6 ms·

"something designed to violate user privacy" I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy con

"something designed to violate user privacy" I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy concern. From screen resolution to mouse movement, everything can be abused to build profiles. Referer headers have a host of valid usecases but if you are opposed any data being shared you'll probably dismiss all of them.

rayiner 7y ago
What’s a valid use case?
- spiderfarmer 7y ago
  If my site is getting hammered by visitors I would like to be able to easily discern if it's because I'm featured on HN's frontpage or if I'm victim of a DDOS attack.
  - y0ghur7_xxx 7y ago
    The referrer header is in no way a tool to differentiate real users from a ddos attack.
    - spiderfarmer 7y ago
      I disagree. A fake referer is easily checked: Is my link really on the frontpage? If so: all good. If not: it's getting suspicious.
      - close04 7y ago
        A similar line of argumentation has been historically used to push every outrageous thing on innocent people since forever. You sell the "abuse" as defense for a shocking crime. Ok, you only said DDoS when the usual is terrorism and child abuse. But the bottom line is the same: I need to take something private from you to defend myself. What would you think if all stores took every measurement they could about you without disclosing it and eventually justified it by saying "how else would I know you're not a thief"?
        spiderfarmer 7y ago
        You sell the "abuse" as defense for a shocking crime. This works the other way around too. You use the abuse of non-personally identifiable information (by combining it with other data points, illegal without consent in the EU) to take useful data away from innocent webmasters.
        close04 7y ago
        Doesn't your argument work against encryption just the same? With such an argument aren't you actually punishing 99.9% of the internet population for what the 0.1% is doing?
        JohnFen 7y ago
        > to take useful data away from innocent webmasters. Webmasters who are collecting data about me or my machines (excluding the data about my direct use of their site) without my permission are not "innocent webmasters".
        close04 7y ago
        I'm surprised that in 2019 people (especially on HN) still believe/claim that users trying to hang on to their personal data "abuse" this to "take useful data away from innocent webmasters". There are dozens of real life situations where covertly collecting such data would be considered completely unacceptable and yet my comment arguing this was still substantially downvoted. But I guess my point is being in a technically literate community makes no difference when it comes to making a buck. Once one agrees to take a "not an outrageous amount" of private data for a bit of money, they'll agree to take an outrageous amount for outrageous money. And I think this is a perfectly accurate explanation for what FB, Google, [you name it] are doing.
        rubinelli 7y ago
        A referrer header is not an outrageous amount of information. It's the store-equivalent of asking "Where did you learn about us?" Taking it away would hurt smaller sites and do nothing against large companies and ad networks.
    - jimktrains2 7y ago
      But in general it's the only way to understand who's linking to you. Sure, not essential, but useful to see in general, especially when search engines could send it and you could see what keywords people used to find your site. If it were gone, as it is in many cases now due to https, people will adjust.
      - spiderfarmer 7y ago
        "as it is in many cases now due to https" That's not exactly true. Referrer is only hidden if it's explicitly asked by using a meta tag: <meta name="referrer" content="no-referrer" /> Or by using Referrer-Policy: Referrer-Policy: no-referrer The default behavior is no-referrer-when-downgrade. This means that referrers from https to http are hidden. But https > https is still visible. And with https adaption reaching saturation, referer headers are usually still sent.
      - ABeeSea 7y ago
        Google has used encrypted search terms in the referrals for years now.
dredmorbius 7y ago
every datapoint is a privacy concern Yes, this. 33 bits.
- majewsky 7y ago
  > 33 bits. Context: There are about 2^33 people on earth, so it takes roughly 33 bits of information to identify a single person. (In practice, it's probably slightly more bits because not all bits carry unique information.)
  - spiderfarmer 7y ago
    33 bits is not nearly enough: https://www.innovationfiles.org/33-bits-of-nonsense/ https://www.innovationfiles.org/33-bits-of-nonsense/ >"Anonymity in real life is much different than anonymity in the lab, and most people are content to be “one in a million” even if they cannot be “one in 6.7 billion.” In any data set, highly unique individuals (i.e. the outliers) may stand out, much like today’s celebrities do not enjoy the same level of anonymity as the average citizen. However, the fact that some individuals may be identified in a particular data set does not mean that any (or all) individuals may be identified in the data set."
pdkl95 7y ago
> I fail to see why sending the referer is a privacy concern. From the article: >> The Zeus platform monitors contextual data such as ... what URL they have used to arrive there ... The publisher will then match that data to its existing audience data pools ... to create assumptions on what that news user’s consumption intent will be. The technology uses machine learning to decipher the patterns. They are explicitly stating they use Referrer-like data to track users.
- spiderfarmer 7y ago
  So that probably makes me part of a group composed of several hundreds of other visitors who exhibited the same behavior. I fail to see how that violates my privacy. You'd probably learn a lot more about me by watching me walk from my office to the parking lot.
  - Barrin92 7y ago
    >You'd probably learn a lot more about me by watching me walk from my office to the parking lot. well I don't really expect the newspaper that I read to watch me walk from my place of work to the parking lot. In fact I don't want them to watch me at all because I don't expect newspapers to be in the surveillance business. When I buy a newspaper at a store the guy behind the counter doesn't follow me three blocks to figure out how I drink my coffee at the coffeeshop, yet curiously enough this is how the internet works, everyhwere
    - spiderfarmer 7y ago
      > When I buy a newspaper at a store the guy behind the counter doesn't follow me three blocks to figure out how I drink my coffee at the coffeeshop, yet curiously enough this is how the internet works, everyhwere But if you keep returning to the same news stand, he'll probably reach for the newspaper you like when he sees you coming. This is the equivalent of what the Washington Post does now. Not following you to the coffeeshop like the ad tech of today.
      - 7y ago
oytis 7y ago
> Following that logic, every datapoint is a privacy concern I think it's a reasonable login when we're talking about data points sent implicitly. In my ideal world the website just gets the resource identifier, and browser cares for the rest.
nerdponx 7y ago
From screen resolution to mouse movement, everything can be abused to build profiles That's correct. I want none of these available without my explicit consent.
JohnFen 7y ago
> Following that logic, every datapoint is a privacy concern. Yes, every data point is a privacy concern.
- oehpr 7y ago
  Even the DNT header is a privacy concern.

rayiner 7y ago

What’s a valid use case?

spiderfarmer 7y ago
If my site is getting hammered by visitors I would like to be able to easily discern if it's because I'm featured on HN's frontpage or if I'm victim of a DDOS attack.
- y0ghur7_xxx 7y ago
  The referrer header is in no way a tool to differentiate real users from a ddos attack.
  - spiderfarmer 7y ago
    I disagree. A fake referer is easily checked: Is my link really on the frontpage? If so: all good. If not: it's getting suspicious.
    - close04 7y ago
      A similar line of argumentation has been historically used to push every outrageous thing on innocent people since forever. You sell the "abuse" as defense for a shocking crime. Ok, you only said DDoS when the usual is terrorism and child abuse. But the bottom line is the same: I need to take something private from you to defend myself. What would you think if all stores took every measurement they could about you without disclosing it and eventually justified it by saying "how else would I know you're not a thief"?
      - spiderfarmer 7y ago
        You sell the "abuse" as defense for a shocking crime. This works the other way around too. You use the abuse of non-personally identifiable information (by combining it with other data points, illegal without consent in the EU) to take useful data away from innocent webmasters.
        close04 7y ago
        Doesn't your argument work against encryption just the same? With such an argument aren't you actually punishing 99.9% of the internet population for what the 0.1% is doing?
        JohnFen 7y ago
        > to take useful data away from innocent webmasters. Webmasters who are collecting data about me or my machines (excluding the data about my direct use of their site) without my permission are not "innocent webmasters".
        close04 7y ago
        I'm surprised that in 2019 people (especially on HN) still believe/claim that users trying to hang on to their personal data "abuse" this to "take useful data away from innocent webmasters". There are dozens of real life situations where covertly collecting such data would be considered completely unacceptable and yet my comment arguing this was still substantially downvoted. But I guess my point is being in a technically literate community makes no difference when it comes to making a buck. Once one agrees to take a "not an outrageous amount" of private data for a bit of money, they'll agree to take an outrageous amount for outrageous money. And I think this is a perfectly accurate explanation for what FB, Google, [you name it] are doing.
      - rubinelli 7y ago
        A referrer header is not an outrageous amount of information. It's the store-equivalent of asking "Where did you learn about us?" Taking it away would hurt smaller sites and do nothing against large companies and ad networks.
  - jimktrains2 7y ago
    But in general it's the only way to understand who's linking to you. Sure, not essential, but useful to see in general, especially when search engines could send it and you could see what keywords people used to find your site. If it were gone, as it is in many cases now due to https, people will adjust.
    - spiderfarmer 7y ago
      "as it is in many cases now due to https" That's not exactly true. Referrer is only hidden if it's explicitly asked by using a meta tag: <meta name="referrer" content="no-referrer" /> Or by using Referrer-Policy: Referrer-Policy: no-referrer The default behavior is no-referrer-when-downgrade. This means that referrers from https to http are hidden. But https > https is still visible. And with https adaption reaching saturation, referer headers are usually still sent.
    - ABeeSea 7y ago
      Google has used encrypted search terms in the referrals for years now.

dredmorbius 7y ago

every datapoint is a privacy concern Yes, this. 33 bits.

majewsky 7y ago
> 33 bits. Context: There are about 2^33 people on earth, so it takes roughly 33 bits of information to identify a single person. (In practice, it's probably slightly more bits because not all bits carry unique information.)
- spiderfarmer 7y ago
  33 bits is not nearly enough: https://www.innovationfiles.org/33-bits-of-nonsense/ https://www.innovationfiles.org/33-bits-of-nonsense/ >"Anonymity in real life is much different than anonymity in the lab, and most people are content to be “one in a million” even if they cannot be “one in 6.7 billion.” In any data set, highly unique individuals (i.e. the outliers) may stand out, much like today’s celebrities do not enjoy the same level of anonymity as the average citizen. However, the fact that some individuals may be identified in a particular data set does not mean that any (or all) individuals may be identified in the data set."

pdkl95 7y ago

> I fail to see why sending the referer is a privacy concern. From the article: >> The Zeus platform monitors contextual data such as ... what URL they have used to arrive there ... The publisher will then match that data to its existing audience data pools ... to create assumptions on what that news user’s consumption intent will be. The technology uses machine learning to decipher the patterns. They are explicitly stating they use Referrer-like data to track users.

spiderfarmer 7y ago
So that probably makes me part of a group composed of several hundreds of other visitors who exhibited the same behavior. I fail to see how that violates my privacy. You'd probably learn a lot more about me by watching me walk from my office to the parking lot.
- Barrin92 7y ago
  >You'd probably learn a lot more about me by watching me walk from my office to the parking lot. well I don't really expect the newspaper that I read to watch me walk from my place of work to the parking lot. In fact I don't want them to watch me at all because I don't expect newspapers to be in the surveillance business. When I buy a newspaper at a store the guy behind the counter doesn't follow me three blocks to figure out how I drink my coffee at the coffeeshop, yet curiously enough this is how the internet works, everyhwere
  - spiderfarmer 7y ago
    > When I buy a newspaper at a store the guy behind the counter doesn't follow me three blocks to figure out how I drink my coffee at the coffeeshop, yet curiously enough this is how the internet works, everyhwere But if you keep returning to the same news stand, he'll probably reach for the newspaper you like when he sees you coming. This is the equivalent of what the Washington Post does now. Not following you to the coffeeshop like the ad tech of today.
    - 7y ago

oytis 7y ago

> Following that logic, every datapoint is a privacy concern I think it's a reasonable login when we're talking about data points sent implicitly. In my ideal world the website just gets the resource identifier, and browser cares for the rest.

nerdponx 7y ago

From screen resolution to mouse movement, everything can be abused to build profiles That's correct. I want none of these available without my explicit consent.

JohnFen 7y ago

> Following that logic, every datapoint is a privacy concern. Yes, every data point is a privacy concern.

oehpr 7y ago
Even the DNT header is a privacy concern.