4 ms·

I don't understand what Mozilla does to Firefox anymore. What does it mean a page "can" leak private data? Is there any story about anyone affected by the issu

I don't understand what Mozilla does to Firefox anymore. What does it mean a page "can" leak private data? Is there any story about anyone affected by the issue? Does this issue even exist? It is just breaking another piece of the open web. It just seems like Mozilla not only surrendered in gaining browser market but also actively acts against open web. I thought website creators and website users should be in charge of what they want to do. But it seems no. Now Mozilla decides what web standards can be broken. I'd maybe applaud changes by Mozilla, but with all of these efforts it is not aimed in gaining more users. Firefox does not gain users with such actions. It does not make any sense what is the aim of Mozilla anymore with Firefox.

Ayesh 6y ago
> Is there any story about anyone affected by the issue? Does this issue even exist Yes. Yes it does. Imagine, a web site that has a query parameter with a secret (password reset pages, email unsubscribe, custom feeds, etc). Any images or other assets used in the page will receive the full URL as the referrer, so they can see those secrets. GitHub fixed this very issue a few years ago. They have a feature to get custom RSS feeds for user activity. There is a secret worry parameter in the URL, and any third party images were receiving that full URL. Referrer-Policy header is already supported in many browsers.
- fvv 6y ago
  If it's a page that contain or receive secret should be using https where referrer is already stripped off
  - jefftk 6y ago
    Firefox was using no-referrer-when-downgrade, which only strips refers when navigating from HTTPS to HTTP. They are switching to strict-origin-when-cross-origin, which cuts the referrer down to just the origin when navigating to a different origin.
- tomaszs 6y ago
  So where is a real life example?
iso1631 6y ago
RFC-1945: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information. So not sending referrer has always been fine, and I suspect that firefox will have an option to enable the sending somewhere in it.
- pjmlp 6y ago
  Normal people are going to switch browser instead of trying to find the said option, because Firefox is "broken".
  - wccrawford 6y ago
    I would say that most "normal people" don't even know the browser sends a referrer header, and it doesn't actually do anything for them. This is useful for site owners, and they have little control over what browser their users use. And as someone else already pointed out, the other big browser (Chrome) has already done this.
  - fogihujy 6y ago
    Why would this break anything? Which sites would break just because the referrer policy default setting changed? And why wouldn't sites have fixed that before, since Chrome pushed the same change last year?
  - RHSeeger 6y ago
    Switch to what, exactly? Chrome already does this, according to another poster.
  - Mordisquitos 6y ago
    Normal websites are going to be unaffected in terms of user-facing functionality, regardless of whether they use the data gathered from HTTP Referer internally. On the other hand, badly designed websites that do depend on the HTTP Referer to provide functional user experience are going to lose their users in favour of normal websites, because they are "broken"—and always have been.
darkwater 6y ago
According to Wikipedia [1] the "Referer" (sic) HTTP header is an optional one so I don't see how they are breaking the open web by sending less data in it under some circumstances. [1] https://en.wikipedia.org/wiki/HTTP_referer https://en.wikipedia.org/wiki/HTTP_referer
selykg 6y ago
If the referrer header contains the full URL from which the user came from it could contain something the user deems private. Imagine that the URL contains a search string that contains something the user might deem private, or the article is about something a state may deem to be illegal, etc. This may not be PII but it could be deemed private by the user. The user should be in control of what information could be given to a website. Imagine a scenario where a person is a member of a group that is looking for equal rights in a country that is very much opposed to this. The group uses a tool that happens to make it clear who this group is. The group then links to an article about their cause or similar. Now that country could potentially link things together and demand information about everyone in that group. It's amazing how little bits of information about you can get you in hot water. This is a good move imo, and I'm glad that Mozilla is trying to plug these types of things. It's better for everyone. As an aside, moving to a privacy oriented browser could very well get Firefox more users. Just like Apple's play to being a private and secure mobile OS is getting them users.
- tomaszs 6y ago
  So where is the example?
  - selykg 6y ago
    I think you've been given plenty. You should try to come into these conversations with a lot less attitude. Perhaps I'm reading your tone wrong, and if I am I'm sorry about that. I always come into these discussions assuming I'm not the smartest person in the room because that means I have more to learn. Maybe give that a try?
deleted 6y ago
[deleted]

Ayesh 6y ago

> Is there any story about anyone affected by the issue? Does this issue even exist Yes. Yes it does. Imagine, a web site that has a query parameter with a secret (password reset pages, email unsubscribe, custom feeds, etc). Any images or other assets used in the page will receive the full URL as the referrer, so they can see those secrets. GitHub fixed this very issue a few years ago. They have a feature to get custom RSS feeds for user activity. There is a secret worry parameter in the URL, and any third party images were receiving that full URL. Referrer-Policy header is already supported in many browsers.

fvv 6y ago
If it's a page that contain or receive secret should be using https where referrer is already stripped off
- jefftk 6y ago
  Firefox was using no-referrer-when-downgrade, which only strips refers when navigating from HTTPS to HTTP. They are switching to strict-origin-when-cross-origin, which cuts the referrer down to just the origin when navigating to a different origin.
tomaszs 6y ago
So where is a real life example?

iso1631 6y ago

RFC-1945: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information. So not sending referrer has always been fine, and I suspect that firefox will have an option to enable the sending somewhere in it.

pjmlp 6y ago
Normal people are going to switch browser instead of trying to find the said option, because Firefox is "broken".
- wccrawford 6y ago
  I would say that most "normal people" don't even know the browser sends a referrer header, and it doesn't actually do anything for them. This is useful for site owners, and they have little control over what browser their users use. And as someone else already pointed out, the other big browser (Chrome) has already done this.
- fogihujy 6y ago
  Why would this break anything? Which sites would break just because the referrer policy default setting changed? And why wouldn't sites have fixed that before, since Chrome pushed the same change last year?
- RHSeeger 6y ago
  Switch to what, exactly? Chrome already does this, according to another poster.
- Mordisquitos 6y ago
  Normal websites are going to be unaffected in terms of user-facing functionality, regardless of whether they use the data gathered from HTTP Referer internally. On the other hand, badly designed websites that do depend on the HTTP Referer to provide functional user experience are going to lose their users in favour of normal websites, because they are "broken"—and always have been.

darkwater 6y ago

According to Wikipedia [1] the "Referer" (sic) HTTP header is an optional one so I don't see how they are breaking the open web by sending less data in it under some circumstances. [1] https://en.wikipedia.org/wiki/HTTP_referer https://en.wikipedia.org/wiki/HTTP_referer

selykg 6y ago

If the referrer header contains the full URL from which the user came from it could contain something the user deems private. Imagine that the URL contains a search string that contains something the user might deem private, or the article is about something a state may deem to be illegal, etc. This may not be PII but it could be deemed private by the user. The user should be in control of what information could be given to a website. Imagine a scenario where a person is a member of a group that is looking for equal rights in a country that is very much opposed to this. The group uses a tool that happens to make it clear who this group is. The group then links to an article about their cause or similar. Now that country could potentially link things together and demand information about everyone in that group. It's amazing how little bits of information about you can get you in hot water. This is a good move imo, and I'm glad that Mozilla is trying to plug these types of things. It's better for everyone. As an aside, moving to a privacy oriented browser could very well get Firefox more users. Just like Apple's play to being a private and secure mobile OS is getting them users.

tomaszs 6y ago
So where is the example?
- selykg 6y ago
  I think you've been given plenty. You should try to come into these conversations with a lot less attitude. Perhaps I'm reading your tone wrong, and if I am I'm sorry about that. I always come into these discussions assuming I'm not the smartest person in the room because that means I have more to learn. Maybe give that a try?

deleted 6y ago

[deleted]