Firefox 87 trims HTTP Referrers by default to protect user privacy

But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.

EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.

https://www.jwz.org/blog/2021/03/cursed-keyboard-image/

I hate sharing Amazon shopping links because Amazon packs much referrer as possible in the link. Amazon uses the referrer to track who am I sharing to and use it for data for them to sells.

How can you tell it's Monday morning on HN?

Someone starts pontificating, "I don't use this, so there is no conceivable reason that anyone else on the planet should ever need this ever!"

See also: Half of StackOverflow questions.

I don't know how commonly it would break that flow, but it certainly could depending on implementation details that are not narrowly prescribed by the OAuth2 spec.

For example you might not know that important site X linked to you and is driving Y% of your audience. You are not necessarily interested in the individuals following the links when you discover that.

The only reason I can see Google still doing rewriting is to protect very old browsers and laziness.

/s ?

(not that firefox doesn't have lots of phone-home behavior you can't turn off like firefox.settings.services.mozilla.com)

1. Chrome, as the dominant browser, drives developer behaviour (devs need to change their websites when Chrome breaks compat). Firefox doesn't have this luxury, so some features like this must necessarily be lead by Chrome in the monopolistic browser world we live in.

2. Referers allow websites to individually track users better, which is bad for user privacy if you are concerned about entities such as Facebook, etc. tracking you. However, those entities are Google's competitors; for Google, Chrome does the tracking, so they have no need of the Referer.

Removing it is "good" for user privacy w.r.t. Google's competitors, and simultaneously good for Google (disadvantaging such competitors).

At the time I'm writing this, there are 740 upvotes and 187 comments on this story vs. 12 upvotes and 0 comments for the top submission when Chrome made the same change [1]. Without the FYI, I would have assumed this was Firefox leading the way in privacy because I was simply unaware that Chrome had done it.

[1] https://news.ycombinator.com/item?id=24008516

    # 1. Apache conf
    Header set Referrer-Policy "no-referrer-when-downgrade"
    <!-- 2. meta HTML head with same effect [2] -->
    <meta name="referrer" content="no-referrer-when-downgrade">
    <!-- 3.  HTML anchor attribute -->
    <a href="https://…" referrerpolicy="no-referrer-when-downgrade">

(Funny all three have different spelling, and that in effect they direct value of a single HTTP header with inherently erroneous spelling.)

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... [2] my guess using `<meta http-equiv="Referrer-Policy" content="no-referrer-when-downgrade">` should do the same, but is not explicitly mentioned anywhere. [3] https://w3c.github.io/webappsec-referrer-policy/

No ordinary user wants to deal with that much complexity.

Except that's already here, or in the making, i.e. with those advertising eye-tracking stories that make the rounds every 6 months or so.

A lot of places will attach unique discount codes to advertisements to get an idea on where you came from.

For example, on a TV commercial it might say use promo code COOL123 to save 10% or if you saw that billboard it might say to use NICE123 instead. Then there's radio, newspapers and so on each with their own unique code that offer the same 10% discount.

And since a discount is applied chances are you'll use it because not too many folks would purposely avoid the discount to hide where you discovered the shopkeeper from.

You often see this being done online too, but there's also things like UTM tags or unique URLs that let you do the same thing without discount codes. It's not to make more money as a shopkeeper (avoiding the discount), it's just easier to set up. Using a UTM tag is a matter of creating a link with a few query parameters. Creating a specific discount code or a unique URL for a specific promotion takes a bit of extra leg work.

I'm not sure where I stand on the movement to remove all forms of referral tracking. Both referral headers and UTM tags can be spoofed or removed through extensions so using them as any type of source of truth was a bad idea anyways.

However, as someone who sells digital products I like knowing which specific video or blog post helped someone discover some of my paid content. But at the same time, the end game is really "is the needle moving forward?" so the specifics kind of don't matter. But in the short term while you're figuring things out, the extra info does help you focus on where to spend your time. Not just for more profit, but to provide better and more free content because it's what folks want.

But the shopkeeper knows if you came in through the street entrance (maybe saw the window display), through the mall entrance (maybe saw the sandwich board), or through the communicating door to the next shop (maybe saw the merchandise).

People are usually happy to tell us; but then we only use that information to run our business better, we don't sell it.

Another technique is referral bonus, "recommend a friend" type offers.

Is this really a security feature though? Or is it Google keeping the important information for themselves?

https://addons.mozilla.org/en-GB/firefox/addon/clearurls/ in case anyone else has also not seen it.

The server shouldn't get information about the client.

Unsurprisingly, UACH is spearheaded by an ad tracking company that benefits from a moat caused by minimally viable/workable browsers costing millions of dollars and dozens of developers to implement.

Compatibility, probably. There are some sites which fail to load or end up in redirect loops if the Referer header is missing. It's not just minor sites, either. The last time I tried blocking Referer headers—just the third-party ones—it broke Google Hangouts (both the Chrome extension and the web version). That was earlier this year.

That is because they are. Mozilla cannot survive without internet advertising, and they sacrifice the privacy of Firefox users in exchange for funding from an advertising company, Google.

Anyone who is serious about internet privacy knows it requires some amount of vigilance. It necessitates some amount of inconvenience. It is not simply a matter of software selection. AFAIK, no third party today is going to take on full responisibility for any user's privacy. You never see Mozilla advocating for user vigilance, yet the fight for internet privacy is the user's, not Mozilla's. The message from Mozilla is something like "If you use Firefox, we have you covered." This encourages inaction more than action. That's good for companies like Google.

If Google paid a group of users the millions it pays the group working at Mozilla, I doubt those users would care one iota about "privacy". Their own, or anybody else's. Why bite the hand that feeds you.

I only send Host and Connection headers for GET and Host, Connection, Content-Length and Content-Type for POST. For me, this works beautifully for 100% of websites posted to HN, and elsewhere on the www. I can easily create exceptions in the forward proxy configs to send Referer to sites that require it. This never happens, IME.