IP: We know where your looking -- from RISKS

[Dave Farber <farber@cis.upenn.edu>]

Date: Sun, 25 Apr 1999 15:21:14 -0500 
From: "Richard M. Smith" <rms@pharlap.com> 
Subject: What's DejaNews up to?
One of my favorite Web sites is DejaNews, the search engine for Usenet 
newsgroup messages. Yesterday I discovered a new "feature" of DejaNews 
which I don't understand.
It seems that when a newsgroup message containing URL's is displayed, the 
DejaNews server is silent changing the links to be routed through the 
DejaNews servers. This new feature allows DejaNews to track when a person 
clicks on a Web site link in a newsgroup message. You still get to the Web 
site, you just go through the DejaNews servers first. My understanding is 
that the new feature was added a couple of months ago.
Here is a quick example of what DejaNews is up to:
Original link: http://www.yahoo.com 
Tracking link: http://x12.dejanews.com/jump/http://www.yahoo.com
Apparently the DejaNews servers simply redirect your browser to the real URL 
after recording where you clicked. In the newsgroup message itself, the 
original link is shown, not the tracking link.
An easy way to defeat this tracking mechanism is to manually copy the link 
in the message text to the location or address window of your browser.
I ran a simple experiment and found that a Web site will still get the 
referring URL which is the URL of the newsgroup message. So one thing that 
DejaNews is not trying to do is block Web sites from knowing where a click 
came from. 
Pretty obviously, DejaNews knows a lot about me already by my searching 
habits. Why do they now also need to know what Web sites I'm visiting? 
What is being done with this information? 
Pretty odd if you ask me. What I can't figure out is what DejaNews is up to 
here. Does anyone have any ideas?
Richard M. Smith <smiths@tiac.net>
[Added note: It gets more interesting. DejaNews is also tracking 
e-mail addresses. When one clicks on an e-mail address in a newsgroup 
message, it first goes thru the DejaNews server before being redirect as a 
mailto: URL. DejaNews ends up know who and when someone is sending e-mail 
to. This is just plain weird.]
Here is more info from comp.security.misc:
donoli wrote:
 > Exactly. Since they are chaining the URL, they get credit for bringing 
 > users to the second site.
Yep, Web sites with high click-thru rates get called first by their friendly 
DejaNews ad rep!
Maybe the next step here for DejaNews is to somehow figure out how to charge 
Web sites for click thru's. Toll booths on the Internet? For example, maybe 
DejaNews only highlights links for Web sites that have DejaNews 
accounts. Each click-thru then costs a dime.
Why DejaNews went through all of the trouble to also track e-mail makes no 
sense at all. It's just plain rude. I've asked their privacy people and PR 
people what's going on. Hopefully they'll get back to me today.
BTW, According to Junkbusters.com, the hotbot search engine also does the 
same trick for Web sites. They are tracking click-thru's in search 
results. None of the other major search engines (AltaVista, Yahoo, Lycos, 
and InfoSeek) appear to be doing this.
Richard