being filtered

Verification passed on

Brave | 1.17.52 Chromium: 86.0.4240.111 (Official Build) dev (64-bit)
-- | --
Revision | b8c36128a06ebad76af51591bfec980224db5522-refs/branch-heads/4240@{#1290}
OS | Windows 10 OS Version 1903 (Build 18362.1139)

@srirambv
Copy link
Contributor

Verification passed on OnePlus 6T with Android 10 running 1.17.68 x64 build


Verification passed on Samsung Tab A with Android 10 running 1.17.68 x64 build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants