1787704 - Add Yandex ysclid to Query Parameter Stripping

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, enhancement, P3)

Description

[leo]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0

Steps to reproduce:

1. Search yandex for example for github
2. Navigate to github

Actual results:

Navigation to github.com

Expected results:

https://github.com/?ysclid=l7eiuldcq7460308795

Yandex are trying to circumvent 3rd party cookie protection by passing ysclid

More info here https://webmaster.yandex.ru/blog/novyy-parametr-dlya-bolee-tochnogo-raspoznavaniya-poiskovykh-fraz-v-metrike

Comment 1

[leo]

Should be linked to https://bugzilla.mozilla.org/show_bug.cgi?id=1787704
(don't know how to link)

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Privacy: Anti-Tracking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Paul Zühlcke [:pbz]]

Thanks for filing a bug! Did you test this with yandex.ru? I can't reproduce your STR. The outgoing links from yandex.ru don't include the ysclid query param.

Comment 4

[leo]

Attachment: ysclid_reproduce.png

I can't reproduce your STR. The outgoing links from yandex.ru don't include the ysclid query param.

See screenshot.

I tried to enable/disable ETP, and this doesn't seem to have any effect.

Looked at Yandex help https://yandex.ru/support/metrica/general/search-query-sup.html

Чтобы более точно определять поисковые запросы, соблюдая при этом требования к сохранению приватности пользователей, Яндекс добавляет в ссылку специальный параметр — ysclid — при переходе на сайт из результатов поиска Яндекса.
Пример: https://example.com/?ysclid=ksil7dwgjm.
Механика доступна некоторым пользователям в режиме закрытого эксперимента. Параметр добавляется к выборочным адресам страниц в результатах поиска в браузерах, в которых не поддерживаются third-party cookies.

Roughly translated as:

For more precise search query recognition, while adhering to user privacy requirements, Yandes adds special query parameter ysclid — on transition from Yandex SERP.
Example: https://example.com/?ysclid=ksil7dwgjm.
This mechanic is enabled for some users in closed trial mode. Parameter is added to selected page addresses in SERP displayed in browsers which not support third-party cookies.

So it's A/B

Comment 5

[Paul Zühlcke [:pbz]]

Thanks! I can reproduce for some of the search results (e.g. RT news) if I browse yandex.ru from Russia via a proxy.

Comment 6

[Paul Zühlcke [:pbz]]

I'm adding the query param to our strip list for our pre-release channels (Nightly, Beta) to evaluate. Setting to P3 for moving that record to release.

Comment 7

[Paul Zühlcke [:pbz]]

ysclid should not be stripped on Nightly and Beta.

Comment 8

[leo]

What's the plan about this?

Comment 9

[Tim Huang[:timhuang]]

Hi leo,

Thanks for asking. We are still evaluating. We will give an update once we have a more concrete plan.

Comment 10

[Paul Zühlcke [:pbz]]

ysclid is now being stripped in ETP strict mode. See full list here: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/query-stripping/records