It's time to abolish the HTTP referer • Hacker News Board

Re: It's time to abolish the HTTP referer

#11

Post by marco1 » Wed, Jan 21, 2015, 5:05 PM UTC

gergo_v wrote: post #7

While the concern for user privacy is certainly understandable, abolishing the HTTP referer does not solve the issue. In fact it can be argued that it could do harm than good - basically every web based business relies on it in one way or another (customer acquisition channels, news mentions, backlinks, attribution, etc). The referrer itself is not at all used in tracking the user - as the visitor data is usually agg…

Of course, it is used for tracking. Fingerprinting and evercookies are the means to identify users, referers are one of the many things that you then track, assigned to those user identifiers.

Apart from that, inadvertently leaking information is easy with the HTTP referer.

Re: It's time to abolish the HTTP referer

#12

Post by tantalor » Wed, Jan 21, 2015, 7:26 PM UTC

marco1 wrote: post #3

tantalor wrote: post #2

It's a good thought... can you expand on it? What is the state of Referer in modern browsers? Why keep it? Would removing it break anything? File bugs against browser developers to remove Referer. Meanwhile users can disable Referer, * https://chrome.google.com/webstore/detail/referer-control/hn... * http://www.technipages.com/firefox-enable-disable-referrer * http://www.nullrefer.com/hide_referrer.html It could also…

> What is the state of Referer in modern browsers? Referers are still sent in all popular browers and expose information that is not necessary at all. > Why keep it? I can't think of any reason. Can you? > Would removing it break anything? It might certainly break some websites. But mechanisms which rely on the HTTP referer are usually broken, anyway. It should not affect too many sites. > File bugs against browser d…

> Even on HTTPS, the referer is always sent

Ah I was mistaken... I assumed Referer was never sent cross-domain in this case. That seems wrong.

Re: It's time to abolish the HTTP referer

#13

Post by _di3p » Wed, Jan 21, 2015, 11:23 PM UTC

Agreed. It's used for pretty much nothing but tracking/advertising, something that's not the end-users problem. I would also wager that 99% of people don't realize that $embarrassing-site.com knows that they just arrived from $social-network.com/$profile, or vice versa.

Re: It's time to abolish the HTTP referer

#14

Post by spdustin » Thu, Jan 22, 2015, 6:27 AM UTC

With no referrer, how would content owners prevent content thieves from stealing away bandwidth by hosting stolen markup on the thief's server that still refer to images on the author's?

Re: It's time to abolish the HTTP referer

#15

Post by gergo_v » Thu, Jan 22, 2015, 2:25 PM UTC

marco1 wrote: post #11

gergo_v wrote: post #7

While the concern for user privacy is certainly understandable, abolishing the HTTP referer does not solve the issue. In fact it can be argued that it could do harm than good - basically every web based business relies on it in one way or another (customer acquisition channels, news mentions, backlinks, attribution, etc). The referrer itself is not at all used in tracking the user - as the visitor data is usually agg…

Of course, it is used for tracking. Fingerprinting and evercookies are the means to identify users, referers are one of the many things that you then track, assigned to those user identifiers. Apart from that, inadvertently leaking information is easy with the HTTP referer.

I've worked with quite a few pieces of security software that rely on user tracking, and the referrer information was only used (if at all) to tie-in with other parts of the system (ie. which marketing channel brought the user in).