3 ms·

yep, you're not being malicious enough :) the issue is not whether the destination site receives the search terms (and indeed, Gabriel suggests that they shoul

by joh6nn 16y ago

yep, you're not being malicious enough :) the issue is not whether the destination site receives the search terms (and indeed, Gabriel suggests that they should continue to do so, either through the GWT, or some other method). the issues is that currently, any advertising networks in use by the destination site also receive the search terms, via the same mechanism: the referrer. that's the crux of the issue. while the destination site can't follow your traffic once you leave it, the ad networks, because of their large user base, frequently can. they can begin to build a much more thorough profile of who you are and what you are searching for than anyone single destination site could. whether that's an invasion of privacy is your call, but to many people it is. currently, they're simply unaware that it's happening.

ohyes 16y ago
Thanks for explaining, I can now see how this might be a problem. Through this same mechanism wouldn't the advertising networks be privy to the content of the sites that I am visiting? It seems that even if we eliminate this, we still have issues with advertisers being able to track and create a profile based on the content of the websites you are visiting. The headers do seem to create a direct link between a given search and a set of visited sites, but can't things like cookies and tracking pixels be used to the same effect? Possibly then using NLP to figure out the most important words on the page? Or the SEO terms that the website uses to get picked up by the search engine? If you are going to let an advertiser post content on your site, it seems to me that it would be very difficult to keep said advertiser from tracking your users. If the user uses Adblocking software or otherwise blocks the advertisers' sub-domains, does the advertiser still receive the referral headers?
- joh6nn 16y ago
  yes, that's right: this is just one arrow out of the quiver. sanitizing the search terms out of the referrer does not fix the full problem. whether the advertisers are receiving the headers are not depends on how the ads are served. to my knowledge, most of the time, they're not receiving the header directly, they're using JS to access the referrer indirectly (it is exposed via the document object). some adblockers merely hide the ads, which would still allow the advertiser to access the referrer. others prevent the ads from loading which i believe would prevent any access.
tdfx 16y ago
Just to avoid confusion, the GWT acronym is usually used to reference the Google Web Toolkit (http://code.google.com/webtoolkit/ http://code.google.com/webtoolkit/), not their Webmaster Tools product.

by joh6nn 16y ago

ohyes 16y ago

Thanks for explaining, I can now see how this might be a problem. Through this same mechanism wouldn't the advertising networks be privy to the content of the sites that I am visiting? It seems that even if we eliminate this, we still have issues with advertisers being able to track and create a profile based on the content of the websites you are visiting. The headers do seem to create a direct link between a given search and a set of visited sites, but can't things like cookies and tracking pixels be used to the same effect? Possibly then using NLP to figure out the most important words on the page? Or the SEO terms that the website uses to get picked up by the search engine? If you are going to let an advertiser post content on your site, it seems to me that it would be very difficult to keep said advertiser from tracking your users. If the user uses Adblocking software or otherwise blocks the advertisers' sub-domains, does the advertiser still receive the referral headers?

joh6nn 16y ago
yes, that's right: this is just one arrow out of the quiver. sanitizing the search terms out of the referrer does not fix the full problem. whether the advertisers are receiving the headers are not depends on how the ads are served. to my knowledge, most of the time, they're not receiving the header directly, they're using JS to access the referrer indirectly (it is exposed via the document object). some adblockers merely hide the ads, which would still allow the advertiser to access the referrer. others prevent the ads from loading which i believe would prevent any access.

tdfx 16y ago

Just to avoid confusion, the GWT acronym is usually used to reference the Google Web Toolkit (http://code.google.com/webtoolkit/ http://code.google.com/webtoolkit/), not their Webmaster Tools product.