Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#61

Post by sk5t »

progval wrote: post #56
godelski wrote: post #43

Earlier quoted context omitted.

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

It might break websites that provide features based on the referrer (eg. a central authentication that redirects back to the original page)

I can't recall ever encountering a referer-based authorization scheme that included the path or querystring in its logic--although it seems likely some goofus has implemented it, somewhere.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#62

Post by StavrosK »

staunch wrote: post #47

If Mozilla genuinely prioritized its users' interest it would block ads and tracking networks, which are the major way people's private information is leaked and also a primary vector for hacking. And yet for some mysterious reason Firefox hasn't broken ranks with Google by incorporating ad blocking. Even though its an obvious major feature and Firefox is losing marketshare every year. We know why Google won't priori…

You mean like the "tracking blocker" that is built-in to Firefox?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#63

Post by ryandrake »

danso wrote: post #37
seszett wrote: post #33

Earlier quoted context omitted.

> Phillip Hallam-Baker Funny how the misspelling of a double consonant comes from someone who has a misspelt given name with an extra double consonant!

In the U.S., apparently both "Phillip" and "Philip" are equally popular: https://www.ssa.gov/oact/babynames/ Edit: I'm glad you made this comment. I only know people with the name "Phillip" but I constantly find myself double-checking how their name is spelt before I refer to them (in text). I chalked it up to me being a bad friend but I guess it doesn't help that I might be seeing enough of the "Philip" variation to…

Popularity and correctness are often confused, especially online :)

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#64

Post by rodorgas »

ZenoArrow wrote: post #27
compsciphd wrote: post #20

Wouldn't this make it obvious that the user is browsing in private mode? While I get that might be preferable to leaking information, its also not an ideal solution either.

Two questions: 1. What does it matter if the creators of a website are aware that a user is using private browsing to view the site? In other words, what would they do with this information? 2. As it's possible to strip out referral information using other means, assuming there's a practical use for this "private browser user" information, what could the site creators do to guard against false positives?

There are some news websites that blocks private browsing[1]. Private browsing is a method of bypass the paywall, so they they make a private-browsing-wall.

1: https://imgur.com/a/gXEtl

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#65

Post by _8j50 »

sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#66

Post by ams6110 »

_8j50 wrote: post #65
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)

You can sort of do that, context menu -> copy url -> open a new tab -> paste url

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#67

Post by staunch »

StavrosK wrote: post #62
staunch wrote: post #47

If Mozilla genuinely prioritized its users' interest it would block ads and tracking networks, which are the major way people's private information is leaked and also a primary vector for hacking. And yet for some mysterious reason Firefox hasn't broken ranks with Google by incorporating ad blocking. Even though its an obvious major feature and Firefox is losing marketshare every year. We know why Google won't priori…

You mean like the "tracking blocker" that is built-in to Firefox?

No. I obviously mean real ad blocking that users are currently required to install as a third-party Firefox extension.

You don't find it curious that Mozilla has made the decision not to implement the most user-demanded browser feature for over a decade?

https://addons.mozilla.org/en-US/firefox/

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#68

Post by tzakrajs »

JepZ wrote: post #22
weinzierl wrote: post #2

> To help prevent third party data leakage while browsing privately , Firefox Private Browsing Mode will remove path information from referrers sent to third parties starting in Firefox 59. Emphasis mine. It only does it in private mode. I experimented with the referrer options mentioned in the article with mixed success. Not sending the referer header breaks some sites and often in a non-obvious way. EDIT: referrer…

Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#69

Post by [deleted] »

tzakrajs wrote: post #68
JepZ wrote: post #22

Earlier quoted context omitted.

Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

[deleted]

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#70

Post by nofunsir »

ams6110 wrote: post #66
_8j50 wrote: post #65

Earlier quoted context omitted.

As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)

You can sort of do that, context menu -> copy url -> open a new tab -> paste url

I do this quite often, and it is indeed usually because I don't want the site to know where I came from.
Post reply on HN