Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#41

Post by seba_dos1 »

franciscop wrote: post #12
weinzierl wrote: post #2

> To help prevent third party data leakage while browsing privately , Firefox Private Browsing Mode will remove path information from referrers sent to third parties starting in Firefox 59. Emphasis mine. It only does it in private mode. I experimented with the referrer options mentioned in the article with mixed success. Not sending the referer header breaks some sites and often in a non-obvious way. EDIT: referrer…

Just curious, did it break any popular website?

Not exactly what you ask for, but just as a note: I had to add Polish online train ticket service to the whitelist in Smart Referer add-on, as it always fails with meaningless "invalid site call" error otherwise :P

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#42

Post by Zancarius »

Feniks wrote: post #25
franciscop wrote: post #12

Earlier quoted context omitted.

Just curious, did it break any popular website?

It will break forums and imageboards in my experience. Perhaps due to CAPTCHA.

I think it's due to dubious "security" implementations, including at least one that was (?) present in a rather notorious PHP message board software package [1]. I'd be surprised if this survived all these years later, but then I've also seen some custom session handling code in my travels that did something similar even as recently as 2-3 years ago.

Some image boards do it to prevent casual hot-linking, as my sibling poster notes.

[1] https://tracker.phpbb.com/browse/PHPBB3-8396

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#43

Post by godelski »

sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#44

Post by 13of40 »

spondyl wrote: post #30

For those confused as to why half the comments have "misspelled" referrer, here's an interesting bit of history: The misspelling of referrer originated in the original proposal by computer scientist Phillip Hallam-Baker to incorporate the field into the HTTP specification. The misspelling was set in stone by the time of its incorporation into the Request for Comments standards document RFC 1945; document co-author Ro…

It seems like the two spellings were used interchangeably until about 1960:

https://books.google.com/ngrams/graph?content=referer%2C+ref...

Edit: Actually, that doesn't seem to be true -- although there's some usage of "referer" in English, most of the hits in Google Books prior to 1960 turn out to be for the Old French word "referer".

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#45

Post by beardog »

throwaway2016a wrote: post #21
joelthelion wrote: post #4

Are there any reasons not to get rid of referers altogether?

Referral headers can be very useful for tracking down fraud and phishing activities. Although tracking down fraud is usually as it relates fraudulent traffic which mostly effects advertising so I imagine a lot of the commenters here would say that is not a good reason.

Sites can outright disable referrers using a meta tag: https://www.w3.org/TR/referrer-policy/#referrer-policy-no-re...

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#46

Post by huac »

ketralnis wrote: post #39
seszett wrote: post #33

Earlier quoted context omitted.

> Phillip Hallam-Baker Funny how the misspelling of a double consonant comes from someone who has a misspelt given name with an extra double consonant!

I don't think you can ever describe a person's name as spelled correctly or incorrectly. It's spelled how they spell it. It's their name, not a dictionary's. Variations in spelling are perfectly natural and for names in particular are incredibly common

Or how their parents spelt it.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#47

Post by staunch »

If Mozilla genuinely prioritized its users' interest it would block ads and tracking networks, which are the major way people's private information is leaked and also a primary vector for hacking.

And yet for some mysterious reason Firefox hasn't broken ranks with Google by incorporating ad blocking. Even though its an obvious major feature and Firefox is losing marketshare every year.

We know why Google won't prioritize the interests of Chrome users but why is the only major independent browser seemingly corrupt in the same way?

Mozilla should be helping society by pushing it past an era of internet advertising and the clearly terrible clickbait-fake-news culture it creates. And yet, it does not.

Is Google using the money it pays Mozilla to "discourage" Firefox from going forward with ad blocking? As a concerned citizen, I sent an email to antitrust.complaints@usdoj.gov requesting an investigation. Anyone with insider info should send it there.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#49

Post by marcell »

joelthelion wrote: post #4

Are there any reasons not to get rid of referers altogether?

If you have a giant traffic spike, it's nice to know where it came from. Eg. if you get linked on Hacker News, you can go to the thread and engage with potential customers.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#50

Post by seszett »

ketralnis wrote: post #39
seszett wrote: post #33

Earlier quoted context omitted.

> Phillip Hallam-Baker Funny how the misspelling of a double consonant comes from someone who has a misspelt given name with an extra double consonant!

I don't think you can ever describe a person's name as spelled correctly or incorrectly. It's spelled how they spell it. It's their name, not a dictionary's. Variations in spelling are perfectly natural and for names in particular are incredibly common

I'm not "attacking" their parents who chose the name or anything like that, and any spelling is fine for a name, but there is a clear etymology to the name "Philip" that comes from "philos" and "hippos", someone who loves horses, and an indisputably historically correct way to spell it.

That a misspelling has become particularly common (or like for my own name, much more common than the historically correct spelling) doesn't make it anymore correctly spelt than "referer" in my opinion.

But if you disagree with the term "misspelling", I can formulate it another way: let's say that it's funny how the creative modern spelling "referer" instead of the historical "referrer" comes from someone who has a creatively spelt name "Phillip" where "Philip" was historically more common, and that both differ from the historical spelling on a double consonant. It's a much more awkward sentence though for such a trivial, passing remark.

Post reply on HN