6 ms·

> what URL they have used to arrive there This is yet another example of why sending the Referrer header is insane. It's a massive privacy breach by design. An

by pdkl95 7y ago

> what URL they have used to arrive there This is yet another example of why sending the Referrer header is insane. It's a massive privacy breach by design. Anything serious about protecting privacy needs to stop intentionally betraying the user's browsing path and simply remove the header from all HTTP requests. Anything that functionally relies on a valid referrer is at best an unfortunate but necessary casualty. However, I suspect that far too often this is simply a way to obfuscate the usual tracking. If you tie your functionality to something designed to violate user privacy, don't be surprised if that functionality breaks when the privacy leak is finally fixed.

mosselman 7y ago
I agree. There are some add-ons that spoof/disable this header for you, but as you said, this breaks some sites. I agree, as a consumer, that website that rely on the header are out of luck with regards to my business, but at work I don't always have a choice with regards to which online tools we use. But white listing the things that break is a fine solution in that case.
- pessimizer 7y ago
  I forge the referer as the root of the site, except in the case of news sites that allow referers from google news to bypass the paywall, in which case I always forge that. This very rarely breaks anything (one out of a million sites expect an external or specific referer.)
rubinelli 7y ago
There are very goods reasons for the Referrer header to be used. If you see a lot of traffic going to a URL with a typo, you will want to know where that typo is. If someone hotlinks to a large file in your domain, you will want to know who it is and block it. Any alternative would be much more intrusive.
- pdkl95 7y ago
  > you will want to know where that typo is ... you will want to know who it I know you want to know those things. Find another way to handle those issues. To be a "good reason", you need to show why your reason is worth paying the high price of betraying every user's browsing path to every server. Worrying about hotlinks and typos... "ain't the same fuckin' ballpark, it ain't the same league, it ain't even the same fuckin' sport". > Any alternative would be much more intrusive. Did you consider only serving that "large file" only when accompanied with a proper session cookie created when they loaded the HTML file? There are many solutions to those problems, including some that are sever-side-only.
  - spiderfarmer 7y ago
    Find another way to handle those issues. If there's another way, it would lead to the same privacy concerns. why your reason is worth paying the high price of betraying every user's browsing path to every server First explain why it's a) betrayal b) a high price. a proper session cookie This again could lead to privacy concerns.
  - dvfjsdhgfv 7y ago
    I understand your concerns very well, but I have a different perspective. I don't modify my Referrer header. I want to let the websites I'm using where I came from. A referrer by itself is innocuous - only when you combine it with other nefarious techniques it wreaks havoc on users privacy. But on it's own, in an anonymous browser environment that I tend to use, it's actually quite useful.
- turbinerneiter 7y ago
  Sadly, the industry chose to abuse it to the detriment of the users. Enough reason to take it away.
spiderfarmer 7y ago
"something designed to violate user privacy" I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy concern. From screen resolution to mouse movement, everything can be abused to build profiles. Referer headers have a host of valid usecases but if you are opposed any data being shared you'll probably dismiss all of them.
- rayiner 7y ago
  What’s a valid use case?
  - spiderfarmer 7y ago
    If my site is getting hammered by visitors I would like to be able to easily discern if it's because I'm featured on HN's frontpage or if I'm victim of a DDOS attack.
    - y0ghur7_xxx 7y ago
      The referrer header is in no way a tool to differentiate real users from a ddos attack.
      - spiderfarmer 7y ago
        I disagree. A fake referer is easily checked: Is my link really on the frontpage? If so: all good. If not: it's getting suspicious.
        close04 7y ago
        A similar line of argumentation has been historically used to push every outrageous thing on innocent people since forever. You sell the "abuse" as defense for a shocking crime. Ok, you only said DDoS when the usual is terrorism and child abuse. But the bottom line is the same: I need to take something private from you to defend myself. What would you think if all stores took every measurement they could about you without disclosing it and eventually justified it by saying "how else would I know you're not a thief"?
amarshall 7y ago
Cross-origin sending of the Referer header can be disabled in Firefox with network.http.referer.XOriginPolicy, along with a variety of other Referer-related options [1]. I have it set to 1 (and XOriginTrimmingPolicy to 2) and haven’t experienced (m)any issues. [1] https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
dehrmann 7y ago
It's not really "design"--the header name is even misspelled. This one always felt like, at the time in the early days of the web, it'd be interesting data to pass along. Since then, things like image hotlinking started to depend on it, and Google got better about hiding referrer data, so there wasn't the same motivation to fix it as implementing same-origin policy. If the web were invented today, yes, I doubt that this would be a thing.
- stubish 7y ago
  It was how you did sessions before Cookies and JavaScript existed, and existed because it was a problem that needed solving. Converting forms to wizards and the first Internet shopping carts.
commoner 7y ago
If you're using Firefox, the Smart Referer add-on strips out the HTTP Referer and the value of document.referer (in JavaScript) from cross-domain requests. It includes a default whitelist, and is customizable. https://addons.mozilla.org/en-US/firefox/addon/smart-referer https://addons.mozilla.org/en-US/firefox/addon/smart-referer It's also open source. https://gitlab.com/smart-referer/smart-referer https://gitlab.com/smart-referer/smart-referer This extension is most effective if you also use an ad blocker (like uBlock Origin) and Firefox's first-party isolation feature, although Smart Referer will still help prevent tracking even if you don't. https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...
- jakejarvis 7y ago
  You can also set this directly in about:config under network.http.sendRefererHeader: 0 = never send the header 1 = send the header only when clicking on links and similar elements 2 = (default) send on all requests (e.g. images, links, etc.) If you want more granular control (like sending referrers but only the root of the domain) all of the various network.http.referer flags for Firefox are listed here: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer Doesn't have a few of the features that your extension has, but it's done the trick for me!
  - copperx 7y ago
    Has the 0 setting broken anything in your experience?
  - commoner 7y ago
    I'm not the developer of the extension (just a user), but thanks for the about:config tip!
ggg3 7y ago
and I wanted to recall that google employees repeatedly removed chromium's project code to restrict or disable referrer headers. I personally was involved in 3 distinct times. And after that gave up chromium and the lie of google-independence completely. and so should you. If they tweak things to reach their profit goals, they will also do the same when any agency "asks" them to. it's a slippery slope, and they already crossed

by pdkl95 7y ago

mosselman 7y ago

I agree. There are some add-ons that spoof/disable this header for you, but as you said, this breaks some sites. I agree, as a consumer, that website that rely on the header are out of luck with regards to my business, but at work I don't always have a choice with regards to which online tools we use. But white listing the things that break is a fine solution in that case.

pessimizer 7y ago
I forge the referer as the root of the site, except in the case of news sites that allow referers from google news to bypass the paywall, in which case I always forge that. This very rarely breaks anything (one out of a million sites expect an external or specific referer.)

rubinelli 7y ago

There are very goods reasons for the Referrer header to be used. If you see a lot of traffic going to a URL with a typo, you will want to know where that typo is. If someone hotlinks to a large file in your domain, you will want to know who it is and block it. Any alternative would be much more intrusive.

pdkl95 7y ago
> you will want to know where that typo is ... you will want to know who it I know you want to know those things. Find another way to handle those issues. To be a "good reason", you need to show why your reason is worth paying the high price of betraying every user's browsing path to every server. Worrying about hotlinks and typos... "ain't the same fuckin' ballpark, it ain't the same league, it ain't even the same fuckin' sport". > Any alternative would be much more intrusive. Did you consider only serving that "large file" only when accompanied with a proper session cookie created when they loaded the HTML file? There are many solutions to those problems, including some that are sever-side-only.
- spiderfarmer 7y ago
  Find another way to handle those issues. If there's another way, it would lead to the same privacy concerns. why your reason is worth paying the high price of betraying every user's browsing path to every server First explain why it's a) betrayal b) a high price. a proper session cookie This again could lead to privacy concerns.
- dvfjsdhgfv 7y ago
  I understand your concerns very well, but I have a different perspective. I don't modify my Referrer header. I want to let the websites I'm using where I came from. A referrer by itself is innocuous - only when you combine it with other nefarious techniques it wreaks havoc on users privacy. But on it's own, in an anonymous browser environment that I tend to use, it's actually quite useful.
turbinerneiter 7y ago
Sadly, the industry chose to abuse it to the detriment of the users. Enough reason to take it away.

spiderfarmer 7y ago

"something designed to violate user privacy" I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy concern. From screen resolution to mouse movement, everything can be abused to build profiles. Referer headers have a host of valid usecases but if you are opposed any data being shared you'll probably dismiss all of them.

rayiner 7y ago
What’s a valid use case?
- spiderfarmer 7y ago
  If my site is getting hammered by visitors I would like to be able to easily discern if it's because I'm featured on HN's frontpage or if I'm victim of a DDOS attack.
  - y0ghur7_xxx 7y ago
    The referrer header is in no way a tool to differentiate real users from a ddos attack.
    - spiderfarmer 7y ago
      I disagree. A fake referer is easily checked: Is my link really on the frontpage? If so: all good. If not: it's getting suspicious.
      - close04 7y ago
        A similar line of argumentation has been historically used to push every outrageous thing on innocent people since forever. You sell the "abuse" as defense for a shocking crime. Ok, you only said DDoS when the usual is terrorism and child abuse. But the bottom line is the same: I need to take something private from you to defend myself. What would you think if all stores took every measurement they could about you without disclosing it and eventually justified it by saying "how else would I know you're not a thief"?

amarshall 7y ago

Cross-origin sending of the Referer header can be disabled in Firefox with network.http.referer.XOriginPolicy, along with a variety of other Referer-related options [1]. I have it set to 1 (and XOriginTrimmingPolicy to 2) and haven’t experienced (m)any issues. [1] https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer

dehrmann 7y ago

It's not really "design"--the header name is even misspelled. This one always felt like, at the time in the early days of the web, it'd be interesting data to pass along. Since then, things like image hotlinking started to depend on it, and Google got better about hiding referrer data, so there wasn't the same motivation to fix it as implementing same-origin policy. If the web were invented today, yes, I doubt that this would be a thing.

stubish 7y ago
It was how you did sessions before Cookies and JavaScript existed, and existed because it was a problem that needed solving. Converting forms to wizards and the first Internet shopping carts.

commoner 7y ago

If you're using Firefox, the Smart Referer add-on strips out the HTTP Referer and the value of document.referer (in JavaScript) from cross-domain requests. It includes a default whitelist, and is customizable. https://addons.mozilla.org/en-US/firefox/addon/smart-referer https://addons.mozilla.org/en-US/firefox/addon/smart-referer It's also open source. https://gitlab.com/smart-referer/smart-referer https://gitlab.com/smart-referer/smart-referer This extension is most effective if you also use an ad blocker (like uBlock Origin) and Firefox's first-party isolation feature, although Smart Referer will still help prevent tracking even if you don't. https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox https://www.ghacks.net/2017/11/22/how-to-enable-first-party-...

jakejarvis 7y ago
You can also set this directly in about:config under network.http.sendRefererHeader: 0 = never send the header 1 = send the header only when clicking on links and similar elements 2 = (default) send on all requests (e.g. images, links, etc.) If you want more granular control (like sending referrers but only the root of the domain) all of the various network.http.referer flags for Firefox are listed here: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer Doesn't have a few of the features that your extension has, but it's done the trick for me!
- copperx 7y ago
  Has the 0 setting broken anything in your experience?
- commoner 7y ago
  I'm not the developer of the extension (just a user), but thanks for the about:config tip!

ggg3 7y ago

and I wanted to recall that google employees repeatedly removed chromium's project code to restrict or disable referrer headers. I personally was involved in 3 distinct times. And after that gave up chromium and the lie of google-independence completely. and so should you. If they tweak things to reach their profit goals, they will also do the same when any agency "asks" them to. it's a slippery slope, and they already crossed