Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

211–220 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#211

Post by Momquist »

kuschku wrote: post #168
dorgo wrote: post #146

Earlier quoted context omitted.

Nooo! Pleasee don't! It will be like these useless cookie warnings in EU all over www. I voluntary enable this path info if you spare me more popups.

Don't worry, the cookie warnings (actually third-party tracking warnings) will soon (May) become not useless at all. From May on sites have to offer yes/no, they may only track you if you choose yes, and if you choose no they may not ask again, and may not refuse access either. Which is what was originally intended all this time, and which all good websites offered anyway.

I won't argue about these warnings uselesness, but they definitely are a pain in the ass because they require enabling JS, at least temporarily, on sites that otherwise would work perfectly without it to be able to answer to these warnings.

How stupid is that? Privacy at the expense of security?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#212

Post by kuschku »

Momquist wrote: post #211
kuschku wrote: post #168

Earlier quoted context omitted.

Don't worry, the cookie warnings (actually third-party tracking warnings) will soon (May) become not useless at all. From May on sites have to offer yes/no, they may only track you if you choose yes, and if you choose no they may not ask again, and may not refuse access either. Which is what was originally intended all this time, and which all good websites offered anyway.

I won't argue about these warnings uselesness, but they definitely are a pain in the ass because they require enabling JS, at least temporarily, on sites that otherwise would work perfectly without it to be able to answer to these warnings. How stupid is that? Privacy at the expense of security?

That's not required. The site could use a redirect to set such a cookie, or could use the DNT header to identify this.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#213

Post by DarronWyke »

I disable referers for all browsers. Firefox has them off completely, with Referer Control using a random one for Chrome. I only enable them for sites that absolutely need them (and that I need to use).

It's simply good data hygiene and privacy.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#214

Post by narag »

gregknicholson wrote: post #191
paulie_a wrote: post #187

Earlier quoted context omitted.

In my opinion Mozilla should be actively hostile to ad companies, and go out of their way to ruin metrics

I don't think that's a good tactic. Google and other ad companies have plenty of money to spread disinformation against Mozilla, if they wanted to. If Mozilla's users are saying “yes, this is good; please do more”, Mozilla can use that as a defence against any resistance from advertisers.

Then it would be better if Mozilla remains closer to neutral but leaves maximum space to the user for custom configurations, maybe using extensions.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#215

Post by mirimir »

nayuki wrote: post #200
mirimir wrote: post #84

Earlier quoted context omitted.

I use RefControl in Firefox. I've set the default to be the root of the destination site. That is, for example, clicking a link to https://foo.com sends https://foo.com as the referrer.

RefControl is a great add-on, but it isn't compatible with the new Firefox Quantum (57+). https://addons.mozilla.org/en-US/firefox/addon/refcontrol/

Yes, Quantum will break lots of stuff. Maybe too much for me to use it. Recent Firefox changes have already broken some of my iMacros scripts :(

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#216

Post by CodeWriter23 »

tzakrajs wrote: post #68
JepZ wrote: post #22

Earlier quoted context omitted.

Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

> Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

You mean some websites that fail to employ the best practice of “don’t trust external input”. Yes that applies to easily-spoofed headers.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#217

Post by proactivesvcs »

groovecoder wrote: post #110
godelski wrote: post #43

Earlier quoted context omitted.

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

Disclaimer: I'm the Firefox engineer who wrote the patch and the post. We did a user research study measuring website breakage under various privacy protections: https://blog.mozilla.org/data/2018/01/26/improving-privacy-w... tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we…

Thank you for your efforts. Features such as this are appreciated by, I'm sure, many of your users. It's a shame that the slating Mozilla has had recently hasn't been met by praise for work like this.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#218

Post by Momquist »

kuschku wrote: post #212
Momquist wrote: post #211

Earlier quoted context omitted.

I won't argue about these warnings uselesness, but they definitely are a pain in the ass because they require enabling JS, at least temporarily, on sites that otherwise would work perfectly without it to be able to answer to these warnings. How stupid is that? Privacy at the expense of security?

That's not required. The site could use a redirect to set such a cookie, or could use the DNT header to identify this.

You misunderstood me. It may not be strictly required for sites to use JS to build these warnings. But in practice, today, that's how it works on sites that display them. And it definitely requires the user to have JS enabled to pass these obnoxious pop-ups.

JS is also used for things that are doable with CSS or even HTML only. This isn't the first time.

My tin-foil hat persona suspects it's yet another way to force me to disable the various script and ad-blockers in the guise of protecting users for privacy concerns. But my more realistic side assumes this is just laziness.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#219

Post by tzakrajs »

CodeWriter23 wrote: post #216
tzakrajs wrote: post #68

Earlier quoted context omitted.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

> Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people. You mean some websites that fail to employ the best practice of “don’t trust external input”. Yes that applies to easily-spoofed headers.

They don't rely on it for authentication alone, usually it's a secondary or tertiary method that can block a login.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#220

Post by [deleted] »

jacquesm wrote: post #97
tzakrajs wrote: post #68

Earlier quoted context omitted.

Some websites rely (at least in part for verification) on referrer for the authentication process, I can imagine that causing some headaches for people.

Frankly: that's their problem. If your business model revolves around client side security then you have other problems.

[deleted]
Post reply on HN