jonathanKingston / fix-my-http

A trial into fixing padlocks
MIT License
1 stars 0 forks source link

PII leaks to archive.org #8

Open jonathanKingston opened 7 years ago

jonathanKingston commented 7 years ago

To prevent personal info going over to archive.org I want to suggest stripping get params from going to archive.org

Such that:

Example url: https://web.archive.org/save/https://www.youtube.com/watch?v={video-link}&utm_source={source}&utm_campaign={campaign}&utm_medium=email&utm_term={thing}

The problem being is the stripping would also break the above URL.

The extension could have a filter list of known bad tracking query strings which could be auto filtered then ask the user for permission to use other query string params.

Such that:

I would rather not have a whitelist per origin of "safe" query string keys, however that could be considered certainly.

Conversation with @bunnybooboo note: HTTP jail functionality hasn't been uploaded yet but basically allows a page action to open the HTTP page unhindered in an iframe

Also this should probably be solved before fixing why https Youtube video links aren't working correctly :D.

jonathanKingston commented 7 years ago

Some mailchimp links like: http://{redacted}.list-manage2.com/track/click?u={something}&id={else}

Jump through to the site and redirect to a http link with PII in them like the above.

The process is: