Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

181–190 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#181

Post by tehmaco »

regexnerd wrote: post #106
will4274 wrote: post #55

Earlier quoted context omitted.

> why would you not want this on non-private sessions Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address. Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site. Sites are pretty bad at sanitizing their outgoing r…

I don't use anything but web mail (Fastmail) since 2002. I do my banking and email in one browser and my general browsing in a very locked down Firefox (Many about:config hacks, uBlock Origin, Decentraleyes, Webmail Ad Block, Privacy Badger, and No Coin) that blocks about everything save the actual content. I also run a Pi-hole. Keeping your actions compartmentalised keeps your privacy better controlled. Nothing is p…

If you're not aware of it, you might want to look into Qubes[0], it's an OS that uses virtualisation tech to compartmentalise applications from each other (and the host OS). So you can use your browser of choice for all uses, just in different VMs configured to retain/discard data as you want.

[0] https://www.qubes-os.org/

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#182

Post by kuschku »

lozenge wrote: post #177
nindalf wrote: post #172

Earlier quoted context omitted.

I'm very curious about this. How will you keep track of a user who has opted out without using a cookie? That's my understanding of the issues - websites keep asking not because they think they can browbeat you into accepting cookies, but because they can't tell the difference between a user who has opted out of cookies and a first time user.

They could use local storage? As local storage isn't sent to the server, the server will not know whether the user opted out. (User opt in will be a cookie still.) Alternatively, the legal definition of tracking cookie can differ from the technical definition of cookie. It wouldn't be the first time...!

The "cookie law" applies to every information that allows identifying the user which is not strictly necessary for the purposes of the service.

Cookie to say "has clicked no"? okay.

Login cookie? okay.

Cookie to track the user? not okay.

Local storage to track the user? not okay.

Tracking the user based on magic? not okay.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#183

Post by paulie_a »

zamber wrote: post #80
ams6110 wrote: post #66

Earlier quoted context omitted.

You can sort of do that, context menu -> copy url -> open a new tab -> paste url

You can disable refferer sending in FF https://askubuntu.com/questions/797135/how-to-disable-http-r...

Is there a way to randomize the ref url?

It's increasingly becoming impossible to have any actual privacy, so in my opinion the best option is to make the data collected worthless.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#184

Post by alkonaut »

marcell wrote: post #49
joelthelion wrote: post #4

Are there any reasons not to get rid of referers altogether?

If you have a giant traffic spike, it's nice to know where it came from. Eg. if you get linked on Hacker News, you can go to the thread and engage with potential customers.

That's not really a direct reason for the client to send them though. There are tons of useful things about referrers to the host.

Stripping everything but the domain should be mostly ok for the client though, so if I come from a.b.com/foo, it just sends b.com as referrer? Both "a" and "foo" can hold any amount of data so those would have to go. Sending b.com should be enough to provide traffic statistics?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#185

Post by alkonaut »

TheCoreh wrote: post #7
joelthelion wrote: post #4

Are there any reasons not to get rid of referers altogether?

They are useful to prevent the hotlinking of images/video from third party domains, which can incur in significant bandwidth costs for smaller websites.

This is just like traffic statistics - a help to the host, not the client. This is data sent voluntarily by the client so there has to be some direct benefit to the client in sending it, or at least sending any more than the domain name with out path, subdomain and parameters?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#186

Post by rocqua »

alkonaut wrote: post #180

#1 this should be on by default. I might be missing something, but do sites really need the referrer? What would break if the browser sent the same page as referrer, or google.com/ or something similar? Is there any value in the referrer to the client ? The host can use it for a whole range of reasons - but apart from helping the host, what is the immediate benefit to the client? #2 Won't this be possible to bypass s…

To answer #1, the referrer could probably be used to make a link refer to a login page on another domain, and to then let the host redirect to the correct page after login. There are of course ways to do this by following your suggestion #2, but I suspect this might be why we originally had the referrer header.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#187

Post by paulie_a »

rrcaptain wrote: post #159
groovecoder wrote: post #110

Earlier quoted context omitted.

Disclaimer: I'm the Firefox engineer who wrote the patch and the post. We did a user research study measuring website breakage under various privacy protections: https://blog.mozilla.org/data/2018/01/26/improving-privacy-w... tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we…

In all seriousness: why should we care what ad companies want? Mozilla makes a browser, not an ad platform. Advertisers may have to adapt, but that's their problem.

In my opinion Mozilla should be actively hostile to ad companies, and go out of their way to ruin metrics

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#188

Post by rovek »

alkonaut wrote: post #180

#1 this should be on by default. I might be missing something, but do sites really need the referrer? What would break if the browser sent the same page as referrer, or google.com/ or something similar? Is there any value in the referrer to the client ? The host can use it for a whole range of reasons - but apart from helping the host, what is the immediate benefit to the client? #2 Won't this be possible to bypass s…

You're right about subdomains but they are stripping both query and path, so 123.a.b.tld/foo would become 123.a.b.tld. It's fair to assume most misplaced sensitive data will be in the path or query, rather than the subdomain.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#189

Post by gregknicholson »

nindalf wrote: post #172
kuschku wrote: post #168

Earlier quoted context omitted.

Don't worry, the cookie warnings (actually third-party tracking warnings) will soon (May) become not useless at all. From May on sites have to offer yes/no, they may only track you if you choose yes, and if you choose no they may not ask again, and may not refuse access either. Which is what was originally intended all this time, and which all good websites offered anyway.

I'm very curious about this. How will you keep track of a user who has opted out without using a cookie? That's my understanding of the issues - websites keep asking not because they think they can browbeat you into accepting cookies, but because they can't tell the difference between a user who has opted out of cookies and a first time user.

If I were drafting the regulations (fortunately I have neither the legal nor technical expertise), I'd make it legal to store without permission a cookie containing only a specific string defined by the regulation, e.g. “optout” or “0”, meaning “this user has seen the question and opted out; don't bother them again”. The regulations would have to ensure that the cookie's timestamps are suitably generic to prevent fingerprinting — perhaps you can store a date but not a time.

Would something like that work?

(Edit: Ah, apparently this sort of thing is already allowed, according to comments I didn't read before writing this. Sensible legislators.)

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#190

Post by alkonaut »

groovecoder wrote: post #111
compsciphd wrote: post #20

Wouldn't this make it obvious that the user is browsing in private mode? While I get that might be preferable to leaking information, its also not an ideal solution either.

Disclaimer: I'm the Firefox engineer who wrote the patch and the blog post. I'm very interested in this thread. Other replies here are correct - there are many ways that sites try to detect private browsing, and many ways they can get it right or wrong. How do people feel about the "stealth" design goal of private browsing? Should it be a goal? What about a hide-in-a-big-crowd tactic? (E.g., how Tor tries to make all…

> How do people feel about the "stealth" design goal of private browsing?

I think this shouldn't just be a goal for private browsing, this should be a goal for browsing period.

Shouldn't the default be to just send the top level domain (if anything) of the source site as soon as you go somewhere else? The next site can't possibly use the complete url of the referring site for any (non-shady) purpose?

Post reply on HN