6 ms·

This seems to work pretty well on Google search results. If you haven't noticed, Google search has this anti-feature bordering on the dark pattern where hoverin

by pierrec 10y ago

This seems to work pretty well on Google search results. If you haven't noticed, Google search has this anti-feature bordering on the dark pattern where hovering a link shows the correct destination URL but right-clicking it (eg. to copy the destination URL) instantly replaces it with an nested Google redirect (I assume they're doing this for the tracking, statistics, etc.)

greglindahl 10y ago
The google redirect does tracking and referer hiding. You'll want to be sure that your browser does referer hiding if you go direct to the link.
- gruez 10y ago
  Why is the referrer hiding important? The most that the destination page will get is what my search query is.
  - greglindahl 10y ago
    Many people consider that to be an important privacy leak. To put this into perspective: I used to have a webpage which ranked quite highly for searches related to chastity belts. Do you think the average visitor would appreciate me knowing the exact search terms that landed them on my page?
    - anc84 10y ago
      Doesn't Google Analytics provide you the exact search terms that Google phished out?
      - greglindahl 10y ago
        Google Analytics doesn't associate search terms with IP addresses or times.
        ForHackernews 10y ago
        I'm sure Google does internally. Honestly, I trust Joe Random Webmaster a lot more than I trust Google, because some small site manager doesn't already have a vast corpus of data about me.
        kl4m 10y ago
        Well, yeah, Google has logs of what what people search on their search engine.
        meowface 10y ago
        I actually trust Joe Random Webmaster a lot less than Google. Google has a lot of power, but from past experience, I've run into many privacy issues with malicious or misguided website owners while I'm unlikely to run into a serious one with Google. At least assuming none of their employees goes very rogue and starts leaking data en masse, or has a personal vendetta against me or something. I know something like that happened once (https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/), but the odds are probably still pretty low.
        jacquesm 10y ago
        It's the aggregation of all those little bits of data into a giant profile where the risk lies.
        anc84 10y ago
        Are you aware that the NSA used (and probably still uses) Google's data? Once you collect data in a central place you attract malicious interests.
        meowface 10y ago
        Yes, but my adversary in that case is the NSA. Even if Google (or other similar companies) didn't exist, NSA would try to get that data one way or another. Also, though it may be naive, I believe Google does not intend to cooperate with the NSA any more than they're absolutely legally required to.
      - dexterdog 10y ago
        Not when GA is blocked like it is by any privacy-concerned individual.
    - Symbiote 10y ago
      I used to host a site for a local youth sports team. Almost all the referrer logs from Google Images had search terms like "hot under 13 girls". I banned the Google Image robot from the site, since no useful visitors arrived this way.
  - vii 10y ago
    Referrer hiding is important to Google itself: https://googleblog.blogspot.com/2011/10/making-search-more-secure.html https://googleblog.blogspot.com/2011/10/making-search-more-s... Previously, some (generally scammy) websites used these keywords forwarded from Google to actually change the content. By concealing the keywords people were searching for to land on your website, they force content hosters and ad networks to depend on the Google analytics + ads ecosystem. With these keywords, you could gather information about your Google rank for queries. Whether it's net beneficial for you as a browser owner to pass referrer information - probably it is if you like the people hosting the content you read, as it helps them understand their traffic and improve their service. If you don't like them (probably because they are spam) then this just helps them be more effective spammers.
  - Too 10y ago
    The refferer can be sensitive both security and integrity wise. Would you like any destination to find out that you came from any of these sites: example.com/admin/?password=xyz or gaymidgetporn.com/forum/how-to-enlarge-penis
    - PavlovsCat 10y ago
      On the other hand, if you suddenly have 100 times the traffic an image on your server got hotlinked elsewhere, wouldn't you want to know what is going on? There's upsides and downsides.. I can't really make up my mind what I'd prefer, other than the utopian option of "all users know what they're doing and how to configure their browsers".
- pierrec 10y ago
  After some testing, it appears that this plugin offers better referer hiding than Google's redirect. I've verified that it completely hides the referer, whereas Google at least reveals that you're coming from Google (which makes sense, since website owners will see this and it can encourage them to subscribe to Google Analytics so they can see some of those hidden details). Also, referer hiding does not justify URL substitution as a result of right-clicking a link. That just forces less savvy users to give Google an additional clickthrough when all they want is the URL.
  - greglindahl 10y ago
    Hopefully you've verified that the referer hiding is due to the plugin and not your personal settings. That's a great feature in a plugin, since many users appreciate referer hiding being the default for search engine clicks.
    - pierrec 10y ago
      Yes, good point, and it was easy to verify. Disable plugin; search "what is my referer"; click on first result: Your HTTP referer is google.ca. Enable plugin; repeat: Your HTTP referer is No referer / hidden.
      - deleted 10y ago
        [deleted]
- jessriedel 10y ago
  Can someone explain why my browser provides referer info at all? Why isn't this a permission I need to give away? What common features that the user needs on the web rely on it?
  - DanBC 10y ago
    The RFC suggested that permissions should be asked for. https://tools.ietf.org/html/rfc1945#section-10.13 https://tools.ietf.org/html/rfc1945#section-10.13 Note: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information.
    - nothrabannosir 10y ago
      Not that it should be asked for; just that it should be configurable. Subtle but important difference. Firefox is following this recommendation, but doesn't ask for it explicitly.
  - detaro 10y ago
    It's one of these things that were added once, pages started to rely on it and now nobody wants to turn it off globally because things will break. They've added ways for sites to control if/how much information is sent on outgoing links though in recent browsers. e.g. in HN's HTML you find <meta name="referrer" content="origin"> which tells the browser to only send the domain, but not the exact URL.
  - pierrec 10y ago
    >What common features that the user needs on the web rely on it? - Website owners and content creators use the Referer to see where their users are coming from, which allows them to make content which is more suitable, which indirectly benefits the user. - It helps prevent hotlinking, so it can protect small websites from getting hammered, which again could indirectly benefit the user. I guess the point is that everyone's a "user" of HTTP, including website owners, and their interests are partly linked to yours. In an objective sense I find the standard still makes sense. In an individualistic sense, things are more complicated.
- wodenokoto 10y ago
  Why is it so bad that a webmaster gets to know I found them through Google?
  - chii 10y ago
    to prevent them from doing silly things like paywall blocking, except when via a google search.
- revelation 10y ago
  Does it have to be so freaking long? They have 512+ bits of various IDs and tracking data in there, that's enough to identify every person on this earth ... a bazillion times over.
amluto 10y ago
I wonder whether Google deliberately makes it hard to copy a real URL to the clipboard or whether it's a careless unintended side effect of tracking context menu open in new tab operations.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
rasz_pl 10y ago
There used to be 'Google Tracking-B-Gone' userjs, but it stopped working some time ago. I patched mine locally, also stripping tracking from Image results. Quick googling shows someone updated it recently https://greasyfork.org/en/scripts/1810-google-tracking-b-gone https://greasyfork.org/en/scripts/1810-google-tracking-b-gon... I have second version stripping tracking from Gmail links (yes, google tracks your clicks in gmail). Should probably throw them up on github.
- verroq 10y ago
  I use this one for google search and image. https://chrome.google.com/webstore/detail/google-link-fixer/pcpdkhaeeohmogfgcheopfcigcfdaioj?hl=en https://chrome.google.com/webstore/detail/google-link-fixer/...

by pierrec 10y ago

greglindahl 10y ago

The google redirect does tracking and referer hiding. You'll want to be sure that your browser does referer hiding if you go direct to the link.

gruez 10y ago
Why is the referrer hiding important? The most that the destination page will get is what my search query is.
- greglindahl 10y ago
  Many people consider that to be an important privacy leak. To put this into perspective: I used to have a webpage which ranked quite highly for searches related to chastity belts. Do you think the average visitor would appreciate me knowing the exact search terms that landed them on my page?
  - anc84 10y ago
    Doesn't Google Analytics provide you the exact search terms that Google phished out?
    - greglindahl 10y ago
      Google Analytics doesn't associate search terms with IP addresses or times.
      - ForHackernews 10y ago
        I'm sure Google does internally. Honestly, I trust Joe Random Webmaster a lot more than I trust Google, because some small site manager doesn't already have a vast corpus of data about me.
        kl4m 10y ago
        Well, yeah, Google has logs of what what people search on their search engine.
        meowface 10y ago
        I actually trust Joe Random Webmaster a lot less than Google. Google has a lot of power, but from past experience, I've run into many privacy issues with malicious or misguided website owners while I'm unlikely to run into a serious one with Google. At least assuming none of their employees goes very rogue and starts leaking data en masse, or has a personal vendetta against me or something. I know something like that happened once (https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/), but the odds are probably still pretty low.
        jacquesm 10y ago
        It's the aggregation of all those little bits of data into a giant profile where the risk lies.
        anc84 10y ago
        Are you aware that the NSA used (and probably still uses) Google's data? Once you collect data in a central place you attract malicious interests.
        meowface 10y ago
        Yes, but my adversary in that case is the NSA. Even if Google (or other similar companies) didn't exist, NSA would try to get that data one way or another. Also, though it may be naive, I believe Google does not intend to cooperate with the NSA any more than they're absolutely legally required to.
    - dexterdog 10y ago
      Not when GA is blocked like it is by any privacy-concerned individual.
  - Symbiote 10y ago
    I used to host a site for a local youth sports team. Almost all the referrer logs from Google Images had search terms like "hot under 13 girls". I banned the Google Image robot from the site, since no useful visitors arrived this way.
- vii 10y ago
  Referrer hiding is important to Google itself: https://googleblog.blogspot.com/2011/10/making-search-more-secure.html https://googleblog.blogspot.com/2011/10/making-search-more-s... Previously, some (generally scammy) websites used these keywords forwarded from Google to actually change the content. By concealing the keywords people were searching for to land on your website, they force content hosters and ad networks to depend on the Google analytics + ads ecosystem. With these keywords, you could gather information about your Google rank for queries. Whether it's net beneficial for you as a browser owner to pass referrer information - probably it is if you like the people hosting the content you read, as it helps them understand their traffic and improve their service. If you don't like them (probably because they are spam) then this just helps them be more effective spammers.
- Too 10y ago
  The refferer can be sensitive both security and integrity wise. Would you like any destination to find out that you came from any of these sites: example.com/admin/?password=xyz or gaymidgetporn.com/forum/how-to-enlarge-penis
  - PavlovsCat 10y ago
    On the other hand, if you suddenly have 100 times the traffic an image on your server got hotlinked elsewhere, wouldn't you want to know what is going on? There's upsides and downsides.. I can't really make up my mind what I'd prefer, other than the utopian option of "all users know what they're doing and how to configure their browsers".
pierrec 10y ago
After some testing, it appears that this plugin offers better referer hiding than Google's redirect. I've verified that it completely hides the referer, whereas Google at least reveals that you're coming from Google (which makes sense, since website owners will see this and it can encourage them to subscribe to Google Analytics so they can see some of those hidden details). Also, referer hiding does not justify URL substitution as a result of right-clicking a link. That just forces less savvy users to give Google an additional clickthrough when all they want is the URL.
- greglindahl 10y ago
  Hopefully you've verified that the referer hiding is due to the plugin and not your personal settings. That's a great feature in a plugin, since many users appreciate referer hiding being the default for search engine clicks.
  - pierrec 10y ago
    Yes, good point, and it was easy to verify. Disable plugin; search "what is my referer"; click on first result: Your HTTP referer is google.ca. Enable plugin; repeat: Your HTTP referer is No referer / hidden.
    - deleted 10y ago
      [deleted]
jessriedel 10y ago
Can someone explain why my browser provides referer info at all? Why isn't this a permission I need to give away? What common features that the user needs on the web rely on it?
- DanBC 10y ago
  The RFC suggested that permissions should be asked for. https://tools.ietf.org/html/rfc1945#section-10.13 https://tools.ietf.org/html/rfc1945#section-10.13 Note: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information.
  - nothrabannosir 10y ago
    Not that it should be asked for; just that it should be configurable. Subtle but important difference. Firefox is following this recommendation, but doesn't ask for it explicitly.
- detaro 10y ago
  It's one of these things that were added once, pages started to rely on it and now nobody wants to turn it off globally because things will break. They've added ways for sites to control if/how much information is sent on outgoing links though in recent browsers. e.g. in HN's HTML you find <meta name="referrer" content="origin"> which tells the browser to only send the domain, but not the exact URL.
- pierrec 10y ago
  >What common features that the user needs on the web rely on it? - Website owners and content creators use the Referer to see where their users are coming from, which allows them to make content which is more suitable, which indirectly benefits the user. - It helps prevent hotlinking, so it can protect small websites from getting hammered, which again could indirectly benefit the user. I guess the point is that everyone's a "user" of HTTP, including website owners, and their interests are partly linked to yours. In an objective sense I find the standard still makes sense. In an individualistic sense, things are more complicated.
wodenokoto 10y ago
Why is it so bad that a webmaster gets to know I found them through Google?
- chii 10y ago
  to prevent them from doing silly things like paywall blocking, except when via a google search.
revelation 10y ago
Does it have to be so freaking long? They have 512+ bits of various IDs and tracking data in there, that's enough to identify every person on this earth ... a bazillion times over.

amluto 10y ago

I wonder whether Google deliberately makes it hard to copy a real URL to the clipboard or whether it's a careless unintended side effect of tracking context menu open in new tab operations.

deleted 10y ago
[deleted]
deleted 10y ago
[deleted]

rasz_pl 10y ago

There used to be 'Google Tracking-B-Gone' userjs, but it stopped working some time ago. I patched mine locally, also stripping tracking from Image results. Quick googling shows someone updated it recently https://greasyfork.org/en/scripts/1810-google-tracking-b-gone https://greasyfork.org/en/scripts/1810-google-tracking-b-gon... I have second version stripping tracking from Gmail links (yes, google tracks your clicks in gmail). Should probably throw them up on github.

verroq 10y ago
I use this one for google search and image. https://chrome.google.com/webstore/detail/google-link-fixer/pcpdkhaeeohmogfgcheopfcigcfdaioj?hl=en https://chrome.google.com/webstore/detail/google-link-fixer/...