11 ms·

A new spam policy for “back button hijacking”

• CableNinja 6mo ago
  Frustrating it took this long for something to be done about this, but glad its now got something being done.
  • throwaway81523 6mo ago
    > When a user clicks the "back" button in the browser, they have a clear expectation: they want to return to the previous page. Back button hijacking breaks this fundamental expectation. It seems pretty stupid. Instead of expanding the SEO policy bureaucracy to address a situation where a spammer hijacks the back button, the browser should have been designed in the first place to never allow that hijacking to happen. Second best approach is modify it now. While they're at it, they should also make it impossible to hijack the mode one.... oh yes, Google itself does that.
    • spankalee 6mo ago
      What about all the very legitimate uses of programmatically adding history entries?
      • jack1243star 6mo ago
        Please explain the legitimate uses. Not once I have ever encountered a website that does something useful by modifying the behavior of my browsing history.
        • venussnatch 6mo ago
          Any single page application, such as YouTube, Gmail, or discord. It lets persistent content (videos) or connections (chat) persist while emulating a pagenated browsing experience. When it's done right you don't notice it at all.
          • jack1243star 6mo ago
            (rant warning) Well, if I wanted to return to the parent screen in a single page application, I'd click on the back button in the app itself. No need to prevent me from back tracking in the exact order of my browsing should I need it. I especially hate YouTube's implementation, I can never know the true state on my older PC during whatever it's trying to accomplish, often playing audio from a previous video when I backspace out. I resort to opening every link in a new tab.
          • mrob 6mo ago
            Youtube doesn't implement a back function. A real back function would take you back to the same page you came from. If you click a video from the Youtube home page, then click the back button, Youtube will regenerate a different home page with different recommendations, losing the potentially interesting set of recommendations you saw before. You are forced to open every link in a new tab if you want true back functionality.
        • least 6mo ago
          https://html.spec.whatwg.org/multipage/nav-history-apis.html#dom-history-pushstate https://html.spec.whatwg.org/multipage/nav-history-apis.html... The spec kind of goes into it, but aside from the whole SPAs needing to behave like individual static documents, the big thing is that it's a place to store state. Some of this can be preserved through form actions and anchor tags but some cannot. Let's say you are on an ecommerce website. It has a page for a shirt you're interested in. That shirt has different variations - color, size, sleeve length, etc. If you use input elements and a form action, you can save the state that way, and the server redirects the user to the same page but with additional form attributes in the url. You now have a link to that specific variation for you to copy and send to your friend. Would anyone really ever do that? probably not. More than likely there'd just be an add to cart button. This is serviceable but it's not necessarily great UX. With the History API you can replace the url with one that will embed the state of the shirt so that when you link it to your friend it is exactly the one you want. Or if you bookmark it to come back to later you can. Or you can bookmark multiple variations without having to interact with the server at all. Similarly on that web page, you have an image gallery for the shirt. Without History API, maybe You click on a thumbnail and it opens a preview which is a round trip to the server and a hard reload. Then you click next. same thing. new image. then again. and again. and each time you are adding a new item to the history stack. that might be fine or even preferred, but not always! If I want to get back to my shirt, I now have to navigate back several pages because each image has been added to the stack. If you use the History API, you can add a new url to the stack when you open the image viewer. then as you navigate it, it updates it to point to the specific image, which gives the user the ability to link to that specific image in the gallery. when you're done. If you want to go back you only have to press back once because we weren't polluting the stack with history state with each image change.
          • jack1243star 6mo ago
            Thanks for the detailed and thoughtful reply! I agree that in both of the scenarios you mentioned, this API does provide better usability. I guess what feels wrong to me is the implicitness of this feature, I'm not sure whether clicking on something is going to add to history or not (until the back button breaks, then I really know).
    • pwdisswordfishq 6mo ago
      Especially since, who cares about traditional SEO any more?
• al_borland 6mo ago
  Some Microsoft sites have been very guilty of this. They are the ones that stick in my head in recent memory.
  • sixothree 6mo ago
    Epic store makes it impossible to navigate backwards from the checkout on mobile at least. Not sure if it's design or just poor design.
    • quantum_magpie 6mo ago
      I think most checkouts do that, to prevent duplicate payments. Dunno about epic, but I often encounter that mitigated by a dedicated ‘go back to store’ button post-checkout
  • 542458 6mo ago
    Are they? This seems about deceptive or malicious content (i.e., redirecting to ads) rather than “something in my history triggers a JS redirect”. I’ve definitely experienced the latter with MS, but never the former.
    • surround 6mo ago
      It seems like Google's policy is unconcerned with the intent of the practice. If a website JS redirect ruins the user experience by breaking the back button, it will be demoted in search results. It doesn't matter whether or not the redirect was meant to be deceptive or malicious, websites shouldn't be ruining the user experience.
      • dataflow 6mo ago
        > It seems like Google's policy is unconcerned with the intent of the practice. I'm reading the opposite: "If you're currently using any script or technique that inserts or replaces deceptive or manipulative pages into a user's browser history that [...]"
      • 6mo ago
• musicale 6mo ago
  The iron law of web encrapification: every web feature will (if possible) be employed to abuse the user, usually to push advertising.
  • chongli 6mo ago
    It really comes down to JavaScript. The web was fine when sites were static HTML, images, and forms with server-side rendering (allowing for forums and blogs).
    • AuthAuth 6mo ago
      It wasnt "fine".
      • atoav 6mo ago
        Oh, the social media was much, much better. People much more open, tracking didn't exist. All the idiots still thought computers were only a thing for nerds and kids.
    • pottertheotter 6mo ago
      Did you use the web back in 1995? It was fun, but it also sucked compared to what we have now. Nothing is ever perfect, but I wouldn’t want to go back.
      • ryandrake 6mo ago
        I’d go back in a heartbeat. Making the web a software SDK was the worst thing to happen to it.
        • collabs 6mo ago
          You talk about 1995 but I wouldn't even go back to 1999. Dialup was so painful. It advertised 56 know but in practice I never even say 48...
• bschwindHN 6mo ago
  Cool, now maybe let's do something about all the shit I have to clear out out my face before I can read a simple web page. For example, on this very article I had to click "No thanks" for cookies and then "No thanks" for a survey or something. And then there was an ad at the top for some app that I also closed. It's like walking into some room and having to swat away a bunch of cobwebs before doing whatever it is you want to do (read some text, basically).
  • internet101010 6mo ago
    Don't forget the useless "Got it!" popups, especially when the site blurs the screen to guide you to it.
  • pwg 6mo ago
    With uBlockOrigin set to default deny all the javascript on the page there are: zero cookie banners zero surveys popping up zero ads to be closed Just the text of the page with no other distractions in the way.
  • not_your_vase 6mo ago
    Haha, we had a solution for that, called pop-up blockers. Then when they became very usable, everyone switched to overlays injected with javascript, so they became unblockable. But thinking of this at this moment, this could be a good use for a locally ran LLM, to get rid of all this crap dynamically. I wonder why Firefox didn't use this as a usecase when they bolted AI on top of Firefox. Maybe it is time for me to check what api FF has for this
    • Terr_ 6mo ago
      I'm waiting for someone to develop an augmented-reality system that detects branded ads or products, compares them against a corporate-ownership database, applies policies chosen by the user, and then adds warning-stripes or censor-bars over things the user has selected against. It would finally put some teeth behind the myth of the informed consumer, and there would be gloriously absurd court-battles from corporations. ("This is our freedom of speech and commerce, it's essential, if people don't like what we're doing they can vote with their wallets... NOT LIKE THAT STOP USING SPEECH AND COMMERCE!")
• synack 6mo ago
  Are they considering all uses of window.history.pushState to be hijacking? If so, why not remove that function from Chrome?
  • omcnoe 6mo ago
    No, only if your website abuses window.history.pushState to redirect the user to spam/ad content is it considered abuse.
  • tgsovlerkhgsel 6mo ago
    Because clicking on a navigation button in a web app is a good reason to window.history.pushState a state that will return the user to the place where they were when they clicked the button. Clicking the dismiss button on the cookie banner is not a reason to push a state that will show the user a screen full of ads when they try to leave. (Mentioning the cookie banner because AFAIK Chrome requires a "user gesture" before pushState works normally, https://groups.google.com/a/chromium.org/g/blink-dev/c/T8d4_BRb2xQ/m/WSdOiOFcBAAJ?pli=1 https://groups.google.com/a/chromium.org/g/blink-dev/c/T8d4_...)
  • kro 6mo ago
    It's a valid question how they detect it. As there are valid usages, just checking for the existence of the function call would not be correct. These sites likely pushState on consent actions so it appears like any user interaction.
    • tgsovlerkhgsel 6mo ago
      No idea how they actually do it, but I wouldn't be surprised if manual reports and actions play a big role. The policy doesn't need to be enforced reliably as long as it is plausible for reasonably big actors to get caught sooner or later and the consequences of getting caught are business-ruining. But detecting it on a technical level shouldn't be hard either. Visit the page, take a screenshot, have an AI identify the dismiss button on the cookie/newsletter popups, scroll a bit, click something that looks inactive, check if the URL changes, trigger the back action. Once a suspicious site is identified, put it in the queue for manual review.
• tgsovlerkhgsel 6mo ago
  Now do paywalls next.
  • ladberg 6mo ago
    How would you recommend that creators of valuable content get paid?
    • renewiltord 6mo ago
      Ideally, when I create valuable content I am paid and when I consume valuable content I don't pay. Advertising does this but I hate it so I don't want that. So ideally, there is no way to extract value from me but I am able to extract value from others. I think I would support someone who finds a way to enforce this. But I am also willing to pay for valuable content an exorbitant amount if it is valuable enough. For instance, for absolutely critical information I might pay 0.79€ a month.
    • tgsovlerkhgsel 6mo ago
      Paywalls are, of course, the author's choice. But a paywall is a rather useless page, so it shouldn't be shown in search results. Normally, serving Google one page (e.g. a full article) and showing users something else (e.g. a paywall) would be grounds to ban that site forever, but Google built a special exemption for paywalls. Showing search results that the user can't actually use is user hostile. It's essentially an ad disguised as a search result, with the problem that those ads displace other results that I might actually be able to read. Of course, if the policy was to not index paywalled content, we might have avoided the paywallization of the Internet. Somehow, decades ago, when the Internet was smaller and there were fewer eyeballs, high quality content could successfully get monetized with non-tracking ads. Now we have invasive ads that try to profile you, ads that are full of scams because quality control has gone out the window, and yet, somehow, everything needs to be behind a paywall...
• charcircuit 6mo ago
  Google should actually fix this from the browser side instead of trying to seriously punish potentially buggy sites.
  • SuperNinKenDo 6mo ago
    Honestly if your site is buggy in a way that effectively breaks the browser, maybe you should be punished.
    • bot403 6mo ago
      I recommend 14 days in jail for the site owner, and, if egregarious, the engineer as well. Not life ruining but just enough to be annoying. Just like their website.
  • josephcsible 6mo ago
    What does this have to do with sites being buggy? This change is about obvious intentional abuse.
    • charcircuit 6mo ago
      SPA legitimately insert pages into the history to hijack the back button to make it seem like the user was actually navigating through a site instead of it being a single page. If there is a bug somewhere that causes it to insert too many of these navigations or add navigations that user doesn't personally think should be navigations I could see it being considered as potentially violating this policy. If this was about intentional abuse the article would not have had to ask all site operators in existence to audit their entire website for this. Even if some random library does this without your knowledge can violate this.
  • domenicd 6mo ago
    We tried a few times. We got as far as gating the ability to push into the "real history stack" [1] behind a user activation (e.g. click). But, it's easy to get the user to click somewhere: just throw up a cookie banner or an "expand to see full article" or similar. We weren't really able to figure out any technical solution beyond this. It would rely on some sort of classification of clicks as leading to "real" same-document navigations or not. This can be done reasonably well as long as you're in a cooperative relationship with the website. For example, if you're trying to classify whether a click should emit single-page navigation performance entries for web performance measurement. (See [2].) In such a case, if the browser can get to (say) 99% accuracy by default with good heuristics and provide site owners with guidance on how to annotate or tweak their code for the remaining 1%, you're in good shape. But if you're in an adversarial relationship with the website, i.e. it's some malicious spammer trying to hijack the back button, then the malicious site will just always go down the 1% path that slips through the browser's heuristics. And you can try playing whack-a-mole with certain code patterns, but it just never ends, and isn't a great use of engineering resources, and is likely to start degrading the experience of well-behaved sites by accident. So, policy-based solutions make sense to me here. [1]: "real history stack": by this I mean the user-visible one that is traversed by the browser's back button UI. This is distinct from the programmer-visible one in `navigation.entries()`, traversed by `navigation.back()` or `history.back()`. The browser's back button is explicitly allowed to skip over programmer-visible entries. https://html.spec.whatwg.org/multipage/speculative-loading.html#nav-traversal-ui https://html.spec.whatwg.org/multipage/speculative-loading.h... [2]: https://developer.chrome.com/docs/web-platform/soft-navigations-experiment https://developer.chrome.com/docs/web-platform/soft-navigati...
• andrewmcwatters 6mo ago
  [dead]
• twism 6mo ago
  Reddit! I'm looking at you?
  • itopaloglu83 6mo ago
    Scroll on Reddit on mobile and click on a link. The comments open in a new tab. Close the tab and the previous tab is also at the link you’ve just closed. Makes it impossible to browse around and long click to open on a new tab doesn’t solve the issue either.
    • kaelwd 6mo ago
      And if the tab was unloaded then you press back it changes the URL but not the actual contents of the page.
  • rc_kas 6mo ago
    I feel like facebook is the worst culprit with this
  • concinds 6mo ago
    Those are all weird WebKit issues, and reddit not testing MobileSafari. It works perfectly on Chrome, if it was intentional they would have broken it on Chrome too. As always you can count on Apple/Safari team to not give a shit, not try to fix it, not reach out to reddit to ask them to fix it, etc.
    • snowwrestler 6mo ago
      You think Reddit does not test in their #1 browser?
      • concinds 6mo ago
        Are you saying it's solely Apple's fault?
• mlmonkey 6mo ago
  But the question is: why are sites allowed to hijack the Back Button?!?
  • filcuk 6mo ago
    Because it has a legitimate use. As anything, the tools will be abused by malicious actors
  • josephcsible 6mo ago
    So that in single-page applications, it can work intuitively instead of always taking you all the way out of the app.
    • not2b 6mo ago
      If the navigation simulates what would happen if we follow links to SPA#pos1, SPA#pos2, etc so that if I do two clicks within the SPA, and then hit Back three times I'm back to whatever link I followed to get to the SPA, I guess it's OK and follows user expectations. But if it is used as an excuse to trap the user in the SPA unless they kill the tab, not OK.
      • mock-possum 6mo ago
        Of course, but programmatically, how do you enforce that?
        • JoshTriplett 6mo ago
          Some browser APIs (such as playing video) are locked behind a user interaction. Do the same for the history API: make it so you can't add any items to history until the user clicks a link, and then you can only add one. That's not perfect, and it could still be abused, but it might prevent the most common abuses. EDIT: apparently Chrome tried that and it wasn't sufficient: https://news.ycombinator.com/item?id=47761349 https://news.ycombinator.com/item?id=47761349
      • bonesss 6mo ago
• transcriptase 6mo ago
  >We believe that the user experience comes first I’ll believe that when YouTube gives me the ability to block certain channels versus “not interested” and “don’t recommend channel” buttons that do absolutely nothing close to what I want. Or a thousand other things, but that one in particular has been top of mind recently.
  • bot403 6mo ago
    Or if they ever bring back the "ignore this domain" feature so we can ignore ai slop and copycat sites. It's why I went to Kagi.
  • PeterStuer 6mo ago
    Let me permanently hide "shorts".
    • VileSquirrel 6mo ago
      You can mostly do it with ublock origin filters. Here are mine, though they do more. www.youtube.com###contents-container > .ytd-rich-shelf-renderer.style-scope www.youtube.com###rich-shelf-header www.youtube.com###content > .ytd-rich-section-renderer.style-scope ||www.youtube.com/shorts/$document Alternatively on firefox you can use either the "unhook" extension (https://addons.mozilla.org/en-US/firefox/addon/youtube-recommended-videos/ https://addons.mozilla.org/en-US/firefox/addon/youtube-recom...) or "enhancer for youtube" (https://addons.mozilla.org/en-US/firefox/addon/enhancer-for-youtube/ https://addons.mozilla.org/en-US/firefox/addon/enhancer-for-...) extension (which has an option for this).
• incognito124 6mo ago
  Now, if they only declared scroll hijacking as spam...
• andreareina 6mo ago
  > Notably, some instances of back button hijacking may originate from the site's ... advertising platform I feel like anything loaded from a third party domain shouldn't be allowed to fiddle with the history stack.
  • kvdveer 6mo ago
    While i agree, the current JS security model rally doesn't allow for distinguishing origin for JS code. Should that ever change, advertisers will just require that you compile their library into the first party js code, negating any benefit from such a security model.
    • lmm 6mo ago
      > advertisers will just require that you compile their library into the first party js code, negating any benefit from such a security model. It will become harder for advertisers to deny responsibility for ads that violate their stated policies if they have to submit the ads ahead of time. Also site operators will need a certain level of technical competence to do this.
      • miki123211 6mo ago
        More likely, advertisers will need you to insert a "bootloader" that fetches their code and passes it to eval(). Alternatively, they might require you to set up a subdomain with a cname alias pointing to them (or a common CDN), negating any security benefits of such a practice.
        • thepasch 6mo ago
          > More likely, advertisers will need you to insert a “bootloader” that fetches their code and passes it to eval(). Sounds like legal precedent waiting to be set. “Run our code so that it looks like your code, acts like your code, and has all the same access as your code” seems like it should be a slam dunk if said code ends up doing a Very Bad Thing to your visitors. But of course that’s assuming common sense, and the law’s relationship with that isn’t always particularly apparent.
• hysan 6mo ago
  Took long enough. Maybe I missed it, but I didn’t see them say how invested they are in tackling this. Promoting a rule is one thing, but everything SEO related becomes a cat and mouse game. I don’t have high confidence that this will work.
  • onli 6mo ago
    Seems invested enough to me. Adding this to the anti spam policy means they will list sites using this lower or not at all, when detected. And they use automated and manual detection for such things. Not much more they can do? And should be effective, who employs scam tactics like this is also interested in having visitors.
• psidium 6mo ago
  Ironically, we have an infringing website right now on the front-page of HN (nypost).
• dnnddidiej 6mo ago
  Easy fix: JS doesn't let you change back button behaviour. Q. But what about SPA? A. Draw your own app-level back button top left of page. Another solution: make it a permisson.
  • Hamuko 6mo ago
    >Draw your own app-level back button top left of page. This is the worst idea I’ve heard all day.
    • dnnddidiej 6mo ago
      I agree. Because most SPAs don't need a back button. VS Code doesn't have one (undo is not back). Thunderbird doesn't. My MP3 player doesn't.
  • kaelwd 6mo ago
    Can I preventDefault on mouse5? What about the physical back button on Android?
  • sublinear 6mo ago
    Why not just put up a fake captcha page? When the user clicks the link to continue, the back button is now hijacked.
  • layer8 6mo ago
    Yeah, no thanks. I want to use my browser’s standard keyboard shortcut to navigate back. And also forward again. And I want to be able to inspect the history listing before I go back or forward. Let the browser do the browsery things. Don’t make SPAs suck even more than they already do.
    • dnnddidiej 6mo ago
      So when you use a desktop app there is no back button but there is a switch to another app shortcut. Same idea.
• sublinear 6mo ago
  > Notably, some instances of back button hijacking may originate from the site's included libraries or advertising platform. We encourage site owners to thoroughly review their technical implementation... Hah. In my time working with marketing teams this is highly unlikely to happen. They're allergic to code and they far outnumber everyone else in this space. Their best practices become the standard for everyone else that's uninitiated. What they will probably do is change that vanity URL showing up on the SERP to point to a landing page that meets the requirements (only if the referer is google). This page will have the link the user wants. It will be dressed up to be as irresistible as possible. This will become the new best practice in the docs for all SEO-related tools. Hell, even google themselves might eventually put that in their docs. In other words, the user must now click twice to find the page with the back button hijacking. Even sweeter is that the unfettered back button wouldn't have left their domain anyway. This just sounds like another layer of yet more frustration. Contrary to popular belief, the user will put up with a lot of additional friction if they think they're going somewhere good. This is just an extra click. Most users probably won't even notice the change. If anything there will be propaganda aimed at aspiring web devs and power users telling them to get mad at google for "requiring" landing pages getting in the way of the content (like what happened to amp pages).
• monegator 6mo ago
  Phew. for a moment there i thought they would start blocking alternate uses of the back button in apps (for like when it means "go back" and when it means "close everything") That would have severely rustled my jimmies
• p4bl0 6mo ago
  That's cool if they can make it work. I don't understand how Google's indexing work anymore. I've had some website very well indexed for years and years which suddenly disappeared from the index with no explanation, even on the Search Console ("visited, not indexed"). Simple blog entries, lightweight pages, no JavaScript, no ads, no bad practices, https enabled, informative content that is linked from elsewhere including well indexed websites (some entries even performed well on Reddit). At the same time, for the past few years I've found Google search to be a less and less reliable tool because the results are less often what I need. Anyway, let's hope this new policy can improve things a little.
  • csomar 6mo ago
    This relates to Chrome, not to search. In regard to search, they have taken a new direction that I don't think is going to change any time soon. Some time in the last 2 years, they started removing any thing that doesn't get significant natural traffic (ie: have a 30 year old user manual for something odd that people only search for once in a while? -> removed). Last few months, I noticed that they will not index anything that seems broad (ie: if similar content exists, they won't index it regardless of your page authority). Basically, they are turning search into Tiktok. If you try to make a search, you'll notice that now they give precedence to AI overview, Youtube, News stories, Maps, Products, etc. Anything but content. tl;dr: content is dead in Google search.
    • rbits 6mo ago
      > This relates to Chrome, not to search. To me, it appears to relate to search > Pages that are engaging in back button hijacking may be subject to manual spam actions or automated demotions, which can impact the site's performance in Google Search results.
      • csomar 6mo ago
        Good point. Chrome has a “feature” where if your website is google-flagged, it’ll display a danger alert when visiting it. For some reason I confused that with this.
• kstenerud 6mo ago
  Now if only they'd do this for Android apps that hijack the back button to pop up things, or say "are you sure you want to leave?"
• oliwarner 6mo ago
  Now do the Amazon app. Number of times I've looked for something on my phone, gone through to a product page on Amazon but then have had to back out multiple times to get back to the search listing. Sometimes it's previously viewed products, sometimes it's "just" the Amazon home page. It should be one-and-done. eBay too. I'm sure there are others.
• bob1029 6mo ago
  This seems like a good time to advertise the post/redirect/get pattern. https://en.wikipedia.org/wiki/Post/Redirect/Get https://en.wikipedia.org/wiki/Post/Redirect/Get Not strictly about hijacking back navigation but it can make experience less bumpy if you've got form submissions in the middle of the path.
  • karim79 6mo ago
    I'm a huge fan of this pattern (and as a greybeard). I honestly wonder if people think about such things this day and age where everything is react.
    • koen_hendriks 6mo ago
      There are frameworks that navigate like this. Laravel is the first that comes to mind. I think Django and Spring do this as well.
    • bob1029 6mo ago
      It's amazing how often highly-polished web infrastructure gets put into the trash in pursuit of narrow objectives like avoiding a full page load. Very few applications actually benefit from being a single page. You tend to lose a lot more than you gain in terms of UX.
  • lxgr 6mo ago
    TIL that this (or rather, the lack of this) is why some pages show that annoying "do you want to resubmit your post" notification, but not others, and the name for it. Thank you!
• NooneAtAll3 6mo ago
  is there a policy on "home button hijacking"? I'm tired of apps that intercept home button to ask "are you sure?" - home button is home button, return me to the main phone screen also, ads at the bottom of the screen, so that if you miss home button you open a website
• imiric 6mo ago
  > We believe that the user experience comes first. If by "user" you mean advertisers, sure you do. Everyone else is an asset to extract as much value from as possible. You actively corrupt their experience. The fact these companies control the web and its major platforms is one of the greatest tragedies of the modern era.
• Animats 6mo ago
  Now to prevent scroll bar hijacking.
• slurpyb 6mo ago
  Porno sites do this thing where every click is a new tab and when you refocus the previous tab, it reloads to an ad. Or so I have been told.
  • estetlinus 6mo ago
    [flagged]
• ffsm8 6mo ago
  I would like to mention that Google own SPA framework, angular, has redirect routes which effectively do back button hijacking if used, because they add the url you're redirecting from to the history. https://angular.dev/guide/routing/redirecting-routes https://angular.dev/guide/routing/redirecting-routes
  • sam1r 6mo ago
    That's only because SPAs routing maybe internal for that particular app. In that case, the UI/UX to end user is *only* possible and smooth when they hijack the back button as such.
    • bryanhogan 6mo ago
      Yeah, I think people are forgetting that if we want PWAs to behave and function like "native apps" that this functionality is needed. I revently built an app with SvelteKit + Capacitor and had to implement the stack-based navigation one expects from a phone app myself.
  • nailer 6mo ago
    getAngular was an online JSON storage service. The guys reused their code when they went to work in DoubleClick at Google. Not made by Google not Google’s framework and plenty of Google people think it’s rubbish.
    • ffsm8 6mo ago
      While that's an interesting history tidbit, angular 2 was remade entirely under Google's leadership - the previous AngularJS framework was not reused to my knowledge - so I'd strongly push back on your statement it not being made by Google
      • nailer 6mo ago
        "made by Google" was added by the 2 guys from the failed startup when Angular was first released (before Angular 2), without permission from the rest of Google.
• G_o_D 6mo ago
  Instagram comments page requires 2 quick back press or else it won't take to previous page
• kristopolous 6mo ago
  Almost 30 years ago I wrote an article advocating for domain level back button with a quasi mode like ctrl to traverse domains. Would have fixed this. Too late now
• _ink_ 6mo ago
  A browser feature I wasn't aware of for too long: long press the back button, to get a list of recent URLs, allowing you to skip anything trying to hijack the back button.
  • Asmod4n 6mo ago
    That’s surely bounded now much it can show, so an attacker can just fill it up till the api throws an error
    • asqueella 6mo ago
      Surely the browser could enforce a limit on a domain, and make sure that the real page you came from (typically the search engine) is prominently displayed.
  • voidUpdate 6mo ago
    Or right click
  • deleted 6mo ago
    [deleted]
  • totalwebtool 6mo ago
    The most egregious cases of back button hijacking will leave you with a very long list of entries, which is why it's good to see Google taking this seriously. It's annoying and can be outright malicious in many cases on the part of the offending website.
• vsgherzi 6mo ago
  Amazing change, fighting with the back button is my least favorite part of the ad web and a blindspot for ublock. I wonder how Google is going to track this and if SPA style react router sites would be downranked because of the custom back button behavior. I doubt it due to their popularity but I'm curious how they're going to determine what qualifies as spam
• firefoxd 6mo ago
  Ok, you can start with LinkedIn, I'll wait... If you are wondering how it works. You get a link from LinkedIn, it's from an email or just a post someone shared. You click on it, the URL loads, and you read the post. When you click the back button, you aren't taken back to wherever you came from. Instead, your LinkedIn feed loads. How did it happen? When you landed on the first link, the URL is replaced with the homepage first (location.replace(...) doesn't change the browser history). Then the browser history state is pushed to the original link. So it seems like you landed on the home page first then you clicked on a link. When you click the back button, you are taken back to the homepage where your feed entices you to stay longer on LinkedIn.
  • giorgioz 6mo ago
    Also www.reddit.com is/was doing the same back button hijacking. From google.com visiting a post, then clicking back and you would find yourself on Reddit general feed instead of back to Google.
    • cli 6mo ago
      I do not see this behaviour on the latest version of Firefox. I do use old.reddit, however.
      • myrion 6mo ago
        I don't use old Reddit, and haven't noticed this behaviour either.
        • moritzwarhier 6mo ago
          Sounds like maybe some prevention against this is already implemented in either particular Android browsers, or ad blockers, maybe even for specific sites? Just speculating, I can't imagine a reason why they'd implement this especially for Safari. Other than A/B-testing or trash code that coincidentally doesn't work in all mobile browsers. Maybe they use the same AI that generates their fictious relationship stories to add these dark patterns to their code base :D
• cik 6mo ago
  Great. Now do Android phones...
• parasti 6mo ago
  I understand this is vague on purpose but wish there was more detail. E.g., if I am running a game in a webgl canvas and "back button" has meaning within the game UI which I implement via history states, is my page now going to be demoted? This article doesn't answer that at all.
  • sheept 6mo ago
    Your game probably has poor SEO to begin with, so the Google Search policy changes would not apply
  • rbits 6mo ago
    If it automatically adds something to the history when you visit the page, then yes. If it only adds to the history when the user clicks something, then I would assume it would be fine. Hopefully.
    • lxgr 6mo ago
      Isn't this a heuristic implemented by browsers already these days?
• the_gipsy 6mo ago
  > We believe that the user experience comes first. Excuse me??
• globalnode 6mo ago
  will google really punish sites for doing this? and if so how do i report a site? i guess i could email the site with the google link and suggest they fix it first
  • CWwdcdk7h 6mo ago
    [dead]
• mikkom 6mo ago
  Maybe we can get facebook finally drop this dark pattern
• nottorp 6mo ago
  So why don't google just disable the possibility of hijacking the back button in Chrome, to give an example?
  • dominicrose 6mo ago
    It's not clear what constitutes a hijacking and how they are going to detect it. It may be OK to override the button as long as it's used in the intended way which is to go back. In a single-page application it may not trigger a navigation event.
    • nottorp 6mo ago
      > In a single-page application it may not trigger a navigation event. So isn't that also back hijacking?
  • deleted 6mo ago
    [deleted]
  • worksonmine 6mo ago
    This would break so many websites. There are valid uses for the history API, I often do modals/popups as shareable URLs, and using the back button closes it.
  • red_admiral 6mo ago
    In an "application" model rather than a "document" one, like MS Word online or draw.io or similar, there's no clear semantics for "back" but there is a risk of the user losing data if they can navigate away without saving.
    • nottorp 6mo ago
      This is a consequence of sites being allowed to hijack back in the first place. They can still fix it. For your use case all you need is the page to get notified so it can save. Remember that on Android your onSaveInstanceState gets called and you have to save your state or lose it.
• alpaca128 6mo ago
  Great! So they'll fix the back button bugs on YouTube, and return me to the previous set of video recommendations when I use it on the homepage, right? Right? And let me return to the actual site when it detects that I lost the web connection for 0.01 seconds and hides all the content, and I then press the back button?
• Aardwolf 6mo ago
  Why not fix this at the browser level? E.g. long or double click on back button = go to previous non-javascript-affected page (I mean by that: last page navigated to in the classical sense, ignoring dynamic histories altered by js and dynamic content)
  • chakintosh 6mo ago
    That wouldn't work because this technique messes with your history. Long press on the button will just show you a list of the previous pages you visited, and all of them will have the same link to the one you're in, with just one at the bottom of the actual URL you came from. But that's so much friction UX-wise.
  • mrob 6mo ago
    Double clicking is not a fix because it doubles latency, and more than doubles latency if you don't want to issue page loads that are immediately aborted. Long clicking is such a bizarre anti-feature that I never considered it might exist until I read about it in this HN discussion. Putting touchscreen-specific workarounds for lack of mouse buttons and modifier keys in a traditional GUI app is insanity.
• chakintosh 6mo ago
  Google should probably talk to Microsoft about this because for me they are the biggest offenders with this back button hijacking in their support forums.
• LLLDP 6mo ago
  So someone developed a malicious plugin to achieve this? Otherwise, I can't imagine how they could bypass the browser to do this.
• vladde 6mo ago
  i wonder if this includes sites that do auto-redirect: A -> B (auto-redirect) -> C if i'm on page C and go back, page B will take me to page C again. i think this is more about techincal incompetence rather than malicious intent, but still annoying.
• kartik_malik 6mo ago
  that's crazy things goin on
• eviks 6mo ago
  > Why are we taking action? We believe that the user experience comes first. What's the real reason?
  • nubinetwork 6mo ago
    It broke Gemini and of course we can't have that...
• Havoc 6mo ago
  Great. Can we do ctrl-f search hijacking next. So jarring when websites replace core functionality with their own broken crap because they think they’re special. Some also seem to hijack right click menu now
  • Mate4 6mo ago
    Firefox allows you to bypass right click hijacking by holding shift before pressing right click.
    • gonzalohm 6mo ago
      There is also an option in about:config: "dom.event.contextmenu.enabled" set it to false
  • arielcostas 6mo ago
    Some also hijack the shortcuts to open devtools (like F12), so you have to find the option in the browser menu itself
    • lebuin 6mo ago
      You can also click the address bar and then press you shortcut. Should be faster and works for all shortcuts AFAIK.
      • david_allison 6mo ago
        Thank you!
  • ivanjermakov 6mo ago
    Don't get me started on scroll hijacking.
  • amadeuspagel 6mo ago
    This misses the point. Websites are allowed to replace default keyboard shortcuts for a reason. There are only a few exceptions to this, like Ctrl+W. In other words, you can design your website however you want, except to make it more difficult to leave. This is an implementation of the same philosophy.
• Yizahi 6mo ago
  I'm at a stage when I click back button extremely rarely and is amazed when it works as I expected.
• seanalltogether 6mo ago
  Does this also apply to sites like instagram that simply erase your entire back button history if you visit the site.
• shevy-java 6mo ago
  I don't trust Google. We need to go back to an independent and competent research group designing standards. Right now Google pwns and controls the whole stack (well, not really ALL of it 1:1, but it has a huge influence on everything via the de-facto chrome monopoly). Remember how Google took out ublock origin. They also lied about this aka "not safe standards" - in reality they don't WANT people to block ads.
  • edg5000 6mo ago
    Power is taken but also given. It's a dynamic and I agree it's gotten way, way out of hand. It may eventually supress progress and become a real parasitic presence, but we've not reached that point yet (in net terms). Google has been relatively responsible with the power, but cracks have been starting to show. It will get a whole lot worse before it gets better. That is why I embrace vertical integration despite the tremendous cost. Call it the cockroach approach; it allows being partially decoupled from outside fluctuations. Addition: People underestimate Google's influence. It's easy to forget they de-facto control Firefox, leaving only Apple and Google in control of the Web. Scary, but looking away won't help either. The Americans have been consistently competent with technology since the advent of the transistor right after WW2. They're reaping the benefits of that still to this day. I say that as a European.
• SCdF 6mo ago
  Ironically the only place I encounter this is using google news, where news sites seem to detect you're in google news (I don't think these same sites do it when I'm just browing normally?), and try to upsell you their other stories before you go back to the main page.
• felixding 6mo ago
  This is great. Can Google also stop scroll hijacking?
• a13o 6mo ago
  This would have been great back when I used a search engine to visit web pages.
• gadders 6mo ago
  I hope this applies to Android as well. Reddit is a particularly egregious offender.
• skrebbel 6mo ago
  How does this work? How can a site inject a totally different site into the history? I thought eg the History API only lets you add to the stack and pop, not modify history?
  • lxgr 6mo ago
    There's also a replace() method, and trying to limit that to only same origin or already visited URLs seems futile, as the pages hosted there can themselves detect that the user is navigating back and can just forward you in a number of ways.
• neeeeeeal 6mo ago
  Is there not a plugin that helps to fix this?
• XCSme 6mo ago
  Thank you! One of the worst is TikTok, even as a developer, when someone sends me a TikTok link and I have to visit it, I get stuck in the browser (same with the app but I uninstalled it), and it feels almost device-breaking the way they trap you in.
  • saagarjha 6mo ago
    TikTok is actually very adamant to boot me out of the browser
• bityard 6mo ago
  As usual, it's a good first step but doesn't go far enough. I don't want my back-button hijacked by _anything_. My issue with back-button hijacking isn't even spam/ads (I use an ad-blocker so I don't see those), but sites that do a "are you sure you want to leave? You haven't even subscribed to our newsletter yet?!"
  • Sayrus 6mo ago
    On the other hand, "are you sure you want to exit without saving" is a good use-case. But I'd prefer that to be a setting I can allow for specific site.
    • wat10000 6mo ago
      Better yet, just save. Storage is cheap and fast these days. The “do you want to save?” idiom is a leftover from the days when a moderately sized document would take a noticeable amount of time to save and eat up a decent chunk of your floppy disk.
      • tripflag 6mo ago
        But what if you are leaving the page because you changed your mind, and don't wish to save the changes after all? This, for me, is the common case, so i would not want the browser to suddenly commit an unfinished draft.
        • wat10000 6mo ago
          If you’re worried about losing the old version, it should keep a history. If you want to erase the new version, there should be an explicit action to do that.
      • Sayrus 6mo ago
        An unfinished upload or sync stored locally instead of on the remote can absolutely be an issue. You can look at all the posts about OneDrive and GDrive not actually syncing before confirming to users who then delete their files since they "have been uploaded". Or the user may never open that specific page again or the session will not exist anymore when he comes back. Browser storage is cheap, but it is not guaranteed to be durable.
• Arthur00 6mo ago
  [dead]
• jbonatakis 6mo ago
  > We believe that the user experience comes first Bold coming from the company who gives me the most confusing “Open in app” prompts that are designed to confuse you and get you to use their app rather than the web https://mjtsai.com/blog/2024/03/29/those-obnoxious-sign-in-with-google-prompts/ https://mjtsai.com/blog/2024/03/29/those-obnoxious-sign-in-w...
• cientifico 6mo ago
  Click on any Youtube video from any web in android. If you press anything that is not the back button immediately, you will loose the option to go back. So this coming from google... it's funny. Welcome, but funny.
• blacksoil 6mo ago
  Yes please! It's very annoying how clicking an FB or Insta result from a Google search result would disallow going back to the search result!
• sidewndr46 6mo ago
  too little, too late. The API for interacting with the back button in Javascript should never have existed in any capacity.
• snowwrestler 6mo ago
  Wait, how does one website (google.com) know what happens inside my browsing session on another website (bad-blog.com) after I click over? Hmmmmm This sort of announcement just emphasizes the extent to which Google observes ALL your web browsing behavior, thanks primarily to their eyes inside Chrome browser. You know those warnings when you install a browser extension, about all the things that extension will be able to see and do? Well so can Chrome itself…
  • beastman82 6mo ago
    They've been crawling the web since inception
    • snowwrestler 6mo ago
      A web crawler reads page content, extracts content and URLs, places them into an index, and then follows links in that index to further build the index and content corpus. Google and others have special crawlers that execute JavaScript to crawl content delivered dynamically. Crawlers do not use the browser back button or browser history. So the only way Google could observe such problems is by observing live human browsing behavior. Also, we know from exhibits in the U.S. DOJ trial that Google does use Chrome browsing behavior as a signal in search ranking. It’s not a hypothetical.
      • adrianmonk 6mo ago
        > Crawlers do not use the browser back button or browser history. Couldn't you instrument the crawler's browser engine to observe whether (while crawling) the page does any behaviors that would result in back button hijacking? No back buttons have to be clicked. You just have to watch whether the mousetrap is set. Since you know how mousetraps work, you don't have to grab the cheese.
  • ImPostingOnHN 6mo ago
    They likely scan the web pages themselves, but you shouldn't be using Chrome anyways, if you care about privacy from Google.
• mixedbit 6mo ago
  An interesting variant of a web phishing attack is to combine the back button hijacking with information that comes from the HTTP referer header. HTTP referer discloses from which website the user is coming from, when the user click the back button, the malicious site can take the user to the site that looks identical (except for the URL), but is attacker controlled.
• cachvico 6mo ago
  I use Chrome on my Android and Mac. For a while I've appreciated the seemingly built-in anti-hijacking measure that always does what I expect on the second Back press. (The first Back may pop up a subscription box for example, but the second will always return me to where I came from). I actually felt that this was a solved problem, so I'm surprised to see so many people still suffer getting stuck in redirect loops.
• cnees 6mo ago
  It's about time. Google is doing so much to keep the web usable. They're the only ones with the teeth to back up standards for mobile web load time, max sender spam rates, leaving browser history alone, etc.
  • righthand 6mo ago
    They’re also the ones frequently making it worse with their monopoly.
• phkahler 6mo ago
  I never understood why browsers ever allowed this in the first place. It's obviously bad. Yeah, yeah there are "reasons" but it's still obviously a bad solution to whatever "problem" they were trying to solve.
• jonahs197 6mo ago
  Microsoft joke support forum stil does this?
• gwbas1c 6mo ago
  It seems like a lot of the APIs that make a website act like an application need to be disabled by default; and some kind of friction needs to exist to enable them. Edit: I'm not sure what kind of friction is needed, either an expensive review process (that most application developers would complain about but everyone else would roll their eyes) or a reputation system. Maybe someone else can think of a better approach than me?
• wbshaw 6mo ago
  Is there any click-bait news site that DOESN'T do this? You hit back and land on a list of their click-bait articles and add links instead of the page you expect.
• halfmatthalfcat 6mo ago
  I remember when I worked at HuffPo and they started doing this. I called out the org and they all just shrugged.
• htk 6mo ago
  Popups were dealt in a way that could be useful here, they're only permitted when the user directly generates the interaction that creates the popup (not scripted). The back button could use the same algorithm back in history, only go back to screens that the user directly navigated.
• radium3d 6mo ago
  What about map applications which manipulate the history to store the position of the map as users drag and release to make back and forward work to the users expectation in a single page app? It’s not malicious, but will Google flag it?
• taco_emoji 6mo ago
  Really wish this was applied to phone apps. In Android at least, app A linking to app B will FREQUENTLY break the "back" functionality, allowing app B to handle the "back" action instead of doing what every user would expect 100% of the time, which is to go back to app A.
• celdon25 6mo ago
  Since this is Google we’re talking about, I’m fully expecting them to penalize benign uses of the back button override.
• davidczech 6mo ago
  There should be some browser-level enforcement of this. For example, it would seem possible to detect a user frustratingly mashing the back button, and offer a remediation dialog to disable any hackery that's hijacking the back buttons.
• Serhii-Set 6mo ago
  [dead]
• TehCorwiz 6mo ago
  I want my browser history to be immutable and operate like a tree and not like a stack.
  • ux266478 6mo ago
    I've been kicking around an idea in my head of a modern browser implementing some kind of "hardening" against anti-features. Deviating from the standard, implementing certain architectural features like this WORM history graph, etc. I don't want to ditch javascript entirely as I don't think it's particularly unreasonable as a feature. That being said, I don't want my extensions to be available via a URL query (even if obfuscated like what Firefox does.) I have yet to find a single webpage utilizing scrolljacking where I would care if it was broken and completely unnavigable. I can count on one hand webpages where I felt like input reading was justified, and even then I wouldn't miss them if the facilities which enable input reading were just made completely undefined. There certainly is a satisfaction that would come from a shit site like linkedin or youtube being reduced to a gibbering mess of exceptions. Scripting is a privilege, and it's a nice one, but abuse of it shouldn't be tolerated. I really don't see a usecase for boiling it down to a binary of allowing the whole gamut of complex programmability web browsers expose, or allowing none of it. I'd rather just draw a line and say "programs that use these features are acceptable, programs that use these ones aren't".
• mrheosuper 6mo ago
  Nice. This has been existed for too long.
• hmokiguess 6mo ago
  It's getting very tiring seeing things that could be first-class user defined controls baked in the browser so that you have true agency over the behaviour being done like this It's like the other thread from before where LinkedIn scans for your extensions, the fact they can do that without prompting for permission from the user is baffling
• TexanFeller 6mo ago
  When I first heard of the APIs that allowed websites to modify browser history it sounded like a huge mistake. I still feel that way to this day.
  • dylan604 6mo ago
    It only made sense in the SPA way of working. Allowing the history to be updated would allow the browser's default navigation to work. Outside of SPA type of sites, it was only ever going to be abused.
• rat_on_the_run 6mo ago
  I wish the browsers had a function of disabling all keyboard shortcuts of a website. I binded Ctrl+E to opening a new tab just beside the current tab (built-in hotkey in Brave). It's frustrating to see it changed to something like opening the emoji menu on Discord.
  • blfr 6mo ago
    Another one is hijcking ctrl+click (open in the new tab) into mere click (open here). I am shocked how many ecommerce sites do this.
    • myself248 6mo ago
      And many of them don't even have a real click action, that I can find. I can't even right-click and manually pick "open in new tab", because the browser doesn't recognize what I'm clicking on as a link. I agree, ecommerce sites are the place that I most often want to open several items in tabs and decide between them, and the place this function is most often blocked! I wish I could scream at the jerk who implemented this, but that jerk is not among the options of screamable people.
      • fragmede 6mo ago
        > the browser doesn't recognize what I'm clicking on as a link. It's entirely possible the browser itself does, but that the site's JavaScript is (also) overriding the right click handler. There's browser extensions to override their override but having to do that is stupid.
        • myself248 6mo ago
          I've installed one of those and it doesn't seem to help in the ecommerce case.
        • kevincox 6mo ago
          It's possible but this seems to be quite rare. In my experience it is always just that they think a div with an onclick handler is the same thing as a link.
• merelysounds 6mo ago
  Looks like there is also a client side solution for that, at least in Firefox; it's possible to prevent a page from modifying browser history: > Open the about:config page in Firefox > Search for "pushstate" > Double-click "browser.history.allowPushState" source: https://superuser.com/a/1688290 https://superuser.com/a/1688290
  • pfg_ 6mo ago
    Usually when I see this from non-spam sites, it's not even pushstate, it's just some page that redirects as soon as it loads. So you press back twice and it goes back -> forwards -> back -> forwards. Disabling pushstate doesn't fix that, it just makes pushstate equivalent to a redirect.
    • chmod775 6mo ago
      I haven't had that problem in a while. Did browser vendors already do something about it?
      • hansvm 6mo ago
        On qutebrowser I type 2H instead of H, and it doesn't go to the most recent history item at all. Mostly though, no, spammy websites still do this, and browser's haven't fixed it.
    • fluoridation 6mo ago
      That's relatively easy to work around. Right-clicking on the back button lets you go back several steps at once. I don't know about Chrome, but it does work on Firefox.
      • HappMacDonald 6mo ago
        AFAICT just holding left-click for half a second has the same effect. That's been my go to since the little triangle dropdown vanished from the back button (checks watch).. uh, some time in the nineties mebe?
• mancerayder 6mo ago
  Do we include reddit.com here, or too big to influence?
• vashchylau 6mo ago
  I initially thought this is for Android. Which has a long overdue problem of "Tap Back again to exit" type hijacks. Or feed-based apps (hi Reddit, TikTok, Instagram) refreshing your timeline in hopes you reconsider exiting and keep doomscrolling. One can only hope…
  • tgtweak 6mo ago
    Was honestly thinking "yeah nice Google, now do it for Android" since the worst offenders are apps (looking at you, Tiktok)
  • butokai 6mo ago
    Same for me! It took me a while staring at the article and wondering why "browser" was mentioned so many times, to realize it was not Android
• KevinMS 6mo ago
  what about back buttons reloading the page so to have any continuity you have to open everything in a separate tab? youtube for example
• purushpsm147 6mo ago
  [dead]
• sam1r 6mo ago
  Finally! (For this feature to be shipped). Almost unrelated, but.. I wonder ..if there was an APM intern[1] behind this, or maybe this was this project. Because, this, would have been an excellent one! [1] I had the fortune to be one myself in June 2012 for the Chrome Team.
• benj111 6mo ago
  Ah the irony. Wouldn't let me go back without clicking the cookie thing.
• urbandw311er 6mo ago
  The idea of Google lecturing anybody about hijacking UI for dark patterns is absurd. The company that hijacked an open source mobile OS and turned it into a closed source profit machine. The company that hijacked the web so “accelerated mobile pages” could effect a walled garden. The company that hijacked a browser and turned it into an anti-privacy tracking system. It’s like R. Kelly giving a keynote on safeguarding minors. EDIT: …but, yes, to be clear, I loathe the hijacking of back buttons too. Just a shame I have to read this sanctimonious shit from a company with such a terrible track record on trust.
• SilentM68 6mo ago
  That's a great step in the right direction since that happens to me all the time. But the penalty of "Manual spam action or automated demotion in Google Search results (as a 'malicious practices' spam violation)" seems a bit lenient.
• arewethereyeta 6mo ago
  20 years too late SEO fix.
• nullc 6mo ago
  Maybe there should be a policy against links that display one destination but actually go somewhere else by changing the target with an onclick event. oh wait.. that won't happen: google is the biggest offender, using that technique to surveil browsing activity.
• bartread 6mo ago
  I assume this is not going to negatively impact well behaved use of the History API to facilitate back/forward navigation within SPAs?
• youknownothing 6mo ago
  Isn't this going to break a lot of React Router navigation? Are they going to manually check every website to see if their manipulation of the history is legit or spammy?
• nixpulvis 6mo ago
  Broken back buttons have been one of my biggest complaints since we enabled SPAs to access the history API in the first place. I don't see it as a net win so far, but maybe a decade later we can solve it?
• deleted 6mo ago
  [deleted]
• wafflemaker 6mo ago
  I sometimes forget there's good people working at Google too. Sorry for every time I called Google the Satan and didn't add exception for the good people working there!