Uhm, wouldn't this give an indication as to whether the user is in private mode?
This was addressed in an earlier reply
Firefox 59 to strip path information from referrer values for 3rd parties
101–110 of 236 posts
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#102Earlier quoted context omitted.
As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)
I use RefControl in Firefox. I've set the default to be the root of the destination site. That is, for example, clicking a link to https://foo.com sends https://foo.com as the referrer.
There is an about:config setting called spoofSource which does the same thing I think - see comment https://news.ycombinator.com/item?id=16286542
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#103As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…
This is horrible and I believe the user should be informed.
Personal data in 3rd party referral is only one of the many side effects. If personal data is available in the URL as query string, chances (very high chances) are that the same data is perfectly visible in clear in the web server logs, and from there only God knows where it's spread, including all the 3rd party services used on the backend side.
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#104Earlier quoted context omitted.
Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.
Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.
Even still it still passes along the domain, so that'd still be possible. I'd guess that nobody would need to validate past the domain (and/or subdomain) level.
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#105This feature should be easily implemented by a extension for Google Chrome using the webRequest API
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#106Earlier quoted context omitted.
As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.
> why would you not want this on non-private sessions Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address. Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site. Sites are pretty bad at sanitizing their outgoing r…
I don't use anything but web mail (Fastmail) since 2002. I do my banking and email in one browser and my general browsing in a very locked down Firefox (Many about:config hacks, uBlock Origin, Decentraleyes, Webmail Ad Block, Privacy Badger, and No Coin) that blocks about everything save the actual content. I also run a Pi-hole. Keeping your actions compartmentalised keeps your privacy better controlled. Nothing is perfect, but keeping things separated is generally a better idea than not doing so.
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#107Color me stupid, but I thought all major browsers already stripped referrer info when navigating from HTTPS? The examples used don't make sense to me if that's true.
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#108Color me stupid, but I thought all major browsers already stripped referrer info when navigating from HTTPS? The examples used don't make sense to me if that's true.
The default user agent policy is no-referrer-when-downgrade, which strips the referrer header going from HTTPS pages to HTTP resources.
Firefox 59 PBM now implements strict-origin-when-cross-origin by default, which trims the path off the referrer value of ALL 3rd-party requests.
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#109Earlier quoted context omitted.
I use RefControl in Firefox. I've set the default to be the root of the destination site. That is, for example, clicking a link to https://foo.com sends https://foo.com as the referrer.
There is an about:config setting called spoofSource which does the same thing I think - see comment https://news.ycombinator.com/item?id=16286542
Thanks. Good to know.
Re: Firefox 59 to strip path information from referrer values for 3rd parties
#110As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…
As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.
Disclaimer: I'm the Firefox engineer who wrote the patch and the post.
We did a user research study measuring website breakage under various privacy protections:
https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...
tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we started by implementing this protection in Private Browsing.
However, note that some advertisers demand that AdTech vendors must not serve their ads on certain kinds of pages. (e.g., https://support.google.com/adsense/answer/1348688?hl=en&topi...) Many of those agreements require full referrers to be able to audit the ad inventory.
So there are some concerns and trade-offs to make in this space.