4 ms·

Great writeup. One issue... It's now suggested to use the about:blank uri in the Referer header when no referer exists, to distinguish between "there

by cyphunk 12y ago

Great writeup. One issue... It's now suggested to use the about:blank uri in the Referer header when no referer exists, to distinguish between "there was no referrer" and "I don't want to send a referrer". For the sake of privacy would it not be better if there was no such distinction. Basically now any privacy conscious services need to add 'about:blank' as the referrer when users do not want to have their behaviour categorised and fingerprinted?

robryk 12y ago
If a user doesn't want to send the referrer when there is no referrer, no referrer should be sent. This then allows sites to distinguish between direct traffic from users that don't block referrers and traffic with blocked referrers. I wouldn't expect this to be a significant concern, because the volume of actual direct traffic is not very large.
- gorhill 12y ago
  > This then allows sites to distinguish between direct traffic from users that don't block referrers and traffic with blocked referrers Any example of benefits for servers to distinguish direct traffic vs. blocked referrers?
  - sergiosgc 12y ago
    When analyzing traffic sources for your site, you could use this to remove noise created by privacy conscious users. For example, if you wish to evaluate the efficiency of a magazine add, today you can't distinguish between ad conversions and privacy conscious users. It'll take a while for clients to be compliant, if they'll ever be, though.
    - gorhill 12y ago
      > if you wish to evaluate the efficiency of a magazine ad Sorry I still don't get it. No referrer or about:blank are both "noise" in such case, I still don't see how the distinction is useful to the server to evaluate efficiency of a particular ad.
      - cheald 12y ago
        "about:blank" usually means "was opened from an external program, such as an IM client". "No referrer" means "A referrer may have existed, but inclusion of that information was explicitly declined as a part of the request". Both are useful.
    - cbr 12y ago
      Use a custom landing page url in the magazine ad that's not linked online.
TheLoneWolfling 12y ago
Yep. Yet another way to fingerprint.
kccqzy 12y ago
The standard doesn't seem to suggest that. Quote from http://tools.ietf.org/html/rfc7231#section-5.5.2 http://tools.ietf.org/html/rfc7231#section-5.5.2 If the target URI was obtained from a source that does not have its own URI (e.g., input from the user keyboard, or an entry within the user's bookmarks/favorites), the user agent MUST either exclude the Referer field or send it with a value of "about:blank". Am I missing anything?

by cyphunk 12y ago

robryk 12y ago

If a user doesn't want to send the referrer when there is no referrer, no referrer should be sent. This then allows sites to distinguish between direct traffic from users that don't block referrers and traffic with blocked referrers. I wouldn't expect this to be a significant concern, because the volume of actual direct traffic is not very large.

gorhill 12y ago
> This then allows sites to distinguish between direct traffic from users that don't block referrers and traffic with blocked referrers Any example of benefits for servers to distinguish direct traffic vs. blocked referrers?
- sergiosgc 12y ago
  When analyzing traffic sources for your site, you could use this to remove noise created by privacy conscious users. For example, if you wish to evaluate the efficiency of a magazine add, today you can't distinguish between ad conversions and privacy conscious users. It'll take a while for clients to be compliant, if they'll ever be, though.
  - gorhill 12y ago
    > if you wish to evaluate the efficiency of a magazine ad Sorry I still don't get it. No referrer or about:blank are both "noise" in such case, I still don't see how the distinction is useful to the server to evaluate efficiency of a particular ad.
    - cheald 12y ago
      "about:blank" usually means "was opened from an external program, such as an IM client". "No referrer" means "A referrer may have existed, but inclusion of that information was explicitly declined as a part of the request". Both are useful.
  - cbr 12y ago
    Use a custom landing page url in the magazine ad that's not linked online.

TheLoneWolfling 12y ago

Yep. Yet another way to fingerprint.

kccqzy 12y ago

The standard doesn't seem to suggest that. Quote from http://tools.ietf.org/html/rfc7231#section-5.5.2 http://tools.ietf.org/html/rfc7231#section-5.5.2 If the target URI was obtained from a source that does not have its own URI (e.g., input from the user keyboard, or an entry within the user's bookmarks/favorites), the user agent MUST either exclude the Referer field or send it with a value of "about:blank". Am I missing anything?