7 ms·

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely

As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. The example they give is an insanely bad design for healthcare.gov and I would absolutely not want to find that type of data in my analytics telemetry. It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown. In some cases, this may restrict you from knowing which article the person was reading on the given site before clicking through to yours, but if that’s so important, there are other ways to instrument source tracking.

godelski 9y ago
As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.
- will4274 9y ago
  > why would you not want this on non-private sessions Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address. Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site. Sites are pretty bad at sanitizing their outgoing referers.
  - tmd83 9y ago
    As I read it the parent is for it. He is actually saying it should be always the mode not just for private browsing.
  - regexnerd 9y ago
    I don't use anything but web mail (Fastmail) since 2002. I do my banking and email in one browser and my general browsing in a very locked down Firefox (Many about:config hacks, uBlock Origin, Decentraleyes, Webmail Ad Block, Privacy Badger, and No Coin) that blocks about everything save the actual content. I also run a Pi-hole. Keeping your actions compartmentalised keeps your privacy better controlled. Nothing is perfect, but keeping things separated is generally a better idea than not doing so.
    - gkgicccj 9y ago
      I sound like a shill but is HN being attacked by bots? This is a comment with useful information, why is this downvoted? Mods can you see?
    - tehmaco 9y ago
      If you're not aware of it, you might want to look into Qubes[0], it's an OS that uses virtualisation tech to compartmentalise applications from each other (and the host OS). So you can use your browser of choice for all uses, just in different VMs configured to retain/discard data as you want. [0] https://www.qubes-os.org/ https://www.qubes-os.org/
- progval 9y ago
  It might break websites that provide features based on the referrer (eg. a central authentication that redirects back to the original page)
  - sk5t 9y ago
    I can't recall ever encountering a referer-based authorization scheme that included the path or querystring in its logic--although it seems likely some goofus has implemented it, somewhere.
    - shkkmo 9y ago
      I actually just finished implementing a very simple JWT single sign-on feature. We don't use the referer for the authentication/authorization. However, having the path/query in the referer does allow our partners to know what (if any) post-login redirect path/query to include in the JWT to provide end users a seamless re-authentication experience. We could, of course, build the same functionality into our implementation without relying having the path/query in the referer.
    - ams6110 9y ago
      Considering that referer is trivially spoofable, not a great idea to rely on it for anything really.
      - thefifthsetpin 9y ago
        So are cookies, but you wouldn't say that it's a bad idea to rely on them. Spoofing is only useful if you know the value you need to spoof.
    - DCoder 9y ago
      I have seen sites where the "Download this foobar" link only works when the referrer is the "Details of this foobar" page, where the download link is placed. If you sent a referrer of some other page on the site, e.g. the "list of all foobars" page, downloads would fail.
- yeukhon 9y ago
  My speculation is that this is a compromise in some sense. The change here aligns with what private session is supposed to be. Private browsing will(1) start out with no sessions (none from normal browsing mode), (2) provides automatic tracker protection, and (3) will clear sessions (cookies and history) on exit leaving no trace. Private browsing is great for a number of use cases such as debug/test web app with a new session, visit NSFW, or hide the fact you watch cat videos on your puppy-lover friend's computer. So it makes sense to hide the referrer in private sessions opt-in automatically. As for the normal browsing, you can disable referrer. See [1]. I would like to see more privacy and security options to be shown in the preferences UI. about:config is "okay" but it feels like Windows registry, not good for user experience, even by developer standard when one just want to toggle on/off privacy and security settings. [1]: https://askubuntu.com/questions/797135/how-to-disable-http-referrer-in-firefox/797137 https://askubuntu.com/questions/797135/how-to-disable-http-r...
- sologoub 9y ago
  It depends on who “you” are in this case. If that “you” is a company that solely makes money by selling various behavioral data and has little care about various jurisdictions (which they really should, especially with GDPR, let a long “doing the right thing”), it might very well be useful to collect extra signals. However, if “you” is a company that is in some other business, but collects analytics for the purposes of optimizing it’s product and figuring out what actually works for their users, then you don’t event want to run the risk of ingesting something private. Especially with exposure to different jurisdictions. Think of it as the difference between a double-opt-in email list where you are very sure people want to receive the communications and an unsolicited spam list. If the user volunteers this data and it has some relevant business purpose, that’s great. However, if the user doesn’t know I have this info and wouldn’t want me to have it, then acting on that data could create a lot of negative emotions that as a company I wouldn’t want.
- mi100hael 9y ago
  It's less common now that web developers have prioritized sane urls, but a lot of sites still have the actual page as a query param like /site.php?page=foo instead of just /foo. Stripping query params by default would render referrers useless on those sites.
- groovecoder 9y ago
  Disclaimer: I'm the Firefox engineer who wrote the patch and the post. We did a user research study measuring website breakage under various privacy protections: https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-w... tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we started by implementing this protection in Private Browsing. However, note that some advertisers demand that AdTech vendors must not serve their ads on certain kinds of pages. (e.g., https://support.google.com/adsense/answer/1348688?hl=en&topic=1271507&rd=1 https://support.google.com/adsense/answer/1348688?hl=en&topi...) Many of those agreements require full referrers to be able to audit the ad inventory. So there are some concerns and trade-offs to make in this space.
  - jdavis703 9y ago
    Many of the ad serving SDKs slurp up all this data anyways and send it down using a request body, query string, or something that isn't the "Referer" HTTP header. I'm not sure how ad verification providers get this data, but if anything it's just going to mean less information leaking out from systems like DFP to the smaller ad tech firms. But firms like Google will still be able to figure out what path you were on.
  - sleavey 9y ago
    Why don't websites just remove ad code from pages they don't want ads to appear on, instead of telling the ad server to not display it on such pages by using the referrer information? Seems like a convoluted way to solve the problem.
    - fiddlerwoaroof 9y ago
      No, the advertiser doesn’t want their ad to appear on a certain publisher’s web page (e.g. banks often can get in trouble if their ads are associated with certain kinds of content).
      - 9y ago
- andrewaylett 9y ago
  To add to everyone else: got to start somewhere. Private browsing seems like a good place, and I've just taken advantage of the plumbing it introduces to set strict origin referer in non-private browsing too. Hopefully, even though groovecoder doesn't mention the possibility, if this works well then we'll see it rolling into regular browsing too, or at least having some UI exposed, in the same way that tracking protection moved from being private browsing only to having an option to enable it in regular browsing. Actually, now I think of it, I wonder if the two could sit behind the same preference in the end?
ams6110 9y ago
I was somewhat shocked that healthcare.gov would have any ads on it. I missed that scandal I guess. https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-personal-data https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-p... Anyone know if this is still the case? I looked at a couple of pages and only saw tiqcdn.com being blocked by uBlock.
- cosmie 9y ago
  That domain belongs to Tealium IQ, an alternative to Google Tag Manager. Tag managers allow you to encapsulate third party tags (and really, any JavaScript you want) and have them dynamically injected without having to hard code anything else on the page. Since that was blocked, you never even saw the other tags that would have attempted being ran.
- gkgicccj 9y ago
  On a side note I recently learnt that ESR is against Obama care. Surprising, I can understand someone young not liking having to pay mandatory insurance but he's old.
- azernik 9y ago
  They were using Floodlight, an analytics tool DoubleClick offers for tracking conversions.
badrabbit 9y ago
As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)
- ams6110 9y ago
  You can sort of do that, context menu -> copy url -> open a new tab -> paste url
  - nofunsir 9y ago
    I do this quite often, and it is indeed usually because I don't want the site to know where I came from.
  - zamber 9y ago
    You can disable refferer sending in FF https://askubuntu.com/questions/797135/how-to-disable-http-referrer-in-firefox/797141#797141 https://askubuntu.com/questions/797135/how-to-disable-http-r...
    - paulie_a 9y ago
      Is there a way to randomize the ref url? It's increasingly becoming impossible to have any actual privacy, so in my opinion the best option is to make the data collected worthless.
- mirimir 9y ago
  I use RefControl in Firefox. I've set the default to be the root of the destination site. That is, for example, clicking a link to https://foo.com https://foo.com sends https://foo.com https://foo.com as the referrer.
  - robocat 9y ago
    There is an about:config setting called spoofSource which does the same thing I think - see comment https://news.ycombinator.com/item?id=16286542 https://news.ycombinator.com/item?id=16286542
volgo 9y ago
Yes it's great from a marketer's point of view. From a consumer's point of view, I don't want you to know where I came from. I don't really care if it's useful to you. It's the difference between pleasing marketers vs pleasing users. Firefox chose wisely
- eli 9y ago
  Honestly, I don't think path information is all that useful for marketers.
  - epigramx 9y ago
    We overthink it when most of the tracking on the internet is based on simply your IP and occasionally a fingerprint of the browser(including any identification done by said browser). Since IPv4's inception that's all that was required and it was an extremely robust way to be tracked if you ask me. If you want to not be tracked you require a random/different IP and a browser fingerprint that blends with the crowd.
    - Feniks 9y ago
      Most people are on mobile nowadays so IP is becoming increasingly worthless.
      - sologoub 9y ago
        If only it was true... quite the opposite is the case at least in US: https://medium.com/@philipn/want-to-see-something-crazy-open-this-link-on-your-phone-with-wifi-turned-off-9e0adb00d024 https://medium.com/@philipn/want-to-see-something-crazy-open...
        Feniks 9y ago
        Oh yeah the US is a lost case.
        9y ago
duncan_bayne 9y ago
> As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. Yeah, but it may surprise you to know that your opinion isn't shared by the people who own the computers in question, or the private data you're digging in. Your personal strong belief is, in this case, utterly irrelevant.
- jrochkind1 9y ago
  I believe they were saying despite being in that business, they -still- think there should be much increased privacy, like the features discussed in OP more widespread. They don't seem to have said so clearly enough. I think some people just read the first half of the sentence and are ready to be mad!
ecesena 9y ago
This is horrible and I believe the user should be informed. Personal data in 3rd party referral is only one of the many side effects. If personal data is available in the URL as query string, chances (very high chances) are that the same data is perfectly visible in clear in the web server logs, and from there only God knows where it's spread, including all the 3rd party services used on the backend side.

godelski 9y ago

As someone that doesn't dig into this data for a living, why would you not want this on non-private sessions (first question I had when reading this)? I'm curious why Mozilla wouldn't want to protect this data leaking in even a normal session.

will4274 9y ago
> why would you not want this on non-private sessions Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address. Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site. Sites are pretty bad at sanitizing their outgoing referers.
- tmd83 9y ago
  As I read it the parent is for it. He is actually saying it should be always the mode not just for private browsing.
- regexnerd 9y ago
  I don't use anything but web mail (Fastmail) since 2002. I do my banking and email in one browser and my general browsing in a very locked down Firefox (Many about:config hacks, uBlock Origin, Decentraleyes, Webmail Ad Block, Privacy Badger, and No Coin) that blocks about everything save the actual content. I also run a Pi-hole. Keeping your actions compartmentalised keeps your privacy better controlled. Nothing is perfect, but keeping things separated is generally a better idea than not doing so.
  - gkgicccj 9y ago
    I sound like a shill but is HN being attacked by bots? This is a comment with useful information, why is this downvoted? Mods can you see?
  - tehmaco 9y ago
    If you're not aware of it, you might want to look into Qubes[0], it's an OS that uses virtualisation tech to compartmentalise applications from each other (and the host OS). So you can use your browser of choice for all uses, just in different VMs configured to retain/discard data as you want. [0] https://www.qubes-os.org/ https://www.qubes-os.org/
progval 9y ago
It might break websites that provide features based on the referrer (eg. a central authentication that redirects back to the original page)
- sk5t 9y ago
  I can't recall ever encountering a referer-based authorization scheme that included the path or querystring in its logic--although it seems likely some goofus has implemented it, somewhere.
  - shkkmo 9y ago
    I actually just finished implementing a very simple JWT single sign-on feature. We don't use the referer for the authentication/authorization. However, having the path/query in the referer does allow our partners to know what (if any) post-login redirect path/query to include in the JWT to provide end users a seamless re-authentication experience. We could, of course, build the same functionality into our implementation without relying having the path/query in the referer.
  - ams6110 9y ago
    Considering that referer is trivially spoofable, not a great idea to rely on it for anything really.
    - thefifthsetpin 9y ago
      So are cookies, but you wouldn't say that it's a bad idea to rely on them. Spoofing is only useful if you know the value you need to spoof.
  - DCoder 9y ago
    I have seen sites where the "Download this foobar" link only works when the referrer is the "Details of this foobar" page, where the download link is placed. If you sent a referrer of some other page on the site, e.g. the "list of all foobars" page, downloads would fail.
yeukhon 9y ago
My speculation is that this is a compromise in some sense. The change here aligns with what private session is supposed to be. Private browsing will(1) start out with no sessions (none from normal browsing mode), (2) provides automatic tracker protection, and (3) will clear sessions (cookies and history) on exit leaving no trace. Private browsing is great for a number of use cases such as debug/test web app with a new session, visit NSFW, or hide the fact you watch cat videos on your puppy-lover friend's computer. So it makes sense to hide the referrer in private sessions opt-in automatically. As for the normal browsing, you can disable referrer. See [1]. I would like to see more privacy and security options to be shown in the preferences UI. about:config is "okay" but it feels like Windows registry, not good for user experience, even by developer standard when one just want to toggle on/off privacy and security settings. [1]: https://askubuntu.com/questions/797135/how-to-disable-http-referrer-in-firefox/797137 https://askubuntu.com/questions/797135/how-to-disable-http-r...
sologoub 9y ago
It depends on who “you” are in this case. If that “you” is a company that solely makes money by selling various behavioral data and has little care about various jurisdictions (which they really should, especially with GDPR, let a long “doing the right thing”), it might very well be useful to collect extra signals. However, if “you” is a company that is in some other business, but collects analytics for the purposes of optimizing it’s product and figuring out what actually works for their users, then you don’t event want to run the risk of ingesting something private. Especially with exposure to different jurisdictions. Think of it as the difference between a double-opt-in email list where you are very sure people want to receive the communications and an unsolicited spam list. If the user volunteers this data and it has some relevant business purpose, that’s great. However, if the user doesn’t know I have this info and wouldn’t want me to have it, then acting on that data could create a lot of negative emotions that as a company I wouldn’t want.
mi100hael 9y ago
It's less common now that web developers have prioritized sane urls, but a lot of sites still have the actual page as a query param like /site.php?page=foo instead of just /foo. Stripping query params by default would render referrers useless on those sites.
groovecoder 9y ago
Disclaimer: I'm the Firefox engineer who wrote the patch and the post. We did a user research study measuring website breakage under various privacy protections: https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-w... tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we started by implementing this protection in Private Browsing. However, note that some advertisers demand that AdTech vendors must not serve their ads on certain kinds of pages. (e.g., https://support.google.com/adsense/answer/1348688?hl=en&topic=1271507&rd=1 https://support.google.com/adsense/answer/1348688?hl=en&topi...) Many of those agreements require full referrers to be able to audit the ad inventory. So there are some concerns and trade-offs to make in this space.
- jdavis703 9y ago
  Many of the ad serving SDKs slurp up all this data anyways and send it down using a request body, query string, or something that isn't the "Referer" HTTP header. I'm not sure how ad verification providers get this data, but if anything it's just going to mean less information leaking out from systems like DFP to the smaller ad tech firms. But firms like Google will still be able to figure out what path you were on.
- sleavey 9y ago
  Why don't websites just remove ad code from pages they don't want ads to appear on, instead of telling the ad server to not display it on such pages by using the referrer information? Seems like a convoluted way to solve the problem.
  - fiddlerwoaroof 9y ago
    No, the advertiser doesn’t want their ad to appear on a certain publisher’s web page (e.g. banks often can get in trouble if their ads are associated with certain kinds of content).
    - 9y ago
andrewaylett 9y ago
To add to everyone else: got to start somewhere. Private browsing seems like a good place, and I've just taken advantage of the plumbing it introduces to set strict origin referer in non-private browsing too. Hopefully, even though groovecoder doesn't mention the possibility, if this works well then we'll see it rolling into regular browsing too, or at least having some UI exposed, in the same way that tracking protection moved from being private browsing only to having an option to enable it in regular browsing. Actually, now I think of it, I wonder if the two could sit behind the same preference in the end?

ams6110 9y ago

I was somewhat shocked that healthcare.gov would have any ads on it. I missed that scandal I guess. https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-personal-data https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-p... Anyone know if this is still the case? I looked at a couple of pages and only saw tiqcdn.com being blocked by uBlock.

cosmie 9y ago
That domain belongs to Tealium IQ, an alternative to Google Tag Manager. Tag managers allow you to encapsulate third party tags (and really, any JavaScript you want) and have them dynamically injected without having to hard code anything else on the page. Since that was blocked, you never even saw the other tags that would have attempted being ran.
gkgicccj 9y ago
On a side note I recently learnt that ESR is against Obama care. Surprising, I can understand someone young not liking having to pay mandatory insurance but he's old.
azernik 9y ago
They were using Floodlight, an analytics tool DoubleClick offers for tracking conversions.

badrabbit 9y ago

As a user I don't want you to know that information. I wish there was a way to click on links with the referer field removed entirely from the request(maybe via context menu)

ams6110 9y ago
You can sort of do that, context menu -> copy url -> open a new tab -> paste url
- nofunsir 9y ago
  I do this quite often, and it is indeed usually because I don't want the site to know where I came from.
- zamber 9y ago
  You can disable refferer sending in FF https://askubuntu.com/questions/797135/how-to-disable-http-referrer-in-firefox/797141#797141 https://askubuntu.com/questions/797135/how-to-disable-http-r...
  - paulie_a 9y ago
    Is there a way to randomize the ref url? It's increasingly becoming impossible to have any actual privacy, so in my opinion the best option is to make the data collected worthless.
mirimir 9y ago
I use RefControl in Firefox. I've set the default to be the root of the destination site. That is, for example, clicking a link to https://foo.com https://foo.com sends https://foo.com https://foo.com as the referrer.
- robocat 9y ago
  There is an about:config setting called spoofSource which does the same thing I think - see comment https://news.ycombinator.com/item?id=16286542 https://news.ycombinator.com/item?id=16286542

volgo 9y ago

Yes it's great from a marketer's point of view. From a consumer's point of view, I don't want you to know where I came from. I don't really care if it's useful to you. It's the difference between pleasing marketers vs pleasing users. Firefox chose wisely

eli 9y ago
Honestly, I don't think path information is all that useful for marketers.
- epigramx 9y ago
  We overthink it when most of the tracking on the internet is based on simply your IP and occasionally a fingerprint of the browser(including any identification done by said browser). Since IPv4's inception that's all that was required and it was an extremely robust way to be tracked if you ask me. If you want to not be tracked you require a random/different IP and a browser fingerprint that blends with the crowd.
  - Feniks 9y ago
    Most people are on mobile nowadays so IP is becoming increasingly worthless.
    - sologoub 9y ago
      If only it was true... quite the opposite is the case at least in US: https://medium.com/@philipn/want-to-see-something-crazy-open-this-link-on-your-phone-with-wifi-turned-off-9e0adb00d024 https://medium.com/@philipn/want-to-see-something-crazy-open...
      - Feniks 9y ago
        Oh yeah the US is a lost case.
        9y ago

duncan_bayne 9y ago

> As someone that digs in this data for a living, personally strongly believe this should be on by default for all browsing. Yeah, but it may surprise you to know that your opinion isn't shared by the people who own the computers in question, or the private data you're digging in. Your personal strong belief is, in this case, utterly irrelevant.

jrochkind1 9y ago
I believe they were saying despite being in that business, they -still- think there should be much increased privacy, like the features discussed in OP more widespread. They don't seem to have said so clearly enough. I think some people just read the first half of the sentence and are ready to be mad!

ecesena 9y ago

This is horrible and I believe the user should be informed. Personal data in 3rd party referral is only one of the many side effects. If personal data is available in the URL as query string, chances (very high chances) are that the same data is perfectly visible in clear in the web server logs, and from there only God knows where it's spread, including all the 3rd party services used on the backend side.