101

Update (Jan 8, 2019)

This is now 8 years old, but still getting occasional upvotes/attention, so I thought it's worth giving a summary of the current state. Despite originally being , over the last decade some changes have made the privacy implications much clearer. You now click "share" instead of "link", and the pop-up is very explicit that the link includes your user ID.

There is a feature request asking that this user ID be anonymized or hashed, to allow users to earn publicity badges (the intention behind having the user ID present in the URL, as per Jeff's reason for declining this) while eliminating the privacy issue.

Original Post

It seems to me there is something of a privacy leak when permalinking to a question. For what I would assume is the purposes of tracking which user is responsible for bringing traffic back to an SE site (for badges, etc.), the user ID of the user obtaining the permanent link is included in the permanent link itself.

I wouldn't argue that this shouldn't be the case, but I find no warning or mention of this when I do these actions. I'm sure I'm not the only one that doesn't desire anonymity on SO but would like at least pseudonymity on some places I might share a SO link, such as on a random blog.

Tooltip as shown when hovering the "link"

As a user, I would not expect sharing a permanent link to leak my identity. Unless you are familiar with Stack Exchange links or your own userID, it's certainly not obvious by looking at the link that it includes your personal info. It'd be nice to have fair warning that using that feature will do so, and perhaps provide/describe the workaround: to simply remove the user-id segment from the URL. Other features would be a preference that formats future permanent links to exclude the user id.

Example (from this question)

Improve this question
22
  • 8
    Your assumption is correct - the permalink is explicitly designed to contain your ID for the purposes of the badges like Announcer (and maybe other tracking). Answers don't have this, though, and as a workaround you can always use the question's title - it's a URL that does not feature your ID.
    – Grace Note StaffMod
    Jan 7, 2011 at 20:50
  • 13
    Or you could edit the link: meta.stackexchange.com/q/74274
    – jjnguy
    Jan 7, 2011 at 20:53
  • 10
    Definitely. @JJnguy's workaround is what I was hinting at in my question. I know workarounds already exist; my fear is that people won't even discover the privacy implications involved until it's "too late." I don't know, maybe it's just something the community at large isn't too concerned about.
    – Mark Peters
    Jan 7, 2011 at 20:56
  • 5
    @Mark: Just FYI in case you didn't know, there are things in your profile that only you can see (okay, devs and moderators can see it too, but that's a tiny group of people). Your email address and OpenID info remain hidden to everyone else. Linking to that page shouldn't be a privacy concern.
    – Bill the Lizard
    Jan 7, 2011 at 21:19
  • 41
    @Bill: You're missing the point. I'm not worried about that stuff being public. I know what is public in my profile and I'm fine with that. The point is, the user-id in the link could be an unintended way of publishing your identity in some context where you where aiming to have pseudonymity.
    – Mark Peters
    Jan 7, 2011 at 21:24
  • 2
    I generally get the permalink by right-clicking the question title instead of using the link button.
    – mmyers
    Jan 7, 2011 at 21:34
  • 2
    @Mark: I understand the point. I was just commenting in case you were worried about those extra bits of info getting out.
    – Bill the Lizard
    Jan 7, 2011 at 21:35
  • 1
    As an aside: this has been in place since August 2010 or earlier.
    – Arjan
    Jan 22, 2011 at 12:58
  • 5
    IMHO, complaining about privacy on SO is... what can I say... dumb? Honestly, just delete your id if you complain so much about it. But if this feature is gone then I will start to complain.
    – BrunoLM
    Jan 22, 2011 at 13:07
  • 1
    As I quite often see these links used in comments, I guess many people indeed don't know about this. (If they would know: why not use the full links, so one knows what the link refers to without clicking? I sometimes make the same mistake, but seeing no warning at all, I really doubt many know.)
    – Arjan
    Jan 22, 2011 at 13:11
  • 5
    Because of the 2nd paragraph of the question, @Bruno.
    – Arjan
    Jan 22, 2011 at 13:29
  • 5
    Some counting: since August/September 2010, about 300 SO users (accidentally?) used the short referral links on SO itself. (This does not count towards getting an Announcer, Booster or Publicist badge, so no benefits from that referral. But as such referral links lack the descriptive title —and hence need clicking to see what one is referring to— my guess is that folks would have posted the full link if they were aware of this.)
    – Arjan
    Jan 27, 2011 at 20:23
  • 16
    +1. User privacy matters. It's a big deal.
    – TRiG
    Sep 15, 2011 at 2:17
  • 3
    Now also for answers. (And, @jcolebrand, no easily accessible way to get the full URL there, if one is aware of the tracking to start with.)
    – Arjan
    Nov 29, 2011 at 20:58
  • 2
    As mentioned on MathOverflow Meta, identity of a reviewer of a scientific paper was leaked in this way: Privacy of software-generated links to questions and answers. At least making it more clear to the users who copy that link that it includes userid would be an improvement. (IMO it would be entirely satisfactory solution.)
    – Martin
    Sep 12, 2020 at 9:13

9 Answers 9

Reset to default
72
+50

Another option is to change the text from "link" to "referral link" when someone is logged in, so they are aware that it's a referral link. If they don't want a referral link and deleting their userid is simply too much trouble, they only need to right click the post title and copy the URL.

This should resolve the problem:

  • It alerts users that this link is a referral link, and may contain user specific information
  • There is another link on the page already which does not contain that information

Most people who regularly share links are used to getting links from the title of blog posts, and those who care about being able to use a sanitized link will either figure it out, or ask on meta.

The majority of SO users won't care, but they will at least be alerted via the use of the word "referral".

Further, since the code already exists to differentiate between a logged in and not logged in user (ie, the link is created with a uid or not) then the code to change to a referral link is minimal.

Improve this answer
4
  • 4
    I like that!
    – Arjan
    Jan 22, 2011 at 17:19
  • 5
    I like this option. After all, it wasn't the fact that it's a referral link that bothered me, but rather that there was very little transparency that it was a referral link.
    – Mark Peters
    Jan 22, 2011 at 19:43
  • As an aside: the same referral links are used in the "Know someone who can answer? Share a link to this question via email, twitter, or facebook." links (only appears when there are no answers yet). It's a bit harder to change the text there, I guess. Well, Share a referral link might do, of course!
    – Arjan
    Jan 23, 2011 at 11:44
  • 5
    I'm not sure, "referral link" is clear enough, you just see "link" and use it. It's a good idea, but there should be some warning on the first use, anyway. I'd prefer an anonymous link as the default with the possibility to change it to referral link for those who like it.
    – maaartinus
    Jan 24, 2011 at 5:09
48

I agree that the current behaviour is surprising. One would expect a clean link behind a "link" button, not a referral.

I suggest adding a second, anonymous linking option:

link · link (anonymous) · edit · close · flag

this is trivial to implement, makes the user aware of the issue, and gives them all the options they need.

Improve this answer
34

Since March 2011, clicking "link" now always shows a popup (while right-clicking still makes most browsers show something like "Copy link address"):

The share a link popup after clicking it. How does that work in screen readers...?

The text is different for questions and answers:

share a link to this question
share a link to this answer

Would it be feasible to just change this, when logged in? Like:

share a referral link to this question
share a referral link to this answer

Or even one better, to allow easy access to the full URL for answers too, some nifty way to toggle the type of URL? For both questions and answers:

toggle anonymous and full url

Likewise, with a different wording based on the link that is currently shown:

Link options Link options Link options

(The tooltips are still "short permalink to this question" and "short permalink to this answer". When logged in, changing these to read "short referral link to ..." would be great too! And adding "referral" to the "Know someone who can answer? Share a link to this question via email, twitter, or facebook." message as well, would lower the chance of accidental referrals even more: though on social networks sharing is non-anonymous by definition, that link might unexpectedly associate accounts as well.)

Improve this answer
18
+50

I also felt annoyed by the presence of the user ID on the short permalinks — not so much due to the privacy issue, but simply because I mostly use those links within the SE network, where the user ID is useless (you don't get badges for sharing links inside the network) and just wastes characters.

As a result, I added something vaguely similar to Arjan's suggestion into the Stack Overflow Unofficial Patch (SOUP) user script. Instead of toggle links, however, my fix simply adds a second ID-less version of the URL into the share popup, like this:

Screenshot

The URL with the user ID is still selected by default (because SOUP doesn't do anything about that), but if you prefer to use the anonymous URL, you can simply press Tab to move the focus into the second textbox before copying its content with Ctrl+C.

This change does make the popup a bit bigger, but I haven't observed any problems with it in practice. The fix has been in the SOUP development branch for almost a year, and is now included in the just released stable version 1.46.

Improve this answer
9
  • Actually since the switch to https, the badge is granted for internal links as well.
    – Shadow Wizard Love Zelda
    Sep 6, 2017 at 12:05
  • @ShaWizDowArd: That does indeed seem to be the case, although I suspect that's a bug. At least I've seen no indication that it would be intentional.
    – Ilmari Karonen
    Sep 6, 2017 at 12:12
  • It's something technical: as far as I know, when using https, the referer header is not being sent or can't be used anymore, and the check for internal link (at least for that badge) depends on this header as there is no query string info where the user came from.
    – Shadow Wizard Love Zelda
    Sep 6, 2017 at 12:16
  • Well, in that case let's hope the team will fix this, though being minor bug the chances are very low.
    – Shadow Wizard Love Zelda
    Sep 6, 2017 at 12:27
  • FYI: Yesterday's update to SE's HTML has resulted in the SOUP fix for this no longer working.
    – Makyen
    Aug 29, 2019 at 3:28
  • I would also suggest to increase this popup's width just a little bit so that the urls fit completely without the need for horizontal scroll.
    – user1306322
    Dec 9, 2019 at 6:00
  • @ShadowWizardWearingMaskV2, does bug reported that internal links are counted? Or it was intentional change? In current badge description meta.stackexchange.com/help/badges/75/booster there is not mentioned , that they applicable for external links only
    – Michael Freidgeim
    Jul 2, 2021 at 23:05
  • 1
    @MichaelFreidgeim yes, see this. You can start a feature request to change the badge description to match the actual behavior, yeah.
    – Shadow Wizard Love Zelda
    Jul 3, 2021 at 8:11
  • Although I like the idea of referral URL for badges and stimulating the growth of smaller sites, this is the best option: Offer a referral and anonymous URL when 'share' is clicked.
    – Bob Ortiz
    Nov 29, 2023 at 10:15
13

If this feature request gets enough upvotes (ie, a lot of people are concerned about it, and want it changed) then one way to implement this is to add a user-preference in the user account screen which disables the userID on links. It seems to me that those who would be concerned about this would want to set it and forget it.

Improve this answer
5
  • 3
    But I doubt many people are that interested...
    – Pollyanna
    Jan 7, 2011 at 22:31
  • 6
    Yes, that's what I was getting at with the last sentence in the question. But from my perspective it's not the hassle of anonymizing the link, it's just the fact that nowhere are you warned that you ARE leaking your user id.
    – Mark Peters
    Jan 8, 2011 at 1:04
  • 2
    If we did that, then we'd have to disable it by default, or we'd also be accused of Zuckerpunching people in the Atwood, or Spolsky, whichever sounds more anitomical.
    – user50049
    Jan 22, 2011 at 13:20
  • An easier implementation would be to add the message on the title of the link. I wouldn't like to see privacy settings on SO. But this message is ok if it shut up this stupid request (IMO)
    – BrunoLM
    Jan 22, 2011 at 13:31
  • 1
    It should be opposite way - privacy by default!
    – 16851556
    Sep 20, 2022 at 5:03
9

This is implemented to support the Booster, Promoter, and Publicist badges:

https://blog.stackoverflow.com/2010/09/announcer-booster-and-publicist-badges/

You can always just delete the user ID from the shortened URL -- it will still work.

Additionally if you browse in incognito (anonymous) mode the URLs do not contain the userid, since obviously you have no user id from the site's perspective -- you're not logged in!

Improve this answer
5
  • 6
    That's a relevant point about incognito mode, although most privacy mode that browsers provide still enable cookies (they just don't carry over from the normal session and they are deleted at the end of the session) so it doesn't prevent you from logging in. Anyway the point wasn't about not having a workaround, it was the fact that it is completely hidden to a casual user that the user id is leaked. I'd just settle for a warning or even the link being something like http://stackoverflow.com/q/#####/####/mark-peters where it's obvious.
    – Mark Peters
    Jan 8, 2011 at 0:58
  • 3
    Personally I wouldn't envision scenarios where it would be so critical to be in incognito mode anyway. I'm not talking about high-risk spying in general. One simple example is just some blog where I'd rather remain anonymous. Like thedailywtf.com. I trust the community here to not do dumb stuff after finding out some basic information about me more than I do on that site.
    – Mark Peters
    Jan 8, 2011 at 1:02
  • @Mark, I'd rather not include the display name: currently, changing that name does not change it on the many copy cat websites that republish the SOFU content. Adding the display name to the links as well makes it even slightly harder to change one's name at some later time, after one has posted it somewhere.
    – Arjan
    Jan 22, 2011 at 13:16
  • 19
    Hey @Jeff, can you comment on why this has been declined? Not enough interest? Privacy isn't a concern here? I only ask because it seems in your answer above that you think somebody was suggesting that the user id shouldn't be in the link. We weren't saying that; we were just asking for a little more transparency/warning that it was a referral. If it's declined I wouldn't mind knowing that the powers at be actually understood both the problem and the request.
    – Mark Peters
    Jan 27, 2011 at 20:52
  • 18
    This is so wrong. A permalink should not contain user information. It should point to the content and nothing more. With this kind of links a user is traceable all over the internet. I prefer privacy over badges but do you prefer privacy over site traffic?
    – Nick
    Mar 22, 2011 at 14:41
5

...or at least use a query parameter, like http://meta.stackexchange.com/q/74274?user=151280 to make clear(er) what's going on. Yes, that's a few more characters.

And no, please do not also add it to full URLs then...

Improve this answer
2
  • Good idea, but I think it is a technical matter of URL Rewriting, not sure it's possible with querystrings, at least not with a major tweak.
    – Shadow Wizard Love Zelda
    Jun 25, 2016 at 15:47
  • The current URLs redirect to ones without the user id (but with the full slug), so the statistics are handled during the redirect/rewriting. Easily done using query parameters as well, @ShadowWizard.
    – Arjan
    Jun 25, 2016 at 16:48
4

Stackapps SOX has this feature as "Remove your user ID from the 'share' link"

Improve this answer
-5

I don't see how this is a problem.

Your Stack Overflow profile is not private. And the post that you are linking to is not private. And it is clear that you are associating yourself with the link that you post when you post it.

I'm not sure what privacy is lost by placing the user id in the URL.

Improve this answer
9
  • 11
    Why is it clear that you are associating yourself with the link that you post when you post it? What if you're just sharing a link to something like stackoverflow.com/questions/194812/…. Not only are there so many users there that they'd never be able to guess who you (the link-sharer) are by looking at the thread, there is really no reason to believe you are associated with that question. You could just think it's a cool thing to pass on. And by doing so, you've ruined any pseudonymity you had where ever you posted it.
    – Mark Peters
    Jan 7, 2011 at 21:19
  • 3
    @Mark, I guess I assume that whoever you share a link with would make the connection between you the link poster and you on stackoverflow. I know they would for me for sure.
    – jjnguy
    Jan 7, 2011 at 21:32
  • 35
    Ok let me describe a hypothetical scenario. Say I was an active member of a mutually anonymous group that published opposition opinion pieces in some dictatorship without freedom of speech. I survive only by nobody knowing my true identity there. In parallel, in my normal life, I am a software professional with a StackOverflow account asking questions and giving answers in a safe way that doesn't belie my "secret" behaviour. One day, somebody on this site asks me a technical question. I find the answer on a StackOverflow question and post it. Boom, all my pseudonymity is gone; I'm dead.
    – Mark Peters
    Jan 7, 2011 at 21:56
  • 7
    @Mark, i'm sorry to hear of your plight, but that is totally unrealistic. And, if you were leading a double life, you would be much more careful about everything you did.
    – jjnguy
    Jan 7, 2011 at 23:09
  • 25
    @JJnguy: It's not my plight. It was just a scenario to demonstrate the issue because you were missing it. It's not entirely unrealistic, but in reality it'd be more like something like "I want to remain anonymous on Reddit but reveal my true identity on StackOverflow". If I naively post a permalink to Reddit I've leaked my user id.
    – Mark Peters
    Jan 8, 2011 at 0:54
  • 22
    @Justin: It's not AT ALL unrealistic. It's exactly how dissidents get discovered and killed.
    – Nicholas Knight
    Jan 22, 2011 at 15:07
  • 1
    @NicholasKnight Do you have a real-world example? With a contrived example, one can prove anything.
    – user164291
    Dec 13, 2011 at 21:26
  • 22
    Here's my scenario: After 15 years in Usenet under my real name, I have found enough reasons to keep my true identity completely separate from my SO identity, and I'd do a lot to keep it that way. So far, there is no publicly available link between the two. However, should I ever publish such a link under my true identity, this separation would break down. Note that it is completely irrelevant whether I am an endangered dissidents or what else my reasons for this are — just be assured that I would consider completely wiping out this 60k+ account if it got compromised.
    – sbi
    Jun 7, 2012 at 11:04
  • 10
    Here’s four people who have been materially affected by a breakdown in the separation of their online and offline lives: a gamer, a journalist, a security researcher, and a divorcée. Not to mention scores of victims of harassment, employees with intrusive bosses, women who are denigrated once their gender becomes known, and so on. The consequences don’t have to be life and death for privacy to be important.
    – duozmo
    Jan 9, 2016 at 22:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .