Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

111–120 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#111

Post by groovecoder »

compsciphd wrote: post #20

Wouldn't this make it obvious that the user is browsing in private mode? While I get that might be preferable to leaking information, its also not an ideal solution either.

Disclaimer: I'm the Firefox engineer who wrote the patch and the blog post.

I'm very interested in this thread. Other replies here are correct - there are many ways that sites try to detect private browsing, and many ways they can get it right or wrong.

How do people feel about the "stealth" design goal of private browsing? Should it be a goal? What about a hide-in-a-big-crowd tactic? (E.g., how Tor tries to make all its users look identical.)

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#112

Post by epigramx »

eli wrote: post #96
volgo wrote: post #90

Earlier quoted context omitted.

Yes it's great from a marketer's point of view. From a consumer's point of view, I don't want you to know where I came from. I don't really care if it's useful to you. It's the difference between pleasing marketers vs pleasing users. Firefox chose wisely

Honestly, I don't think path information is all that useful for marketers.

We overthink it when most of the tracking on the internet is based on simply your IP and occasionally a fingerprint of the browser(including any identification done by said browser). Since IPv4's inception that's all that was required and it was an extremely robust way to be tracked if you ask me.

If you want to not be tracked you require a random/different IP and a browser fingerprint that blends with the crowd.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#113

Post by gkgicccj »

ams6110 wrote: post #53
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

I was somewhat shocked that healthcare.gov would have any ads on it. I missed that scandal I guess. https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-p... Anyone know if this is still the case? I looked at a couple of pages and only saw tiqcdn.com being blocked by uBlock.

On a side note I recently learnt that ESR is against Obama care. Surprising, I can understand someone young not liking having to pay mandatory insurance but he's old.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#114

Post by gkgicccj »

regexnerd wrote: post #106
will4274 wrote: post #55

Earlier quoted context omitted.

> why would you not want this on non-private sessions Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address. Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site. Sites are pretty bad at sanitizing their outgoing r…

I don't use anything but web mail (Fastmail) since 2002. I do my banking and email in one browser and my general browsing in a very locked down Firefox (Many about:config hacks, uBlock Origin, Decentraleyes, Webmail Ad Block, Privacy Badger, and No Coin) that blocks about everything save the actual content. I also run a Pi-hole. Keeping your actions compartmentalised keeps your privacy better controlled. Nothing is p…

I sound like a shill but is HN being attacked by bots?

This is a comment with useful information, why is this downvoted?

Mods can you see?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#115

Post by boomboomsubban »

staunch wrote: post #92
boomboomsubban wrote: post #71

Earlier quoted context omitted.

If Firefox disabled ads by default, a large number of sites would likely block Firefox or set up angry messages telling the user to switch browsers. Yes, you could bypass that, but most people wouldn't bother. Add in the logistical issues, and the fact that some of the things blocked are beneficial, then I see no reason to expect the conspiracy you suspect.

If a major service blocks Firefox users it could lead to a massive boycott. Users could rally around Mozilla if it stopped selling out their interests. More people use ad-blockers than Firefox has users. The best way to attract more users is to make the best possible browser. That means incorporating ad-blocking as users have loudly demanded for a decade.

It wouldn't lead to a massive boycott, most people barely care about browser choice. And what would a boycott accomplish? If they're blocking you for not giving them ad revenue, your refusal to go there changes nothing.

Over the past decade, I've had to switch ad blockers several times to deal with performance and privacy issues, and I still have to deal with a ton of broken sites that would make most people just assume their browser was broken. The logistics of including the blocker in the browser are a nightmare, and I doubt the results would lead most people to call it the "best browser."

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#116

Post by jdavis703 »

volgo wrote: post #90
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

Yes it's great from a marketer's point of view. From a consumer's point of view, I don't want you to know where I came from. I don't really care if it's useful to you. It's the difference between pleasing marketers vs pleasing users. Firefox chose wisely

Good marketing does please users by delivering them products tailored to them that they may have never knew even existed.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#117

Post by jdavis703 »

groovecoder wrote: post #110
godelski wrote: post #43

Earlier quoted context omitted.

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

Disclaimer: I'm the Firefox engineer who wrote the patch and the post. We did a user research study measuring website breakage under various privacy protections: https://blog.mozilla.org/data/2018/01/26/improving-privacy-w... tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we…

Many of the ad serving SDKs slurp up all this data anyways and send it down using a request body, query string, or something that isn't the "Referer" HTTP header. I'm not sure how ad verification providers get this data, but if anything it's just going to mean less information leaking out from systems like DFP to the smaller ad tech firms. But firms like Google will still be able to figure out what path you were on.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#118

Post by Pxtl »

tzakrajs wrote: post #68
JepZ wrote: post #22

Earlier quoted context omitted.

Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

Any that we'd actually heard of?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#119

Post by jrochkind1 »

duncan_bayne wrote: post #100
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

> As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. Yeah, but it may surprise you to know that your opinion isn't shared by the people who own the computers in question, or the private data you're digging in. Your personal strong belief is, in this case, utterly irrelevant.

I believe they were saying despite being in that business, they -still- think there should be much increased privacy, like the features discussed in OP more widespread.

They don't seem to have said so clearly enough. I think some people just read the first half of the sentence and are ready to be mad!

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#120

Post by Feniks »

epigramx wrote: post #112
eli wrote: post #96

Earlier quoted context omitted.

Honestly, I don't think path information is all that useful for marketers.

We overthink it when most of the tracking on the internet is based on simply your IP and occasionally a fingerprint of the browser(including any identification done by said browser). Since IPv4's inception that's all that was required and it was an extremely robust way to be tracked if you ask me. If you want to not be tracked you require a random/different IP and a browser fingerprint that blends with the crowd.

Most people are on mobile nowadays so IP is becoming increasingly worthless.
Post reply on HN