When you share a YouTube video using the share button it adds “si=some_unique_code” to the URL. If you don’t remove that it shows your personal account to anyone who receives it so that they can chat directly with you. For a lot of people this is their real name.
I’ve seen it all over Lemmy so I figured I’d mention it here! You only need the stuff before the question mark in the URL to let others see the video.
This can also be turned off in your YouTube settings under the privacy section. The setting is “channel visibility for shared links”. It will still add the si code for tracking though.
On my forum, youtube links get stripped of any extra url parameters. Every site should have to do that.
That’s a great extra layer of protection, but people shouldn’t rely on it and get/stay in the habit of always removing the tracking code themselves.
Yeah, it’s easily possible to set it up to save the original link somewhere hidden. Same reason why you shouldn’t reuse passwords because it’s trivial to set up a site to look like it’s doing it right from the outside but actually saves all passwords in plaintext for owners, admins, or disgruntled staff to look at later and see if it logs in to your email.
Facebook and Instagram do the same btw. Just FYI.
It would be great if link cleaning and auto-mirroring was part of the lemmy UI itself.
I think that would probably be a client implemented feature, not a Lemmy one. I also don’t design social medias, so I don’t really know.
The problem is that there is an almost infinite way to design these kinds of URLs, so maintaining a database of what should be stripped out isn’t trivial.
Yeah, would be best within particular client implementations. Not core Lemmy tho. Too many ways to do this and high maintenance.
Along similar lines be careful of the images you post if you location tag your photos. A lot of the larger websites will strip the location data by default but some do not. I’ve saved a handful of photos from reviews off the internet and now have people’s home addresses where the photo is of the product in their living room or whatever.
If you go to the ‘map’ section of your photos app it arranges them by location.
You can turn location tagging off globally when photos are taken or usually when you go to share a photo there is an option buried in a menu to strip location data(on mobile).
I have an iOS shortcut that remove exit meta data.
You can turn location tagging off globally
That’s one of the first things I did when configuring my kids phones.
https://f-droid.org/packages/com.svenjacobs.app.leon
I use this, and it works really well for the big apps and services.
That app seems not as transparent as it could be since it doesnt give any detail on the removed stuff; I recommend URLCheck instead, which is fully transparent about all trackers and even lets you pick which ones to remove at will.
I never knew users could get the profile from it, I always thought that was a youtube internal thing. thats not cool
It’s a very recent change
i would be surprised if it is true that “If you don’t remove that it shows your personal account to anyone who receives it so that they can chat directly with you”, and a search just now didn’t find anything to substantiate that.It’s a very recent change
is it though? if so, how do you actually find out the profile name from thesiparameter?obviously tracking parameters from URLs should be removed in any case, but afaict only google can use this to find which user generated the link.after some more reading i found conflicting reports but i think this might actually be happening; apparently it is only visible in the app?
I’ve seen it when opening shared links in the browser but it’s possible that you need to be logged in for it to show
FYI on desktop you can right click on the video and select “Copy video URL”, it doesn’t include the tracker string. Wish they’d let us remove it from the Share button, I’ve simply removed that button with uBlock Origin.
It’s also missing from my patched YouTube app’s Share on Android, not sure if that’s one of the patches.
Yeah, that’s certainly a patch. NewPipe, PipePipe, etc. all also remove
?si=.
If you never sign into YouTube and sharing links from a third party application, what is it that they append? Curious what makes up that shared id.
Additional PSA: TikTok does the same. Also Instagram, but in my experience it doesn’t reveal the sharing user (yet).
Insta does. if you open it on web and you didn’t log in, the popup that beg you to log in will also include the user who shared it.
What the fuck
Instagram absolutely does reveal the sharing user
Get YouTube Sharing URL sans Sharing / Tracking Code (for iOS users)
It should be common practice if you commonly share links. Try removing the query string (everything after and including the question mark). See if you get to the same page. If you do, don’t use the query string.
Query string parameters are rather often used for tracking. Look for gclid parameters after you click a google ad, for example.
The harder ones to bypass are Facebook and Reddit share URLs, which give zero indicator of their destination; it seems impossible as the recipient of such a URL.
At least with bit.ly, one can add a
+to the end of the URL and see data on it, including the original link (to then safely access without adding to its click counter).Yeah, there are always ways… any service could easily generate unique paths that require a server-supplied redirection to the main target. Then the server just needs to stitch up (1) where was that link generated and (2) who arrived at the redirection page. Users would have no way to determine the target link without exposing themselves to being tracked.
A platform like Reddit can do this too, by replacing the links you put in your comments/post, so they redirect to the original link. They can even make it continue displaying the original link, while actually linking to the redirect page.
Right, I’ve seen Slickdeals and I think Bing eventually take that on over the years: on-mouse-hover shows the original link, temporarily, until you actually right-click and copy, at which point the evil reveals itself lol.
Hmm… now I wonder if a browser add-on could circumvent the right-click interaction and stealth-copy the originally displayed link… lol, it’s nuts how far into the weeds of privacy our guerrilla warfare has been getting.
You should also known that TikTok does this by default and the generated code is impossible to remove afaik, it’s part of the video identifier.
So when sharing a tiktok video always download it and share the file.
deleted by creator
Always remove those search parameters before pasting links, even to my friends. F—k these big tech platforms, I’m not giving you any sharing data!
Same here, the awful thing is if they click on it, they cannot see the comments under the video and can only “reply” to you. Not sure what that should do, since the link has already been shared.
On android, urlcheck is a great app to modify URLs before sharing or opening. For this problem, you can use the json editor, and add the following two entries with small a regex I wrote:
"shorten Youtube": { "regex": "^https?:\/\/(?:[a-z0-9-]+\\.)*?youtube\\.com\/(.*)&.*", "replacement": [ "https:\/\/youtube.com\/$1" ], "enabled": true }, "shorten Youtu.be": { "regex": "^https?:\/\/(?:[a-z0-9-]+\\.)*?youtu\\.be\/([^?]*)?.*", "replacement": [ "https:\/\/youtube.com\/watch?v=$1" ], "enabled": true },A button to shorten the link appears in urkcheck when the pattern matches. You can all auto shorten them by replacing “enabled”: true
With
“automatic”: trueWow. This is awesome. Thank you! I will have to see if the dev has a donate button.
FWIW I had to noodle with the spacing of your json after copying from Lemmy (Voyager android app) but I got it to work. Thanks for sharing!
Pipepipe does not include this tracking, by default.
Same with freetube (which can be used for both mobile and desktop)
Same with LibreTube.
Hopefully NewPipe does the same, as PipePipe’s successor.
Newpipe and Tubular also share videos without the tracking, by default.
Nice!
I’m preeeeety sure PipePipe is the successor. Or atleast a different fork with more updates.
You are correct. Or, rather, not the successor but an independent fork (doesn’t necessarily adopt upstream changes).
I don’t know what the hell I saw just the other day. I am 100% certain that I read that some GitHub project I was looking at said it was a fork of PipePipe, or in reverse, that “you should use NewPipe as it supersedes this repo”.
🤨 I need to dive into my browser history…
Edit: ah! It was PipePipe! I just misinterpreted this line:
NewPipe, reimagined: faster, more stable, and packed with more features.
I took this to mean:
NewPipe is a reimagined fork of this project, which is faster, more stable, and packed with more features.
🤦♂️💁♂️ D’oh.
Grayjay does too.
Revanced strips it when copying or sharing the video url
