Camas already has a history with web security issues. With that context, the city of Camas recently posted an update on the Lake-Everett Roundabout Project (WARNING: please read this article in full before clicking any of the city's links in that update, shown here).
The update included drone footage of the cut area where hundreds of trees were removed in the past month. The update text has two URL links included, one to that drone footage and one to one of the city's two web pages tracking the Lake-Everett intersection.
Readers may be familiar with "masked hyperlinks". You'll normally see these as descriptive words or phrases (typically blue and underlined) that you can click to lead to a separate web page - the most common example is something like:
"learn more about the latest news in Camas here"
In that example the word "here" links out to the WATCH Camas home page. It's a way to not have to post a long (sometimes ugly) web addresses with random strings of letters and numbers along the lines of "website.com/hd4856hgf8sdj".
Regardless of how these links present, you should always hover over them BEFORE clicking. While hovering, if you look to the bottom of your browser usually, you'll see the actual link you're being taken to regardless of the "mask" you might see in blue underlined text (on mobile, you can usually long press on the link and you can see a full URL depending on your device) .
For example, when you hover over the WATCH Camas logo on the top left of your screen, you will see that it links you back home to www.watchcamas.com as expected.
But what happens when you hover and the link doesn't match what you expected?
Is it safe to click?
As mentioned, the city's recent update had two masked hyperlinks. The odd thing was that they were both masked versions of full URLs with that random number "gobbledygook" mentioned before. So it would seem that the city was just copy and pasting these longer, "ugly" links, but in fact, the links go to different websites in both cases - Why?
Well, there are two examples of when this makes sense to do (A) when a website's URL is small and you want/need to promote it (i.e. watchcamas.com). (B) when an author is being lazy or is unable to create a masked hyperlink for some reason (This is true on website's like Twitter for example). So what happens when you hover over the two links on the city's roundabout update post right now?
LINK 1
What's shown to readers:
https://vimeo.com/417658306/dc28fa540f
What the actual HIDDEN link looks like:
https://vimeo.com/417658306/dc28fa540f?fbclid=I456wgXctu4RLNrAew37r4gXctu4RLNrAeNrAeooVgKiLjgBpnRrAe2GgXctu4RLNrAe3CegXctu4RLew37r4gNrAe
LINK 2
What's shown to readers:
www.cityofcamas.us/lakeroadconstruction
What the actual HIDDEN link looks like:
https://l.facebook.com/l.php?u=http%3A%2F%2Fwww.cityofcamas.us%2Flakeroadconstruction%3Ffbclid%3DIwO7P9yEBDoJ-S5FzW1VaBYF-sLkdneBNdTQuD7hesO8QJbVeBmQ8hnaS9T-nc&h=AT0Pv1TvjFcAwGYk4JUwrHD4r8ZrGF3p5MCLZlxsO7P9yEBDM1JEPS11LhWmF3p5MCLZlxsO7P9yEBDg9qsaJg4-R2HzwZnkk1BlCnGkE9VWUnOif0XaBt52YLzZMSmkO7P9yEBDoJ-S5F70Wkm-P-U7_BBej7fT7T1TGhmElnPPg6HQ5IhrAR2Sm83Adp5mMbKtqWITAqLuUR86qWHO7P9yEBDoJ-S5FGQIHomGsXJFezI2sBjLlxsO7P9yEBDcw0IHKWRcwjXVgI60aTlGj9tjLuqB_jM5U9obMrFIzoFvwsZ59jzQdViaV688KxhO6WJ3LIM0F3p5MCLZlxsO7P9yEBDM1JEPS11LhWmF3p5MCLZlxsO7P9yEBDg9qsaJg4-R2HzwZnkk1BlCnGkE9cDncq1WfbFbBmBnmO7P9yEBDoJ-S5Fnqsp6z7j4zS1DIIp8xyxCZrSSTDuHWamdjs6POYqsJGoXQ5xSekM8rbESIg7K0sekYwE2Fh_LHYO7P9yEBDoJ-S5FyEBDoJ-S5FBDxSekM8rb
Why would anyone mask an "ugly" link to show a longer or entirely different "ugly" link? Why does "www.cityofcamas.us/lakeroadconstruction" link to a gigantic Facebook URL and show users this screen when they click?
This page appears because Facebook can't get away with practices like this anymore without disclosure to a user. When you see this page you are being redirected through facebook so that your profile can be linked and tracked. Basically, it would seem that before a citizen goes to the lake and everett construction website, the city of Camas would like to know who you are, who your friends are and what kind of stuff you're saying on social media.
With increased attention on this practice, Facebook isn't going to be potentially liable for the nefarious monitoring tactics of businesses and even the occasional municipality it seems. But again, by redirecting you through Facebook, Camas gets to know exactly who you are as you click on that link - regardless of security measures you may take (like ad blockers or VPNs). This tracking is through a device called a Facebook Click Identifier or “FBCLID”. Here’s a little more about “tracking links” like the FBCLID and the dangers they may pose. Here’s an important snippet from that article,
“Let that sink in. Every time you forward a link with tracking info to a friend, you may be helping the tech giants build a map of your social network that goes beyond what they already have. Think about the Cambridge Analytica scandal, made possible by following social links. Now you see why this matters.”
There are direct links to both of this pages that involve no Facebook tracking ID, but the extra effort was made to not use those links and create redirects. Who at the city approved this unethical practice and what is the resulting tracking being used for?
@WATCH Camas Staff My first initial and last name are normally an accepted ID or handle, but since you ask us to use the name we'd use around town I'm happy to oblige! No need to be haughty about it. When you provide people with the right opportunities they always reveal who they are, but even when they're naughty, syntax and style gives people away every time.