3 ms·

It's depressing to consider browser history in the threat model but you're right about it. A thought: if you're generating a plain-search URL from a share butt

It's depressing to consider browser history in the threat model but you're right about it. A thought: if you're generating a plain-search URL from a share button (great idea) you could make the URL bar have a hash of that share URL. The only information this leaks to you is who has repeated that search query, which you already knew, and the Evil Browser Distro has to GET rather than just regex if they want to know what the user has been asking about. And you don't have to curl to robots for free, or at all if they're misbehaving by running replay attacks on your clients.

jedwhite 5y ago
Hashing the URL is a brilliant idea. Thank you for that suggestion. I'd been thinking about how to do it in a privacy-safe way and of course that's a great solution. We can probably get it so you can navigate back and forward through searches either by tapping the bubbles like now, or by using browser back and forth, but without losing your session, just changing the current result set and jumping to the right point in the conversation thread. I feel slow for not even thinking about that before :) The curl/robot attacks will be an issue. We have a few things we're building to help but it has killed a lot of search startups! And that's a very simple and elegant solution without many downsides. Thanks seriously!