6 ms·

Doesn't this just push people to more tracking cookies? How are sites supposed to know what sources are driving their traffic? Whether visitors are coming via

Doesn't this just push people to more tracking cookies? How are sites supposed to know what sources are driving their traffic? Whether visitors are coming via email campaigns, google, etc?

Symbiote 6y ago
Why should they know this? I am keen that they don't know this. If I walk into a shop, the shopkeeper doesn't know if something in the window caught my eye, if my friend recommended the helpful staff, if I saw the advert they placed on a billboard, or if I just came in because it's raining.
- slater 6y ago
  "the shopkeeper doesn't know if something in the window caught my eye" Except that's already here, or in the making, i.e. with those advertising eye-tracking stories that make the rounds every 6 months or so.
- nickjj 6y ago
  > If I walk into a shop, the shopkeeper doesn't know if something in the window caught my eye, if my friend recommended the helpful staff, if I saw the advert they placed on a billboard, or if I just came in because it's raining. A lot of places will attach unique discount codes to advertisements to get an idea on where you came from. For example, on a TV commercial it might say use promo code COOL123 to save 10% or if you saw that billboard it might say to use NICE123 instead. Then there's radio, newspapers and so on each with their own unique code that offer the same 10% discount. And since a discount is applied chances are you'll use it because not too many folks would purposely avoid the discount to hide where you discovered the shopkeeper from. You often see this being done online too, but there's also things like UTM tags or unique URLs that let you do the same thing without discount codes. It's not to make more money as a shopkeeper (avoiding the discount), it's just easier to set up. Using a UTM tag is a matter of creating a link with a few query parameters. Creating a specific discount code or a unique URL for a specific promotion takes a bit of extra leg work. I'm not sure where I stand on the movement to remove all forms of referral tracking. Both referral headers and UTM tags can be spoofed or removed through extensions so using them as any type of source of truth was a bad idea anyways. However, as someone who sells digital products I like knowing which specific video or blog post helped someone discover some of my paid content. But at the same time, the end game is really "is the needle moving forward?" so the specifics kind of don't matter. But in the short term while you're figuring things out, the extra info does help you focus on where to spend your time. Not just for more profit, but to provide better and more free content because it's what folks want.
  - zentiggr 6y ago
    As a user with a certain combination of medical and other life issues, I'm neutral on the use of varied discount codes, as it's not personally identifying, just gives you the seller an idea of which media is a good buy. Ok, no worries. Bur given the unique personal searches/browsing I could have just been doing, I sure the heck don't want my recent activity advertised to the next site I go to. Happy as a clam to shut down all the Referrer uses, even whatever login flows that might have to re-engineer themselves.
- reaperducer 6y ago
  If I walk into a shop, the shopkeeper doesn't know if something in the window caught my eye, if my friend recommended the helpful staff, if I saw the advert they placed on a billboard, or if I just came in because it's raining. But the shopkeeper knows if you came in through the street entrance (maybe saw the window display), through the mall entrance (maybe saw the sandwich board), or through the communicating door to the next shop (maybe saw the merchandise).
  - antonvs 6y ago
    Only true for a small shop where the shopkeeper can see all entrances and is able to pay attention to that enough of the time. Otherwise you need video cameras and AI... or perhaps spray every incoming customer with a source-identifying powder or smell - hmm, maybe that explains Abercrombie & Fitch!
- pbhjpbhj 6y ago
  We run a micro-business and we ask people how they heard of us (and use offer codes, but that was mentioned). People are usually happy to tell us; but then we only use that information to run our business better, we don't sell it. Another technique is referral bonus, "recommend a friend" type offers.
Deukhoofd 6y ago
You can still see what site the referrer came from, just not the path + query string behind it.
puszczyk 6y ago
How does this work in real life? How does say Tesco can find out if I’m shopping there because of a billboard ad, or because it’s conveniently located on my commute? How do they measure their ad campaign effectiveness?
- TeMPOraL 6y ago
  Facial recognition in stores, your credit card, or your loyalty card tie your purchase to an ID, which then can be back-tied to all the Internet surveillance in your browser and on your phone, to attribute purchases to ads viewed on-line. It's a bit tougher with attributing real-life billboard ads.
  - puszczyk 6y ago
    Brave new world ;)
ldjb 6y ago
Firefox still sends the origin (the domain name and subdomain) of the referring page, so you can still see the website the user is coming from. Google has had a dereferral process in place for many years anyway, which prevents you from seeing the specific search engine results page the user is coming from. So this really doesn't change anything for those websites such as Google that already had these security features in place.
- Andrew_nenakhov 6y ago
  > Google has had a dereferral process in place for many years anyway, which prevents you from seeing the specific search engine results page the user is coming from. Is this really a security feature though? Or is it Google keeping the important information for themselves?
  - SXX 6y ago
    It's certainly has nothing to do with security. It's Google's way to force you to use Google Analytics if you want to track said informarion.
    - lmkg 6y ago
      Google Analytics does not give you additional keyword information. If you want keyword information from Google search results, the best way to get it is actually buying ads for those keywords. And in fact some marketers allocate ad budget to keywords they already rank for, specifically for that purpose.
      - shostack 6y ago
        But to the grandparent's point, GA used to give you a ton more organic info at the keyword level. It is part of what drove the seo industry. The only way to get an abstract view of that keyword volume now, including on your brand terms, is to buy ads and run the organic reports.
    - tannhaeuser 6y ago
contravariant 6y ago
A popular approach seems to be to use customized URLs. Which is of course always an option, though ClearURLs takes care of a few common options. Besides it's up to a user whether they want to tell you where they came from, you aren't supposed to know anything, you are allowed to.
- jbverschoor 6y ago
  Back in the days, there'd be a jsessionid in the url :-)
- andrewaylett 6y ago
  Thanks for the pointer -- not come across Clear URLs before. https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ in case anyone else has also not seen it.
nkrisc 6y ago
As a visitor to your web site: not my problem and you've no right to know anyway what I visited before coming to your site. That fact that you can still see the referring domain is still too much, in my opinion.
- gxnxcxcx 6y ago
  In Firefox, "network.http.referer.spoofSource = true" takes care of that last bit. The only thing it breaks for me is codepen.io, which fortunately I don't use.
viraptor 6y ago
UTM tags mostly https://www.intownwebdesign.com/google/google-analytics-utm-link-tagging-explained.html https://www.intownwebdesign.com/google/google-analytics-utm-...
gspr 6y ago
> How are sites supposed to know what sources are driving their traffic? Whether visitors are coming via email campaigns, google, etc? Kindly, and non-intrusively, ask them? You know, just like in other aspects of life?
kevincox 6y ago
I think the major problem here is that this information was sent *by default* and many websites didn't realize that outbound links where sharing the source URL. This could result in an exploitable security issue. Now the website has to do something explicit to share information (beyond the hostname) to outbound cross-origin outbound links. It is much more likely that the website will pay attention to what information they are sharing in this case.

Doesn't this just push people to more tracking cookies? How are sites supposed to know what sources are driving their traffic? Whether visitors are coming via email campaigns, google, etc?

Symbiote 6y ago

Why should they know this? I am keen that they don't know this. If I walk into a shop, the shopkeeper doesn't know if something in the window caught my eye, if my friend recommended the helpful staff, if I saw the advert they placed on a billboard, or if I just came in because it's raining.

slater 6y ago
"the shopkeeper doesn't know if something in the window caught my eye" Except that's already here, or in the making, i.e. with those advertising eye-tracking stories that make the rounds every 6 months or so.
nickjj 6y ago
> If I walk into a shop, the shopkeeper doesn't know if something in the window caught my eye, if my friend recommended the helpful staff, if I saw the advert they placed on a billboard, or if I just came in because it's raining. A lot of places will attach unique discount codes to advertisements to get an idea on where you came from. For example, on a TV commercial it might say use promo code COOL123 to save 10% or if you saw that billboard it might say to use NICE123 instead. Then there's radio, newspapers and so on each with their own unique code that offer the same 10% discount. And since a discount is applied chances are you'll use it because not too many folks would purposely avoid the discount to hide where you discovered the shopkeeper from. You often see this being done online too, but there's also things like UTM tags or unique URLs that let you do the same thing without discount codes. It's not to make more money as a shopkeeper (avoiding the discount), it's just easier to set up. Using a UTM tag is a matter of creating a link with a few query parameters. Creating a specific discount code or a unique URL for a specific promotion takes a bit of extra leg work. I'm not sure where I stand on the movement to remove all forms of referral tracking. Both referral headers and UTM tags can be spoofed or removed through extensions so using them as any type of source of truth was a bad idea anyways. However, as someone who sells digital products I like knowing which specific video or blog post helped someone discover some of my paid content. But at the same time, the end game is really "is the needle moving forward?" so the specifics kind of don't matter. But in the short term while you're figuring things out, the extra info does help you focus on where to spend your time. Not just for more profit, but to provide better and more free content because it's what folks want.
- zentiggr 6y ago
  As a user with a certain combination of medical and other life issues, I'm neutral on the use of varied discount codes, as it's not personally identifying, just gives you the seller an idea of which media is a good buy. Ok, no worries. Bur given the unique personal searches/browsing I could have just been doing, I sure the heck don't want my recent activity advertised to the next site I go to. Happy as a clam to shut down all the Referrer uses, even whatever login flows that might have to re-engineer themselves.
reaperducer 6y ago
If I walk into a shop, the shopkeeper doesn't know if something in the window caught my eye, if my friend recommended the helpful staff, if I saw the advert they placed on a billboard, or if I just came in because it's raining. But the shopkeeper knows if you came in through the street entrance (maybe saw the window display), through the mall entrance (maybe saw the sandwich board), or through the communicating door to the next shop (maybe saw the merchandise).
- antonvs 6y ago
  Only true for a small shop where the shopkeeper can see all entrances and is able to pay attention to that enough of the time. Otherwise you need video cameras and AI... or perhaps spray every incoming customer with a source-identifying powder or smell - hmm, maybe that explains Abercrombie & Fitch!
pbhjpbhj 6y ago
We run a micro-business and we ask people how they heard of us (and use offer codes, but that was mentioned). People are usually happy to tell us; but then we only use that information to run our business better, we don't sell it. Another technique is referral bonus, "recommend a friend" type offers.

Deukhoofd 6y ago

You can still see what site the referrer came from, just not the path + query string behind it.

puszczyk 6y ago

How does this work in real life? How does say Tesco can find out if I’m shopping there because of a billboard ad, or because it’s conveniently located on my commute? How do they measure their ad campaign effectiveness?

TeMPOraL 6y ago
Facial recognition in stores, your credit card, or your loyalty card tie your purchase to an ID, which then can be back-tied to all the Internet surveillance in your browser and on your phone, to attribute purchases to ads viewed on-line. It's a bit tougher with attributing real-life billboard ads.
- puszczyk 6y ago
  Brave new world ;)

ldjb 6y ago

Firefox still sends the origin (the domain name and subdomain) of the referring page, so you can still see the website the user is coming from. Google has had a dereferral process in place for many years anyway, which prevents you from seeing the specific search engine results page the user is coming from. So this really doesn't change anything for those websites such as Google that already had these security features in place.

Andrew_nenakhov 6y ago
> Google has had a dereferral process in place for many years anyway, which prevents you from seeing the specific search engine results page the user is coming from. Is this really a security feature though? Or is it Google keeping the important information for themselves?
- SXX 6y ago
  It's certainly has nothing to do with security. It's Google's way to force you to use Google Analytics if you want to track said informarion.
  - lmkg 6y ago
    Google Analytics does not give you additional keyword information. If you want keyword information from Google search results, the best way to get it is actually buying ads for those keywords. And in fact some marketers allocate ad budget to keywords they already rank for, specifically for that purpose.
    - shostack 6y ago
      But to the grandparent's point, GA used to give you a ton more organic info at the keyword level. It is part of what drove the seo industry. The only way to get an abstract view of that keyword volume now, including on your brand terms, is to buy ads and run the organic reports.
  - tannhaeuser 6y ago

contravariant 6y ago

A popular approach seems to be to use customized URLs. Which is of course always an option, though ClearURLs takes care of a few common options. Besides it's up to a user whether they want to tell you where they came from, you aren't supposed to know anything, you are allowed to.

jbverschoor 6y ago
Back in the days, there'd be a jsessionid in the url :-)
andrewaylett 6y ago
Thanks for the pointer -- not come across Clear URLs before. https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ in case anyone else has also not seen it.

nkrisc 6y ago

As a visitor to your web site: not my problem and you've no right to know anyway what I visited before coming to your site. That fact that you can still see the referring domain is still too much, in my opinion.

gxnxcxcx 6y ago
In Firefox, "network.http.referer.spoofSource = true" takes care of that last bit. The only thing it breaks for me is codepen.io, which fortunately I don't use.

viraptor 6y ago

UTM tags mostly https://www.intownwebdesign.com/google/google-analytics-utm-link-tagging-explained.html https://www.intownwebdesign.com/google/google-analytics-utm-...

gspr 6y ago

> How are sites supposed to know what sources are driving their traffic? Whether visitors are coming via email campaigns, google, etc? Kindly, and non-intrusively, ask them? You know, just like in other aspects of life?

kevincox 6y ago

I think the major problem here is that this information was sent *by default* and many websites didn't realize that outbound links where sharing the source URL. This could result in an exploitable security issue. Now the website has to do something explicit to share information (beyond the hostname) to outbound cross-origin outbound links. It is much more likely that the website will pay attention to what information they are sharing in this case.