5 ms·

I would assume this is caused by the search bar now using the SSL version of Google. The "fix" is "easy": If you want referrer data, offer your site over SSL o

by pilif 14y ago

I would assume this is caused by the search bar now using the SSL version of Google. The "fix" is "easy": If you want referrer data, offer your site over SSL or use the Google Webmaster tools (I don't know whether there is an API to get to that data). Browsers don't send a referrer header if the referring site is SSL and the target site is not. This has always been the case even on the desktop.

olalonde 14y ago
Yep, that's what the RFC says. http://tools.ietf.org/html/rfc2616#section-15.1.3 http://tools.ietf.org/html/rfc2616#section-15.1.3 "Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol."
- jimktrains2 14y ago
  Doesn't it also say not to send refer data to different domains? I'm trying to find docs for that. EDIT: https://bugzilla.mozilla.org/show_bug.cgi?id=141641 https://bugzilla.mozilla.org/show_bug.cgi?id=141641 Maybe I'm wrong but that seems to be what some browsers do/did.
  - deleted 14y ago
    [deleted]
  - olalonde 14y ago
    Sending referer data to different domains is always allowed for non-secure URLs (otherwise, web analytics would be pretty boring). For secure URLs however, the browser should only send referer data if the destination page is also secure, regardless of domain.
    - dmayle 14y ago
      That makes no sense, and defeats some of the protection of SSL. If you're on a secure site, there should be no referrer sent cross-domain, or cross-protocol.
      - entropy_ 14y ago
        I makes some sense. If you're using SSL and someone is trying to snoop on your connection. If you visit a non-SSL site from an SSL site and the referrer gets sent then the snooper knows the URL of the page you were on last. Whereas if the target site is SSL then no information is leaked to listeners. The point of SSL is to protect from snooping, not as a general privacy-protection mechanism that should have everything privacy-related shoehorned into it.
peteretep 14y ago
Yes, this is the case. A quick search shows I'm being taken to Google via https, hence no referrer string. You'd hope the author would have worked that out :-/
- IanDrake 14y ago
  On my desktop (with chrome) searching google via HTTPS I get search results that first redirect to a HTTP page on Google then does a client redirect to the search result. This produces referer information to the search result. It seems this step is not being taken on iOS, it could be google who singling out iOS6 and not doing the redirect to the HTTP page.
  - peteretep 14y ago
    That's interesting. But as a counter point, my blog gets a bunch of hits from Google marked as "[Secure Search]", so I guess they don't always do it.
  - mikeryan 14y ago
    Tried this on my Nexus 7 and didn't get the redirect so it may be something they're doing for mobile user agents. Its definitely not specific to iOS6
    - lallysingh 14y ago
      Probably to reduce latency. Another hop is expensive on mobile networks.
nchlswu 14y ago
I'm not familiar with the implications of not sending the referer data. Can be interpreted that not sending the referer, and thus the decision to use the SSL version is in anyway malicious in intent (almost like what the author is implying in the headline)?
- pilif 14y ago
  You can't have it all. The HTTP RFC is very clear that referrer data from HTTPS sites should not be sent to HTTP sites (in order to protect the content of the HTTPS site - remember: Even the URL is transmitted in an encrypted way, so it might contain sensitive data). So by doing the Google searches over HTTPS, you make the life of pages and analytics vendors harder, but you are doing a huge favor to the end users because now their searches are private between them and Google. Nobody else on the way can sniff them. No government and no neighbor/coworker. Of course, once the user clicked and found your site, the URL the user initially used isn't that confidential any more, so in theory, passing the referrer wouldn't be a problem in this case, but that's not what the standard says and it's not what browsers are doing. If you want to see this changed, talk to the IETF or the W3C to have the standard changed such that, for example, google could add some rel= attribute to tell the browser that sending a referrer is OK. Or just serve your page over SSL, further helping the end-user - and it's all about them in the first place - isn't it?
sullivandanny 14y ago
There is no fix for this. In the article, see the related stories at the bottom, in particular "Google Puts A Price On Privacy." Google deliberately prevents referrer data from passing regardless of the state of SSL. It only allows it to pass if someone's clicking on an ad.
sullivandanny 14y ago
There is no fix for this. In the article, see the related stories at the bottom, in particular "Google Puts A Price On Privacy." Google deliberately prevents referrer data from passing regardless of the state of SSL. It only allows it to pass if someone's clicking on an ad.
ry0ohki 14y ago
Unfortunately no. Welcome to the future of web analytics, where all inbound keywords are (not provided) :(. Google claims this is a privacy thing, however AdWords keywords are still conveniently passed on!
pandog 14y ago
This is exactly what's happening - though the author seems to think differently. This isn't a huge deal as you can still get details of Google Queries using Google Webmaster Tools: http://www.google.com/webmasters/ http://www.google.com/webmasters/
- sullivandanny 14y ago
  It is a huge deal and has been since Google stopped passing referrers for signed-in users last October. That's because... 1) If it's a privacy thing, then Google is happy having a leak by giving these terms to advertisers 2) The data is not provided in a way that can be used by third party ad retargeting terms, giving Google a competitive advantage 3) Publishers can't use the data to better target with landing pages 4) Google Webmaster Central data only goes back for a short period of time, and if you haven't constantly been downloading your data, all your historic traffic information related to a term has gone poof.
  - mun2mun 14y ago
    Does it create a monopoly situation?
- scottkrager 14y ago
  This is a massively huge deal for attribution of organic search. The queries you can download from webmaster tools are just 1 column of data....nothing to tie queries to conversions or any meaningful metric. If it was everyone who was losing this data...I could understand the change but if you buy adwords ads, you still get the referral data even in https Google.
Bill_Dimm 14y ago
If you want referrer data, offer your site over SSL...Browsers don't send a referrer header if the referring site is SSL and the target site is not. I haven't tested any browsers or looked at any standards on this, but if that works it doesn't make any sense to me. I would think that the rule would be "Browsers don't send a referrer header [to a different domain] if the referring site is SSL" period (no "and the target site is not" part). If a URL on site X contains secret information, why would it be OK to transmit that secret information to some other website simply because the secret information is encrypted while in transit? At the very least, I would expect the user to be prompted to confirm such action before doing it (which would probably be more annoying to the user than just dropping the referrer info).
- halfwit 14y ago
  Right, that doesn't make sense.

by pilif 14y ago

olalonde 14y ago

Yep, that's what the RFC says. http://tools.ietf.org/html/rfc2616#section-15.1.3 http://tools.ietf.org/html/rfc2616#section-15.1.3 "Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol."

jimktrains2 14y ago
Doesn't it also say not to send refer data to different domains? I'm trying to find docs for that. EDIT: https://bugzilla.mozilla.org/show_bug.cgi?id=141641 https://bugzilla.mozilla.org/show_bug.cgi?id=141641 Maybe I'm wrong but that seems to be what some browsers do/did.
- deleted 14y ago
  [deleted]
- olalonde 14y ago
  Sending referer data to different domains is always allowed for non-secure URLs (otherwise, web analytics would be pretty boring). For secure URLs however, the browser should only send referer data if the destination page is also secure, regardless of domain.
  - dmayle 14y ago
    That makes no sense, and defeats some of the protection of SSL. If you're on a secure site, there should be no referrer sent cross-domain, or cross-protocol.
    - entropy_ 14y ago
      I makes some sense. If you're using SSL and someone is trying to snoop on your connection. If you visit a non-SSL site from an SSL site and the referrer gets sent then the snooper knows the URL of the page you were on last. Whereas if the target site is SSL then no information is leaked to listeners. The point of SSL is to protect from snooping, not as a general privacy-protection mechanism that should have everything privacy-related shoehorned into it.

peteretep 14y ago

Yes, this is the case. A quick search shows I'm being taken to Google via https, hence no referrer string. You'd hope the author would have worked that out :-/

IanDrake 14y ago
On my desktop (with chrome) searching google via HTTPS I get search results that first redirect to a HTTP page on Google then does a client redirect to the search result. This produces referer information to the search result. It seems this step is not being taken on iOS, it could be google who singling out iOS6 and not doing the redirect to the HTTP page.
- peteretep 14y ago
  That's interesting. But as a counter point, my blog gets a bunch of hits from Google marked as "[Secure Search]", so I guess they don't always do it.
- mikeryan 14y ago
  Tried this on my Nexus 7 and didn't get the redirect so it may be something they're doing for mobile user agents. Its definitely not specific to iOS6
  - lallysingh 14y ago
    Probably to reduce latency. Another hop is expensive on mobile networks.

nchlswu 14y ago

I'm not familiar with the implications of not sending the referer data. Can be interpreted that not sending the referer, and thus the decision to use the SSL version is in anyway malicious in intent (almost like what the author is implying in the headline)?

pilif 14y ago
You can't have it all. The HTTP RFC is very clear that referrer data from HTTPS sites should not be sent to HTTP sites (in order to protect the content of the HTTPS site - remember: Even the URL is transmitted in an encrypted way, so it might contain sensitive data). So by doing the Google searches over HTTPS, you make the life of pages and analytics vendors harder, but you are doing a huge favor to the end users because now their searches are private between them and Google. Nobody else on the way can sniff them. No government and no neighbor/coworker. Of course, once the user clicked and found your site, the URL the user initially used isn't that confidential any more, so in theory, passing the referrer wouldn't be a problem in this case, but that's not what the standard says and it's not what browsers are doing. If you want to see this changed, talk to the IETF or the W3C to have the standard changed such that, for example, google could add some rel= attribute to tell the browser that sending a referrer is OK. Or just serve your page over SSL, further helping the end-user - and it's all about them in the first place - isn't it?

sullivandanny 14y ago

There is no fix for this. In the article, see the related stories at the bottom, in particular "Google Puts A Price On Privacy." Google deliberately prevents referrer data from passing regardless of the state of SSL. It only allows it to pass if someone's clicking on an ad.

sullivandanny 14y ago

ry0ohki 14y ago

Unfortunately no. Welcome to the future of web analytics, where all inbound keywords are (not provided) :(. Google claims this is a privacy thing, however AdWords keywords are still conveniently passed on!

pandog 14y ago

This is exactly what's happening - though the author seems to think differently. This isn't a huge deal as you can still get details of Google Queries using Google Webmaster Tools: http://www.google.com/webmasters/ http://www.google.com/webmasters/

sullivandanny 14y ago
It is a huge deal and has been since Google stopped passing referrers for signed-in users last October. That's because... 1) If it's a privacy thing, then Google is happy having a leak by giving these terms to advertisers 2) The data is not provided in a way that can be used by third party ad retargeting terms, giving Google a competitive advantage 3) Publishers can't use the data to better target with landing pages 4) Google Webmaster Central data only goes back for a short period of time, and if you haven't constantly been downloading your data, all your historic traffic information related to a term has gone poof.
- mun2mun 14y ago
  Does it create a monopoly situation?
scottkrager 14y ago
This is a massively huge deal for attribution of organic search. The queries you can download from webmaster tools are just 1 column of data....nothing to tie queries to conversions or any meaningful metric. If it was everyone who was losing this data...I could understand the change but if you buy adwords ads, you still get the referral data even in https Google.

Bill_Dimm 14y ago

If you want referrer data, offer your site over SSL...Browsers don't send a referrer header if the referring site is SSL and the target site is not. I haven't tested any browsers or looked at any standards on this, but if that works it doesn't make any sense to me. I would think that the rule would be "Browsers don't send a referrer header [to a different domain] if the referring site is SSL" period (no "and the target site is not" part). If a URL on site X contains secret information, why would it be OK to transmit that secret information to some other website simply because the secret information is encrypted while in transit? At the very least, I would expect the user to be prompted to confirm such action before doing it (which would probably be more annoying to the user than just dropping the referrer info).

halfwit 14y ago
Right, that doesn't make sense.