Invisible Click Tracking Using “Empty” UTF-8 Characters

by konstruktorson 2/14/2015, 9:28 AMwith 36 comments

by thegeomasteron 2/14/2015, 1:34 PM

Just to point out that hovering over the link shows URL-encoded codepoints, i.e. %u200B (in Firefox, for me, at least). I do think it's a better solution than the existing approach with GET parameters which does look clumsy.

by shared4youon 2/14/2015, 12:41 PM

Nitpick:

> The idea is to use zero-width and space characters of UTF-8 such as U+200B, U+200C, U+200D

That must be Unicode, not UTF-8.

by mrgriscomon 2/14/2015, 1:25 PM

Isn't this exploiting the same kind of Unicode ambiguity that allowed phishing sites to impersonate trusted domains by substituting certain latin characters with identical-looking cyrillic equivalents? I would expect this capability to last long in the wild.

by imjustsayingon 2/14/2015, 12:43 PM

Anyone have a suggestion of how this would be used in practice for uniquely identifying something?

So there are a certain number of non-width space characters. As far as I can find in the links in the OP, U+FEFF, U+180E, U+200B, U+200C, U+200D would make 5.

So we have at least 5 values to work with, which would make... 120 combinations if they're ordered differently? Surely we would need more if we want to uniquely identify something such as a referral, or are there more non-width spaces?

I'm kind of dumb and bad at probability, also. You're encouraged to correct my thoughts on this and show me the errors of my thinking.

by boscomutungaon 2/14/2015, 11:09 AM

i don't see any variables in the url when i run the inspector.

by theunixbeardon 2/14/2015, 11:24 PM

So who would pay for a tool to make creating/handling/analyzing these links as easy as using UTM parameters?

by jkoton 2/14/2015, 2:01 PM

There are only a few chars, so urls grow huge, once click count increases. JS is probably better

by cturhanon 2/14/2015, 9:12 PM

Post as many as character you want and it will work. Here:

http://kaspars.net/blog/web-development/invisible-click-trac...

by belornon 2/14/2015, 11:59 AM

Does this also work in mail readers?

by andybakon 2/14/2015, 11:35 AM

I actually like this. Assuming you agree there are non-creepy reasons to track clicks (not a given on HN) then this lets you keep your urls nice and clean when people just want to copy and paste them.

I imagine it might break in some scenarios (the url ends up with junk in it from bad unicode conversion) but it's up to you to be permissive in the urls you accept.