Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways. What are the security advantage of new redirecting method used by gmail and Facebook?

share|improve this question
2  
What is the "other way", and what is the usual way to make a redirection? –  curiousguy Aug 6 '12 at 14:49
    
Just popped open gmail, and links are presented as standard <a> tags to me. –  Graham Hill Aug 6 '12 at 16:20
    
@GrahamHill While it looks like regular links to me. When a new page is opened it appears that it has a google address for a second then redirects. Maybe handled by JavaScript. My guess would be for tracking purposes by Google. –  Travis Pessetto Aug 6 '12 at 16:38
    
i posted a link(fcbarcelona.com/football/first-team/detail/image_gallery/…) in facebook. when click on link i get this url www.facebook.com/l.php?u=http%3A%2F%2Fgoo.gl%2F7zwY5&h=JAQHfoVEuAQF4tNib9gAmMNEb‌​yjZje3sdb_Hb9jBNnNZikg&s=1 after some time i reached the page fcbarcelona.com/football/first-team/detail/image_gallery/…. why directly redirected to my posted url –  ebola virus Aug 6 '12 at 16:44

2 Answers 2

up vote 5 down vote accepted

This has nothing to do with security, really. It's about statistics and advertising.

When you put in a link like this:

http://example.com/foo.bar

You get this:

http://www.facebook.com/l.php?u=http%3A%2F%2Fexample.com%2Ffoo.bar&h=<hash>

So, when you click the link, l.php verifies that the h parameter matches the u parameter for security purposes, otherwise it's an open redirection flaw.

The script then logs that you clicked the link. This allows Facebook to get information about how you interact with their service, e.g. Alice shared a link, which Bob and Eve clicked. It also allows them to identify topics you're talking about, even when sending links to each other, for improved ad relevance.

As Hans mentioned, the other part of this is to preserve privacy. When clicking a link, the target server is told, by the browser, which page you were linked from. If you clicked the link whilst viewing Facebook, this might leak your identity or the identity of one of your friends to the target site.

share|improve this answer

There are two reasons for the intermediate page:

  • It prevents sensitive information in the url of the current page to leak to the other side in the "Refer" header because the Refer-header will now contain the url of the intermediate page only.
  • It allows the email or social media provider to track clicks. They use this information for spam rating and might use it to increase their knowledge about your interests.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.