Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#71

Post by boomboomsubban »

staunch wrote: post #47

If Mozilla genuinely prioritized its users' interest it would block ads and tracking networks, which are the major way people's private information is leaked and also a primary vector for hacking. And yet for some mysterious reason Firefox hasn't broken ranks with Google by incorporating ad blocking. Even though its an obvious major feature and Firefox is losing marketshare every year. We know why Google won't priori…

If Firefox disabled ads by default, a large number of sites would likely block Firefox or set up angry messages telling the user to switch browsers. Yes, you could bypass that, but most people wouldn't bother. Add in the logistical issues, and the fact that some of the things blocked are beneficial, then I see no reason to expect the conspiracy you suspect.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#72

Post by tmd83 »

will4274 wrote: post #55
godelski wrote: post #43

Earlier quoted context omitted.

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

> why would you not want this on non-private sessions Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address. Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site. Sites are pretty bad at sanitizing their outgoing r…

As I read it the parent is for it. He is actually saying it should be always the mode not just for private browsing.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#73

Post by sologoub »

godelski wrote: post #43
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

It depends on who “you” are in this case. If that “you” is a company that solely makes money by selling various behavioral data and has little care about various jurisdictions (which they really should, especially with GDPR, let a long “doing the right thing”), it might very well be useful to collect extra signals.

However, if “you” is a company that is in some other business, but collects analytics for the purposes of optimizing it’s product and figuring out what actually works for their users, then you don’t event want to run the risk of ingesting something private. Especially with exposure to different jurisdictions.

Think of it as the difference between a double-opt-in email list where you are very sure people want to receive the communications and an unsolicited spam list. If the user volunteers this data and it has some relevant business purpose, that’s great. However, if the user doesn’t know I have this info and wouldn’t want me to have it, then acting on that data could create a lot of negative emotions that as a company I wouldn’t want.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#74

Post by mi100hael »

godelski wrote: post #43
sologoub wrote: post #34

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown.…

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

It's less common now that web developers have prioritized sane urls, but a lot of sites still have the actual page as a query param like /site.php?page=foo instead of just /foo. Stripping query params by default would render referrers useless on those sites.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#75

Post by dylanpyle »

x775 wrote: post #6

In about:config, setting 'network.http.sendRefererHeader' to 0 (default is 2) will stop the referer header from being sent, and the document.referrer from being set. See http://kb.mozillazine.org/Network.http.sendRefererHeader for more information.

Similar for Chrome, there's a flag at chrome://flags/#reduced-referrer-granularity

Description: "If a page hasn't set an explicit referrer policy, setting this flag will reduce the amount of information in the 'referer' header for cross-origin requests."

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#76

Post by mi100hael »

ori_b wrote: post #15
0xbadcafebee wrote: post #13

Earlier quoted context omitted.

Also paywall skipping, to track what sites are bringing you traffic, to pass fields to forms to report problems, to present targeted traffic based on use, and of course, advertising.

The question was for reasons to __not__ remove them.

And those are all answers...?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#77

Post by shkkmo »

sk5t wrote: post #61
progval wrote: post #56

Earlier quoted context omitted.

It might break websites that provide features based on the referrer (eg. a central authentication that redirects back to the original page)

I can't recall ever encountering a referer-based authorization scheme that included the path or querystring in its logic--although it seems likely some goofus has implemented it, somewhere.

I actually just finished implementing a very simple JWT single sign-on feature. We don't use the referer for the authentication/authorization. However, having the path/query in the referer does allow our partners to know what (if any) post-login redirect path/query to include in the JWT to provide end users a seamless re-authentication experience.

We could, of course, build the same functionality into our implementation without relying having the path/query in the referer.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#78

Post by tmd83 »

throwaway_boi wrote: post #23
joelthelion wrote: post #4

Are there any reasons not to get rid of referers altogether?

Preventing CSRF attacks: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...

This. For this you just need the origin though. There's an origin header for 10 years which makes CSRF protection so trivial yet its still not available in all browsers. Firefox can leak referer in regular mode but can't send origin? Not sure.

Anyone knows a good document on when/which browser actually sends referer header?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#79

Post by orthecreedence »

marcell wrote: post #49
joelthelion wrote: post #4

Are there any reasons not to get rid of referers altogether?

If you have a giant traffic spike, it's nice to know where it came from. Eg. if you get linked on Hacker News, you can go to the thread and engage with potential customers.

Weird, every time I get HN traffic the referrer is the HN homepage, never individual posts. Is it just me?

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#80

Post by zamber »

ams6110 wrote: post #66
_8j50 wrote: post #65

Earlier quoted context omitted.

As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)

You can sort of do that, context menu -> copy url -> open a new tab -> paste url

You can disable refferer sending in FF https://askubuntu.com/questions/797135/how-to-disable-http-r...
Post reply on HN