10 ms·

> what people click on email, thanks to gmail rewriting all links to a google track url (while misleading the user by a fake status text on mouse over) They us

> what people click on email, thanks to gmail rewriting all links to a google track url (while misleading the user by a fake status text on mouse over) They use the same trick for Google Search in a way that is transparent to the user - as long as you have JS turned on. When you switch it off, you realize instead of clicking on HNs URL, you actually click https://www.google.com/url?q=https://news.ycombinator.com/&sa=U&ved=0ahUKEwjMxpegp73gAhXvlIsKHcxcDV0QFggZMAA&usg=AOvVaw23bpdDl4nmvkO_L9fANoX7 https://www.google.com/url?q=https://news.ycombinator.com/&s... Now, they want to move a step further. I wonder when they're going to stop.

k_bx 8y ago
This technique (redirecting through some dummy ?url=... page) is a common way of doing an external redirect on any service you're building. It's a simple way of making it impossible to see the actual Referer to external website, which is more secure to your data and the service you're building (e.g. Gmail).
- z3t4 8y ago
  But browsers seem to have stopped giving out referrer some years back.
- ajnin 8y ago
  There's a standard way to do that, which is to add a rel="noreferrer" tag to your outgoing links.
  - k_bx 8y ago
    Code usually doesn't carry final HTML in its data structures, whereas converting a URL in a single place where it's extracted is easy. In other words, making sure you didn't miss to put rel=noreferrer everywhere is way harder.
  - detaro 8y ago
    And it still makes somewhat sense to not entirely rely on it, given people still use browsers that do not support it.
- martin_a 8y ago
  > It's a simple way of making it impossible to see the actual Referer to external website It's about tracking outbound links, not about masking the referrer. As already mentioned, there are standard ways for that.
  - k_bx 8y ago
    Tracking can be done in JS via onclick event also. What makes you so sure it's not about masking referrer?
    - martin_a 8y ago
      Because I've done tracking like that for several years, lots of services are still doing it this way and because rel="noopener" or rel="noreferrer" is the way to go if you want to mask the referrer. Even Google recommends to do it that way[0]. If you are not using it for tracking, there is no point in doing it like this after all. [0] https://developers.google.com/web/tools/lighthouse/audits/noopener https://developers.google.com/web/tools/lighthouse/audits/no...
muthdra 8y ago
Actually, it seems like the <a> you click on Google Search has the right href (which is what appears on the status text) but it also has a ping attribute to it for tracking. https://www.w3schools.com/tags/att_a_ping.asp https://www.w3schools.com/tags/att_a_ping.asp
- degenerate 8y ago
  I'm surprised there is not a chrome extension to remove these.
  - dvfjsdhgfv 8y ago
    I'm not surprised at all. Fortunately we still have Firefox: https://addons.mozilla.org/en-US/firefox/addon/google-no-tracking-url/ https://addons.mozilla.org/en-US/firefox/addon/google-no-tra... Edit: it seems to remove ping, but the onmousedown event is still there.
  - vntok 8y ago
    Nobody cares, really, except for a percent fringe users of a percent of Google users. On a more general point, once again Google Search is provided to you for free. If you don't want to use it by their rules, you are entirely free to use Bing or Yahoo. Actually using the service regularly, because it is tailored to your workflow and provides value to you, while complaining that the tailored/value-adding part is driven by an analysis of your behaviour on the servicee... that's very hypocritical.
    - degenerate 8y ago
      I don't use Google, I use StartPage. I am plainly stating that I am surprised nobody made an extension to remove the ping= link attribute from all webpages, considering that the only reason it exists is to track user activity.
      - vntok 8y ago
        That is exactly what is hypocritical about your behaviour: Startpage exclusively uses results from Google, which the company pays Google for. So you are using Google regularly while complaining about it.

k_bx 8y ago

This technique (redirecting through some dummy ?url=... page) is a common way of doing an external redirect on any service you're building. It's a simple way of making it impossible to see the actual Referer to external website, which is more secure to your data and the service you're building (e.g. Gmail).

z3t4 8y ago
But browsers seem to have stopped giving out referrer some years back.
ajnin 8y ago
There's a standard way to do that, which is to add a rel="noreferrer" tag to your outgoing links.
- k_bx 8y ago
  Code usually doesn't carry final HTML in its data structures, whereas converting a URL in a single place where it's extracted is easy. In other words, making sure you didn't miss to put rel=noreferrer everywhere is way harder.
- detaro 8y ago
  And it still makes somewhat sense to not entirely rely on it, given people still use browsers that do not support it.
martin_a 8y ago
> It's a simple way of making it impossible to see the actual Referer to external website It's about tracking outbound links, not about masking the referrer. As already mentioned, there are standard ways for that.
- k_bx 8y ago
  Tracking can be done in JS via onclick event also. What makes you so sure it's not about masking referrer?
  - martin_a 8y ago
    Because I've done tracking like that for several years, lots of services are still doing it this way and because rel="noopener" or rel="noreferrer" is the way to go if you want to mask the referrer. Even Google recommends to do it that way[0]. If you are not using it for tracking, there is no point in doing it like this after all. [0] https://developers.google.com/web/tools/lighthouse/audits/noopener https://developers.google.com/web/tools/lighthouse/audits/no...

muthdra 8y ago

Actually, it seems like the <a> you click on Google Search has the right href (which is what appears on the status text) but it also has a ping attribute to it for tracking. https://www.w3schools.com/tags/att_a_ping.asp https://www.w3schools.com/tags/att_a_ping.asp

degenerate 8y ago
I'm surprised there is not a chrome extension to remove these.
- dvfjsdhgfv 8y ago
  I'm not surprised at all. Fortunately we still have Firefox: https://addons.mozilla.org/en-US/firefox/addon/google-no-tracking-url/ https://addons.mozilla.org/en-US/firefox/addon/google-no-tra... Edit: it seems to remove ping, but the onmousedown event is still there.
- vntok 8y ago
  Nobody cares, really, except for a percent fringe users of a percent of Google users. On a more general point, once again Google Search is provided to you for free. If you don't want to use it by their rules, you are entirely free to use Bing or Yahoo. Actually using the service regularly, because it is tailored to your workflow and provides value to you, while complaining that the tailored/value-adding part is driven by an analysis of your behaviour on the servicee... that's very hypocritical.
  - degenerate 8y ago
    I don't use Google, I use StartPage. I am plainly stating that I am surprised nobody made an extension to remove the ping= link attribute from all webpages, considering that the only reason it exists is to track user activity.
    - vntok 8y ago
      That is exactly what is hypocritical about your behaviour: Startpage exclusively uses results from Google, which the company pays Google for. So you are using Google regularly while complaining about it.