12 ms·
Just a FYI because some people are complaining that Mozilla is doing something evil or will break all of the web or something. Chrome made the same change a whi
by hannob 6y ago
Just a FYI because some people are complaining that Mozilla is doing something evil or will break all of the web or something. Chrome made the same change a while back:
https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default https://developers.google.com/web/updates/2020/07/referrer-p...
So if this breaks something people probably already noticed. And Mozilla is merely aligning with the browser with the largest market share on this. (Also everyone who wants something different for their sites, it's configurable: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... )
- merb 6y agowhy tf should removing Referer break sites? who uses Referer?! the only thing that Referer brought were privacy leaks.
- npteljes 6y agoI recently had to enable it for some login to work, unfortunately can't remember which website.
- roywiggins 6y agoI've had to enable it for Atlassian's login to work.
- prussian 6y agoI turned it off once and the most common breakages were usually authentication that involves some kind of OpenID delegation.
- hirsin 6y agoYeah, we (Azure AD) got a couple of "login is broken" escalations when Chrome made this change. A couple vendors use it to validate a request is coming from the upstream IDP, to block drive by attacks I assume.
- simias 6y agoSome websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs). But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves. EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.
- calvinmorrison 6y agoVictorOps uses referrers as a "security measure" on login. So I just have a separate profile of firefox without my antireferrer addon
- ignoramous 6y ago> VictorOps uses referrers as a "security measure" on login. Using the referrer header as a security and privacy measure is prevalent among service providers. Vimeo even hilariously charges for this feature which is trivially bypassed; and I'd reckon their paying customers aren't even aware of it: https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changing-the-privacy-settings-of-your-videos https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changi... Talk about smoke and mirrors.
- judge2020 6y agoMaybe they advertise it as a security feature but it's still a good way to prevent unauthorized hotlinking that burns your vimeo bandwidth, costing you money (assuming it does indeed prevent random websites from embedding your videos).
- monkeybutton 6y agoThis reminds me of some vague memories of a time long ago where some websites had a secure login page that asks for a username&pw but every other page after just checked the referall header. It wasn't a very secure system and people shared the header values needed to bypass logging in.
- mauvehaus 6y agoI believe jwz rather famously does. Let's see: https://www.jwz.org/blog/2021/03/cursed-keyboard-image/ https://www.jwz.org/blog/2021/03/cursed-keyboard-image/
- Macha 6y agoHis use only needs the domain, so should be unaffected? That said, something from my browser, probably ETP strict mode, appears to be stripping out the referrer entirely already anyway.
- pbhjpbhj 6y agoI'm not following that on the assumption is he the guy that shows HN users the goatse image? If so then please mark your link up as NSFW/NSFL.
- smcl 6y agojwz has got a rather ... interesting use case for it relating to HN
- bartvk 6y agoAnd slashdot before that.
- smcl 6y agoAh jwz did this for /. too? If he did then it seems like he has switched it off, because I cannot reproduce it
- bartvk 6y agoI just tried to find references to it, but couldn’t. I’m wondering if my memory is broken. Slashdot is old though, we used to get worked up about bugs in X11 screensavers, and GNAA trollers.
- eli 6y agoIt was a somewhat common “security” feature to check referer, especially in the days before you could rely on CSP.
- hk1337 6y agoThe first thing I thought of was when you go to a URL but it requires a login so it redirects you to the login page but then redirects you back to your original page after you login. Pretty sure it’s easily remedied without referer but that was the first thing I thought about.
- bdcravens 6y agoIf the login is on the same site, this change won't affect that, as this change only applies to cross-original requests.
- merb 6y agothat is a security issue on it's own. you should never have an openredirect bug, that's why openid servers need to store redirect uris somewhere and validate them.
- jakub_g 6y agoSome ad networks use(d to use) referers for brand safety when resource serving an ad is embedded iframe. For example if the parent URL contains "osama-bin-laden-killed", don't display ad about nice family moments together (or anything else, likely)
- ttt0 6y agoOr keep track of your internet history to have a more accurate profile of you. This is not a good thing and it's precisely why it's a privacy leak.
- Isthatablackgsd 6y agoSome sites use referrer as their "cookie session". One site use Cloudflare Anti-DDOS referrer as their cookie. Removing that referrer will cause the browser to infinity loop in CF Anti-DDOS because the site is expecting that referrer before entering the site. I hate sharing Amazon shopping links because Amazon packs much referrer as possible in the link. Amazon uses the referrer to track who am I sharing to and use it for data for them to sells.
- lupire 6y agoAre you conflating Referer with URL parameters? (Amazon calls them "ref tags" (referrer tags) but that's not HTTP Referer. It's not even possible to do what you are imagining with HTTP Referer, since Referer is only inside a browser session, not across from you to your friend.
- Isthatablackgsd 6y agoDang it, I didn't realize it was specific to HTTP. Thank you for pointing it out, all I see referrers (I somehow blank on HTTP) and I thought it was about the referrer tags.
- reaperducer 6y agowho uses Referer?! How can you tell it's Monday morning on HN? Someone starts pontificating, "I don't use this, so there is no conceivable reason that anyone else on the planet should ever need this ever!" See also: Half of StackOverflow questions.
- nicbou 6y agoWell, who does?
- RinTohsaka 6y agopcpartpicker does
- yellowapple 6y agoAnd likewise, the other sign it's Monday morning is when someone starts pontificating "this exists for some reason, so there must be someone using it for non-malicious purposes". Which very well might be true, but that was exactly the question: who?
- Nathanba 6y agoI use it to understand which site or link the user used to find an outdated link on our site. It's very helpful to know how he got there because often the references to that obsolete link are all purged in the code but somewhere deep inside the database or CMS somebody still put a link to the obsolete page.
- merb 6y agowell you can turn the header off pretty easily and you won't see many sites are breaking (alexa top 100), of course some wierd sites think it's important to use it, but because of the madness of referer there are so many things that will leak your privacy extremly, it came to the point that it's necessary to have extensions to remove the header or at least inject noreferer into a tags.
- smt88 6y agoReferer is an important way to maintain the security of an OAuth flow. I don't know how commonly it would break that flow, but it certainly could depending on implementation details that are not narrowly prescribed by the OAuth2 spec.
- merb 6y agono referer is an important way to screw your security in an oauth2 flow. with oauth2 a correct configuration would be Referrer-Policy: no-referrer and enforcing a secure state param and csrf.
- TedDoesntTalk 6y ago> Referer is an important way to maintain the security of an OAuth flow. How? Referrer can be easily spoofed.
- smt88 6y agoThe scenario is that the user is being phished with an uncompromised, modern browser. The idea is that if the attacker doesn't have control of the browser, they can't spoof the referer.
- asveikau 6y agoIsn't it also sort of useful information for site owners even if they are not maliciously slurping your private information? For example you might not know that important site X linked to you and is driving Y% of your audience. You are not necessarily interested in the individuals following the links when you discover that.
- antonvs 6y agoThis change only trims the referrer string, it doesn't remove the origin domain info. You can still tell that "important site X linked to you and is driving Y% of your audience." You just wouldn't be able to get any more granular than that.
- lgeorget 6y agoWe use them to prevent other websites to hotlink our dynamic map tiles. Not a big protection of course but useful anyway.
- amaccuish 6y agoLoads of cashback systems use it. You get directed to Lieferando or whatever and the "click" is registered using the referrer.
- TedDoesntTalk 6y agothere are other ways to do the same, like a URL parameter. Referrer affects the privacy of everyone and the entire web. The fact that cashback systems for some small subset of internet users will be affected (and they have alternatives like URL parameters, they did not need to use referrer) is irrelevant.
- jrochkind1 6y agoI didn't realize this, thanks for pointing it out. I thought, wait, but how is this feature in my own app still working with chrome then! Aha, Chrome only trims referrer for cross-origin requests. Is FF the same? Looks like... yes! "…will also trim path and query information for all cross-origin requests."
- superkuh 6y agoThis doesn't change my opinion. This is like saying, "The soviet union gulags their people too and did it first. It's fine." Whataboutism re: corporate control of web standards.
- ethbr0 6y agoGood for both Firefox and Chrome. Does this mean Gmail can stop rewriting links in emails (ostensibly to derefer)?
- kevincox 6y agoI'm pretty sure they could have done this years ago as most browsers supported setting the policy explicitly for years. This only changes the default policy. The only reason I can see Google still doing rewriting is to protect very old browsers and laziness.
- lupire 6y agoPresumably no because they also probably use it for analytics and/or security (blocking malware URLs)
- Arnavion 6y agoIndeed. If not sending referer was the only reason, gmail would never have needed to rewrite the link since it could've just used `rel=noreferrer` on the original anchor tags instead.
- deleted 6y ago[deleted]
- Larrikin 6y agoAre there any extensions that can rewrite these in the meantime?
- smichel17 6y agoNot using gmail works
- bjornstar 6y agoI wrote Intercept Redirect to skip these redirect services. It doesn't change the URLs that appear on sites but intercepts the requests and instantly redirects them to the intended URL. It also requests the are minimum of permissions and collects no data.
- ehsankia 6y agoYour FYI is also useful for the contrapositive of that feeling, which we often see on HN: "Look how Firefox is leading privacy improvements and how much more privacy forward it is than Chrome".
- michaelt 6y agoYou see, when Firefox improves privacy it's for the good of users, but when Chrome improves privacy it's because Google can track you just fine despite the change and they want to give competing ad networks a kicking. /s ?
- deleted 6y ago[deleted]
- ViViDboarder 6y agoI mean, that can be true, no? Google does have many ways of tracking you and blocking others from doing it while still doing it themselves certainly helps them maintain their moat.
- Groxx 6y agoAMP is a pretty good example of this. Good for Google, reduces tracking (by anyone but Google), bad for everyone else.
- tasogare 6y agoBoth browsers are funded mainly by the same source, so in the end changes in any of them is Google’s move anyway.
- GeekyBear 6y ago>You see, when Firefox improves privacy it's for the good of users, but when Chrome improves privacy it's because Google can track you just fine despite the change and they want to give competing ad networks a kicking. /s ? Given that Firefox improving privacy generally doesn't draw antitrust scrutiny, where is the problem with that statement? >The questions from Justice Department investigators have touched on how Chrome policies, including those related to cookies, affect the ad and news industries, four people said. Investigators are asking whether Google is using Chrome, which has 60% global market share, to reduce competition by preventing rival ad companies from tracking users through cookies while leaving loopholes for it to gather data with cookies, analytics tools and other sources, the sources added. https://www.reuters.com/article/us-tech-antitrust-google-exclusive/exclusive-googles-privacy-push-draws-u-s-antitrust-scrutiny-sources-idUSKBN2BA10I https://www.reuters.com/article/us-tech-antitrust-google-exc... If Google were truly improving privacy, one would expect their changes to decrease their own ability to track users, not just their competitors.
- smileybarry 6y agoAh, that explains why the old "come from Google" trick for bypassing paywalls stopped working a while ago.
- Ajedi32 6y agoYeah, I was gonna say; isn't this part of the spec? Seems like it is; at least in the latest editor's draft: https://w3c.github.io/webappsec-referrer-policy/#default-referrer-policy https://w3c.github.io/webappsec-referrer-policy/#default-ref...
- unnouinceput 6y agoThat's probably because if you run Chrome, you're already Google's executable on your system. I mean they can track you using gazillion of other, more precise meanings and this is something they shut it to keep the pie for themselves. I do not use Chrome anymore, switched to Firefox a year and a half ago - best decision ever.
- xPaw 6y agoThat doesn't appear to be accurate in Chrome, in 89 I am getting no-referrer-when-downgrade. For example, I clicked a link on old reddit and saw the full referer being sent to another origin.
- glsdfgkjsklfj 6y agoHeh. chrome undone this change at least 3 times in the past, that I counted. Remember that cross-domain referrer is essential to Google business (getting money from sending people from search ads) There used to be a user visible option in the very early days that allowed to not send, not send cross-domain or send only origin for cross domain. A google domain username removed it when "moving some items into advanced menu". Then someone added it as a hidden setting in chromium. Another google domain username removed it again in an urelated change. Then someone added it back to the command line, and I know because i tested it. A few years later, no more command line setting. I still could build chrome with a flag that enabled it. but building chrome is a full time job. meh. So funny that now they are "trendsetters" of adding this option back.
- canada_dry 6y agoAnd to note the obvious... the companies that you might think would be most opposed to it (e.g. facebook, google) really don't care because their page tracking hooks are omnipresent so they're not missing out on any precious meta data.