Tjyylli

I've noticed a long time ago that links that are posted on facebook are somehow handled in a twisted way. If I hover with my mouse over the link or page preview, my browser (in this case, Safari for Mac) displays the expected link that was pasted in the post (e.g. http://www.example.com/). BUT if I right-click and copy the link, then paste it in some new tab's address bar, the URI is quite different: it's gonna be something like https://l.facebook.com/l.php?u=http%3A%2F%2Fwww.example.com%2F&h=xxxxx where xxxx is actually a unique identifier, no doubt linked to my account and whatever else. I'm assuming that facebook uses this to track what people click on. I'm wondering whether they're trying to "conceal" that fact by using a scheme where the browser doesn't show the effective, tracking link. I've looked at the HTML source and it looks like the a tag uses the proper URI as its href attribute, but then it has two additional attributes, data-lynx-mode with value origin (from what I've seen, there may be others) and data-lynx-uri which contains the link that is actually copied and followed on user interaction, the one I've mentioned above. I've done a quick search on the net and couldn't find much documentation about these attributes -- but they seem to be mostly if not only used in connection with facebook links -- although the browser seems to react in a particular way to them, somehow inconsistent because what it shows in the status bar is different from what it copies to the clipboard. Does anyone have more information about them? Could they be simply proprietary and used by some javascript code that would override the normal link following? Can they be "ignored" so the browser follows the proper link instead and doesn't feed facebook's profiling machine?

Thanks for your ideas!

EDIT:

stachu's answer works well (using Tampermonkey for Safari, I'm taken directly to the original page when clicking a link), however it's not quite sufficient for my particular use: I'm using different browsers for Facebook and general browsing (call it paranoia), and what I usually do is copy the link from Safari and open it in the other browser. Right-clicking and selecting "Copy link" from Safari still gets the tracking link, not the actual href. I'm trying to find out what happens when I do that, maybe some javascript catches the action and garbles the link, or does Safari default to copying this data-lynx-uri when it's present??

EDIT 2:

Facebook does juggle back and forth with the link, changing the value of the href attribute to the contents of data-lynx-uri when a right-click occurs, and setting it back to its original value when you hover over the element – to me it really looks like they're just trying to obfuscate the display and fool the user into not seeing the redirection. I'm trying to catch the right-click and restore the value of the link using javascript/Tampermonkey, but for some reason my function is not getting called :-|.

document.addEventListener('contextmenu', function(e) {

    Array.from(e.target.attributes).filter(attribute => attribute.name.startsWith("data-lynx-")).forEach(attribute => e.target.removeAttribute(attribute.name));

    var href = e.target.getAttribute("href");

    var regex = /^https://l.facebook.com/l.php?u=(http.*?)&.*$/;

    var match = regex.exec(href);

    if(match[1]) {

        var uri = match[1].replace(/%3A/g, ':').replace(/%2F/g, '/').replace(/%26/g, '&').replace(/%3D/g, '=').replace(/%3F/g, '?');

        e.target.setAttribute("href", uri);

    }

}, false);

You can add your own scripts to Facebook site using, for example Greasemonkey if you are using FireFox.

Example script which fires on each click

document.addEventListener('click', event => {

    let target = event.target;



    if (target.tagName.toLowerCase() === "a") {

        Array.from(target.attributes).filter(attribute => attribute.name.startsWith("data-lynx-")).forEach(attribute => target.removeAttribute(attribute.name));

    }

})

If target element (which you clicked) is a link (a tag) script removes data-lynx-* attributes.

You should check that some scripts have href attribute changed into Facebook tracking links (domain l.facebook.com) and add this case to your script.

You should check that this script works even with AJAX added content.