1

Suppose I’m logged into YouTube or Amazon, and I use their web pages “share” button to copy a link for the video/whatever into my paste buffer. Does this copied URL embed encoded info that specifically identifies my user account?

2 Answers 2

1

There is no generic rules stating what what a website must or must not do in this case.

For example, YouTube does not add any parameter tied to a user id in the sharing link. The link format is https://youtu.be/dQw...XcQ where the random string is the video id.

However, Stack Exchange does add the user id. The sharing link format is https://security.stackexchange.com/q/266612/91652 where the first parameter is the question id, and the second one the user id. It can be removed without breaking the link.

0

There is no simple yes/no answer, since services differ and link policies may change without notice.

A click on an URL may associated to your person in different ways:

  • inheritently in the link itself by a "user ID" attached. Lock at the link: does it contain enough apparent entropy for the likely number of users of that web service? "https://servicedomainxyz.com/currentoffers" is possibly, but unlikely a uniquely generated URL for 1000 web shop users, as compared to "https://servicedomainxyz.com/currentoffers_1234567/ABCDE". This may even change the way you copy the URL, e.g. using manual copy/paste of URL line or Chrome's share button, vs. e.g. stackaxchange share button below a question. Have the clipboard pasted as plain text and look at it befor you disseminate it.
  • URLs may be of low appaent entropy, but sent only to a limited number of people - if it is clicked, it was (one of) you (or a crawler/bot that randomly tried addresses). Is the URL known (or likely) to be reached via links from generic URL? Then it is likely to be visited by crawlers/bots more often, and seems less likely to be constructed for identification/tracking.
  • beyond that and out of scope of this question, of course there are more possibilities such as that the web page contacts the sender to load (possibly small and white, unvisible) images or do fingerprintimg of your system (OS, browser, screen resolution, fonts installed...). Also assuming network traffic interception is out of scope.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .