3 ms·
Encrypting the url parameters is the way to go: Requests for: http://duckduckgo.com/?q=hacker+news http://duckduckgo.com/?q=hacker+news Should HTTP redirect
by mike-cardwell 17y ago
Encrypting the url parameters is the way to go:
Requests for:
http://duckduckgo.com/?q=hacker+news http://duckduckgo.com/?q=hacker+news
Should HTTP redirect to something like:
http://duckduckgo.com/?enc=34g7h3giuh3g http://duckduckgo.com/?enc=34g7h3giuh3g
Where 34g7h3giuh3g would be the ciphertext generated by encrypting "hacker news". That page knows what the search term was because it will have decrypted the parameters on the server side, but any referers would just contain "garbage", and it would also mean people can copy/paste the address bar about.
- apgwoz 17y agoall the other person has to do then is perform a search to see the secret terms. granted, it's better than it showing up in plain text in the referrer, but you could easily write a script to scrape the actual terms...
- mike-cardwell 17y agoYes, you're right. I didn't think of that.
- erikpukinskis 17y agoWhat if you use the IP address of the user as a seed for the encryption? Then if someone else used the same key from a different IP they'd get different search terms?
- epi0Bauqu 17y agoThat embeds the IP in the process and could theoretically be reverse-engineered.