Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

161–170 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#161

Post by andrewaylett »

godelski wrote: post #43
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

To add to everyone else: got to start somewhere. Private browsing seems like a good place, and I've just taken advantage of the plumbing it introduces to set strict origin referer in non-private browsing too.

Hopefully, even though groovecoder doesn't mention the possibility, if this works well then we'll see it rolling into regular browsing too, or at least having some UI exposed, in the same way that tracking protection moved from being private browsing only to having an option to enable it in regular browsing.

Actually, now I think of it, I wonder if the two could sit behind the same preference in the end?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#162

Post by masklinn »

rrcaptain wrote: post #158
Tepix wrote: post #151

Whoah, TIL that > EFF researchers discovered this leak of personal health data from healthcare.gov to DoubleClick It blows my mind that a site such as healthcare.gov would include 3rd party trackers. You guys in the US really don't care about privacy at all.

This is largely the part of independent contractors and subcontractors. Contracts go to the companies good at winning contracts, not necessarily the best company to do the job. The contractor takes an obscene profit for providing no value and then subcontracts the project to various subcontractors who may or may not employ actually qualified and skilled engineers. The government employees managing the contract typica…

> This is largely the part of independent contractors and subcontractors. Contracts go to the companies good at winning contracts, not necessarily the best company to do the job. The contractor takes an obscene profit for providing no value and then subcontracts the project to various subcontractors who may or may not employ actually qualified and skilled engineers.

Frankly, I don't think that's really the case / honest here. There's been a movement to create "readable URLs" over the last few years, how many people considered that this could leak information through referers? I really can't say I remember seeing any discussion of that issue.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#163

Post by masklinn »

fiddlerwoaroof wrote: post #148
eitland wrote: post #60

Earlier quoted context omitted.

Was very handy to find other people linking to your site, often people with similar sites to yours. Also I remember someone I know got an email that a page ge was linking to was about to move. I guess this was only possible because of the referer header.

It’s, nice, for example, to see where your GitHub repositories were referred to

Or which sites & forums were hotlinking your images, to decide who'd get horse porn.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#166

Post by vidarh »

masklinn wrote: post #162
rrcaptain wrote: post #158

Earlier quoted context omitted.

This is largely the part of independent contractors and subcontractors. Contracts go to the companies good at winning contracts, not necessarily the best company to do the job. The contractor takes an obscene profit for providing no value and then subcontracts the project to various subcontractors who may or may not employ actually qualified and skilled engineers. The government employees managing the contract typica…

> This is largely the part of independent contractors and subcontractors. Contracts go to the companies good at winning contracts, not necessarily the best company to do the job. The contractor takes an obscene profit for providing no value and then subcontracts the project to various subcontractors who may or may not employ actually qualified and skilled engineers. Frankly, I don't think that's really the case / hon…

Clearly not enough people considered that it'd leak information, but awareness of it was sufficient that most mail providers and large portals had redirect servers to "clean" URLs of meaningful referrers from their pages already by 2000 or before.

So I agree it's probably an issue that people still don't understand this, but it's not a new issue, and there's really no excuse for not knowing this.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#167

Post by wastedhours »

tzakrajs wrote: post #68
JepZ wrote: post #22

Earlier quoted context omitted.

Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

For things like small-time affiliate systems maybe?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#168

Post by kuschku »

dorgo wrote: post #146
icebraining wrote: post #133

Earlier quoted context omitted.

Then ask the users from which page they came from, I'm sure they'll be happy to do that so that they can know about those great products.

Nooo! Pleasee don't! It will be like these useless cookie warnings in EU all over www. I voluntary enable this path info if you spare me more popups.

Don't worry, the cookie warnings (actually third-party tracking warnings) will soon (May) become not useless at all.

From May on sites have to offer yes/no, they may only track you if you choose yes, and if you choose no they may not ask again, and may not refuse access either.

Which is what was originally intended all this time, and which all good websites offered anyway.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#169

Post by jacquesm »

Fnoord wrote: post #154
jacquesm wrote: post #97

Earlier quoted context omitted.

Frankly: that's their problem. If your business model revolves around client side security then you have other problems.

I get what you're saying and I agree but it is a bit more nuanced. Say you want to read a certain news article, and if you get referred to it by Google you can read it, otherwise not. Now, lets say you've been finding news articles to read that way via Google the past years. Suddenly, with Firefox 59, this no longer works. Without even informing the user. That is not user-friendly.

Sites should be penalized for giving preference to one kind of link over another. Why should Google have even more of an upper hand than they already have?

To me this is a super good illustration of why we probably should get rid of the 'Referer' (sic) header altogether.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#170

Post by vanderZwan »

ecthiender wrote: post #165

Why is this being only implemented in private browsing mode and not in the normal mode? IMO, this should be the default.

My guess is: they are letting the privacy nuts (and I am one) figure out the kinks in the system first before unleashing it on the general public
Post reply on HN