4 ms·

This article is about website owners. The best thing you can do as a user is enabling the 'Referer' for same-origin requests only. That way, you keep almost all

by marco1 10y ago

This article is about website owners. The best thing you can do as a user is enabling the 'Referer' for same-origin requests only. That way, you keep almost all the advantages of the 'Referer' but at the same time fix almost all the privacy issues. In Firefox, you can do this by setting `network.http.referer.XOriginPolicy` to `1` in `about:config`. Or use a `user.js` file with other helpful privacy settings, e.g. https://github.com/delight-im/Secure-Firefox https://github.com/delight-im/Secure-Firefox

JohnTHaller 10y ago
Note to be sure to set to 1 (base domains match) and not to 2 (domains match). Otherwise you'll be blocked from many CDNs used by large domains (for example... example.com serves its images and static js from cdn.example.com). Many CDNs are configured to check the referrer to prevent hot-linking of images, javascript, etc. Also note that setting it to 1 will still block you from loading CDN-served images and javascript for smaller sites that are not using their own custom subdomain for their 3rd party CDN service. So, a site using MaxCDN to serve their images and javascript from the default CDN-issued domain of zonename.companyname.netdna-cdn.com with "HTTP Referrer Whitelist" enabled for their example.com domain that you are visiting will block you from downloading images and static javascript hosted on the CDN.
ryuuchin 10y ago
You can also do this in Chrome although I'm not sure if the behavior is identical. On chomre://flags search for reduced-referrer-granularity and enable it to get a similar effect. I believe it may only affect web sites that do not explicitly provide a referrer policy.
- Houshalter 10y ago
  In Chrome I use Referer Control: https://chrome.google.com/webstore/detail/referer-control/hnkcfpcejkafcihlgbojoidoihckciin?hl=en https://chrome.google.com/webstore/detail/referer-control/hn... This gives you the ability to whitelist websites, and also a lot of control over what kind of requests are blocked and what aren't. I have it set to block everything by default, and only a few websites cause problems.
  - ryuuchin 10y ago
    Well I also use uMatrix which covers the cases where the built-in option does not. It can also be controlled on a per-site basis. I assume the functionality is pretty much the same.
eps 10y ago
This used to break virtually all paid webfont services and most likely it still does.
msravi 10y ago
Also, if you use uMatrix, you can choose to spoof the referrer string of third-party requests. And you can optionally choose to allow referrers for certain domains: referrer-spoof: * true referrer-spoof: wsj.com false This, for example, "allows" viewing of articles on wsj for google-referred links.
- digi_owl 10y ago
  Similarly with Noscript.

by marco1 10y ago

JohnTHaller 10y ago

Note to be sure to set to 1 (base domains match) and not to 2 (domains match). Otherwise you'll be blocked from many CDNs used by large domains (for example... example.com serves its images and static js from cdn.example.com). Many CDNs are configured to check the referrer to prevent hot-linking of images, javascript, etc. Also note that setting it to 1 will still block you from loading CDN-served images and javascript for smaller sites that are not using their own custom subdomain for their 3rd party CDN service. So, a site using MaxCDN to serve their images and javascript from the default CDN-issued domain of zonename.companyname.netdna-cdn.com with "HTTP Referrer Whitelist" enabled for their example.com domain that you are visiting will block you from downloading images and static javascript hosted on the CDN.

ryuuchin 10y ago

You can also do this in Chrome although I'm not sure if the behavior is identical. On chomre://flags search for reduced-referrer-granularity and enable it to get a similar effect. I believe it may only affect web sites that do not explicitly provide a referrer policy.

Houshalter 10y ago
In Chrome I use Referer Control: https://chrome.google.com/webstore/detail/referer-control/hnkcfpcejkafcihlgbojoidoihckciin?hl=en https://chrome.google.com/webstore/detail/referer-control/hn... This gives you the ability to whitelist websites, and also a lot of control over what kind of requests are blocked and what aren't. I have it set to block everything by default, and only a few websites cause problems.
- ryuuchin 10y ago
  Well I also use uMatrix which covers the cases where the built-in option does not. It can also be controlled on a per-site basis. I assume the functionality is pretty much the same.

eps 10y ago

This used to break virtually all paid webfont services and most likely it still does.

msravi 10y ago

Also, if you use uMatrix, you can choose to spoof the referrer string of third-party requests. And you can optionally choose to allow referrers for certain domains: referrer-spoof: * true referrer-spoof: wsj.com false This, for example, "allows" viewing of articles on wsj for google-referred links.

digi_owl 10y ago
Similarly with Noscript.