Hacker News Reader

Comment by hannob | Hacker News Reader

Just a FYI because some people are complaining that Mozilla is doing something evil or will break all of the web or something. Chrome made the same change a while back:

https://developers.google.com/web/updates/2020/07/referrer-p...

So if this breaks something people probably already noticed. And Mozilla is merely aligning with the browser with the largest market share on this. (Also everyone who wants something different for their sites, it's configurable: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... )

View on HN

Your FYI is also useful for the contrapositive of that feeling, which we often see on HN: "Look how Firefox is leading privacy improvements and how much more privacy forward it is than Chrome".

You see, when Firefox improves privacy it's for the good of users, but when Chrome improves privacy it's because Google can track you just fine despite the change and they want to give competing ad networks a kicking.

/s ?

I mean, that can be true, no? Google does have many ways of tracking you and blocking others from doing it while still doing it themselves certainly helps them maintain their moat.

AMP is a pretty good example of this. Good for Google, reduces tracking (by anyone but Google), bad for everyone else.

Both browsers are funded mainly by the same source, so in the end changes in any of them is Google’s move anyway.

>You see, when Firefox improves privacy it's for the good of users, but when Chrome improves privacy it's because Google can track you just fine despite the change and they want to give competing ad networks a kicking.

/s ?

Given that Firefox improving privacy generally doesn't draw antitrust scrutiny, where is the problem with that statement?

>The questions from Justice Department investigators have touched on how Chrome policies, including those related to cookies, affect the ad and news industries, four people said.

Investigators are asking whether Google is using Chrome, which has 60% global market share, to reduce competition by preventing rival ad companies from tracking users through cookies while leaving loopholes for it to gather data with cookies, analytics tools and other sources, the sources added.

https://www.reuters.com/article/us-tech-antitrust-google-exc...

If Google were truly improving privacy, one would expect their changes to decrease their own ability to track users, not just their competitors.

But doesn't chrome have baked-in identification?

(not that firefox doesn't have lots of phone-home behavior you can't turn off like firefox.settings.services.mozilla.com)

Exactly. In FF, one of the first things I always do is turn off "Firefox Data Collection and Use" in the Settings.

True, but this case contains a little more complexity. Namely:

1. Chrome, as the dominant browser, drives developer behaviour (devs need to change their websites when Chrome breaks compat). Firefox doesn't have this luxury, so some features like this must necessarily be lead by Chrome in the monopolistic browser world we live in.

2. Referers allow websites to individually track users better, which is bad for user privacy if you are concerned about entities such as Facebook, etc. tracking you. However, those entities are Google's competitors; for Google, Chrome does the tracking, so they have no need of the Referer.

Removing it is "good" for user privacy w.r.t. Google's competitors, and simultaneously good for Google (disadvantaging such competitors).

It seems that the solution to the “complex” scenario you’re describing is simple: use Firefox instead of Chrome.

It’s only simple in the sense that it takes few words to say, but then world peace is also simple: just stop having wars.

Do you really think the two are in any way comparable?

It's a web browser.

It's an analogy.

Still easier said than done. There are still many websites that break in weird ways because the developers don’t care about Firefox.

I myself religiously use Firefox by default and only use Chrome if I bump into some websites don’t work in Firefox. But my kid’s teachers often send links that my kid needs to use for school work. And a lot of them are educational websites that don’t work in Firefox. I can’t be home all day to provide tech support. So having Firefox as the default browser is simply a no-go. Guess what wins, between Chrome and Firefox?

> Still easier said than done. There are still many websites that break in weird ways because the developers don’t care about Firefox.

I read a lot of people saying this, but I use Firefox and I don't run on this issues, except when I land by accident on some weird dark pages (mainly porn pages)

As developer, I develop on Firefox, and sometimes do a quick test on Chromiun/Edge/Chrome to see if something it's break or bugged on Chromiun/Edge/Chrome web engines.

Literally nothing about the scenario described above will change, except that it will give Firefox the option to make the change before Chrome does.

Your answer takes Google's POV into account (the "why"), but the GP was mentioning the end result of firms' intentions (the "what"). In other words, it doesn't matter why google needs to or wants to implement some features. What matters is that those features are implemented in Chrome and yet they don't get praised on HN. But if Mozilla adds the same features, HN folks go crazy about it.

I'm a happy Firefox user too, but I don't want to believe that Firefox is the only browser that cares about user privacy.

> I don't want to believe that Firefox is the only browser that cares about user privacy.

I don't either, but I don't believe HN users praising Chrome is going to help with that situation...

I think the parent comment's point is that Firefox is worth celebrating because they're making this (and other changes) with no ulterior motive other than championing user privacy. But with Chrome, the user privacy improvement is a biproduct of Google making profit-oriented decisions, and not the focal point of their change.

I'll happily celebrate Google making a privacy-oriented change that's actually intended and not a bi-product, but this isn't such a case.

We can guess Google's motivation but no source.

> Removing it is "good" for user privacy w.r.t. Google's competitors, and simultaneously good for Google (disadvantaging such competitors).

And how does Mozilla make money?

Google paying it.

Out of Chrome and Firefox, one is one big level of indirection further away from Google's influence than the other.

No. Mozilla Corp is a separate entity from the Mozilla Foundation, and Google pays Mozilla Corp. (The arrangement with Google is exactly why Mozilla Corp is a distinct thing from the Mozilla Foundation: it means profits to Mozilla Corp can't influence the Mozilla Foundation.)

Mozilla Foundation is purely a donation-fed nonprofit, and most things you associate with "Mozilla" are made by the Mozilla Foundation. In fact, even Firefox itself — the open source project — is made by the Mozilla Foundation.

Mozilla Corp is just a company that employs engineers to work on Firefox. (I.e. their job is to be ordinary FOSS contributors to the project.) Those engineers might have a profit motive to do things Mozilla Corp investors/shareholders like, but that's fine, because those engineers mostly aren't part of the Firefox steering committee. The Firefox steering committee (along with all other Mozilla projects) is composed of people who are employed by the nonprofit Mozilla Foundation; and/or FOSS people external to Mozilla as a whole.

(ETA: fixed the names. I originally called Mozilla Corp "Firefox Corp" — and it really basically is, as Mozilla Corp doesn't employ people to work on anything other than Firefox. IMHO "Firefox Corp" would be a strictly-better name for it.)

You're close, but there's no "Firefox Corp".

From Wikipedia: "Mozilla [...] is a free software community founded in 1998 by members of Netscape. [...] The community is supported institutionally by the not-for-profit Mozilla Foundation and its tax-paying subsidiary, the Mozilla Corporation."

A distinction without a difference, since the same people lead both organizations.

This comment misses one glaring point: Mozilla Foundation does not fund Firefox development.

There's three entities:

- Mozilla Foundation: accepts donations and spends them on web initiatives, does not spend them on Firefox

- Mozilla Corporation: is owned by Mozilla Foundation, employs Firefox devs, has search deals with Google

- Firefox software: is developed by Mozilla Corporation, is funded by search deals

Through royalties and donations[0]. You say this like something nefarious is going on. But also consider that Mozilla has a net income of 90 million/yr[1]. The income levels between these two companies are extremely different and thus they can operate in different ways and under different conditions and saying "how does x make money" and not taking this into account is just a bad question. Their goal isn't to be Google and to be a trillion dollar company.

[0] https://www.investopedia.com/articles/investing/041315/how-m...

[1] https://en.wikipedia.org/wiki/Mozilla_Corporation

This is technically correct as the commenter asked "How does Mozilla make money?", but I suspect they were really enquiring how Firefox is funded.

Many people are a bit shocked to learn Mozilla Foundation does not fund Firefox. Firefox is funded by search deals (mostly by Google); Mozilla spends donations elsewhere.

> for Google, Chrome does the tracking, so they have no need of the Referer.

Source?

Afaik, Chrome does not the tracking. Or do you have some source?

In the event that such behavior would occur, it can be detected by sniffing your packets, and people would very soon speak about it.

Someone shared this with me earlier today, funny enough [1]. They track you quite thoroughly and link the collected data, including browsing history, to your identity. It's actually much worse than just browsing data, though [2].

1. https://www.forbes.com/sites/zakdoffman/2021/03/20/stop-usin...

2. https://specials-images.forbesimg.com/imageserve/6055073241c...

I think it's the classic "help enhance user experience" opt-out (usually prompted when you first open Chrome) that was weirdly not done here.

It's accessible even afterwards on chrome://settings/security

Chrome does a lot of tracking. This seems obvious enough that I would reply by asking: do you have a source demonstrating that it does not track?

However there are many many many sources out there documenting Chrome's comprehensive tracking:

- Google's own ToS is probably too long to read, but it lists ways in which you consent to be tracked by the browser

- Google's proposals to the W3C for adding new ad-tracking tech to web standards go into detail on Chrome's own mechanisms for doing this tracking as a PoC example [0]

- Chrome isn't technically available on iOS; they are forced to use Safari's engine under the hood of iOS Chrome, which restricts in some ways the amount of tracking the browser can do. Despite this, the list of data tracked by iOS Chrome is listed on the AppStore download page and IT IS LONG.

Finally, you mention packet sniffing. In actual fact, direct packet sniffing has been made non-trivial by cert-pinning. This doesn't however prevent checking the frequency and destination of app phone-home requests, and yes, Chrome does it a lot. You can see this yourself if you use common user firewall tools such as LittleSnitch/LuLu/OpenSnitch/etc.

[0] https://github.com/WICG/floc#qualifying-users-for-whom-a-coh...

Ok it looks like you're right that by default a lot of tracking is done.

However the link you provided shows that in "Google Activity Controls" and "Google Ad Settings" the user has the possibility to completely opt-out of this tracking.

If privacy-minded users are fully aware of all of these options, that may be fine for them? (spoiler: I was NOT aware of all!)

The link provides (pretty convoluted) details on how to opt out of one very specific type of tracking that Chrome does.

There are other options in Chrome's settings that may allow you to further opt out of other types of tracking, if you can discover them.

These settings aren't documented simply or centrally by Google and can change with each release (releases are extremely frequent).

Then there are types of tracking that can't be disabled as Google classifies them as "legitimate interest" or required for certain functions of the browser (one particular example here that comes up often is the collection of wifi ssid data for geo apis).

Anything that's on by default will always be unmanageable even by most technical users. We need a browser that doesn't track by default. Otherwise, you must typically assume you are being tracked (this goes for Firefox as well, though I think we can at least assume less data is tracked in firefox and is slightly easier to opt out)

Google consistenly tries to make it harder for their competitors to grab user data.

It's also useful for recognizing how preconceived notions and biases influence upvoting behavior and by extension what gains visibility on the front page, further reinforcing those biases.

At the time I'm writing this, there are 740 upvotes and 187 comments on this story vs. 12 upvotes and 0 comments for the top submission when Chrome made the same change [1]. Without the FYI, I would have assumed this was Firefox leading the way in privacy because I was simply unaware that Chrome had done it.

[1] https://news.ycombinator.com/item?id=24008516

I didn't realize this, thanks for pointing it out.

I thought, wait, but how is this feature in my own app still working with chrome then! Aha, Chrome only trims referrer for cross-origin requests.

Is FF the same?

Looks like... yes! "…will also trim path and query information for all cross-origin requests."

Good for both Firefox and Chrome.

Does this mean Gmail can stop rewriting links in emails (ostensibly to derefer)?

Presumably no because they also probably use it for analytics and/or security (blocking malware URLs)

Indeed. If not sending referer was the only reason, gmail would never have needed to rewrite the link since it could've just used `rel=noreferrer` on the original anchor tags instead.

I'm pretty sure they could have done this years ago as most browsers supported setting the policy explicitly for years. This only changes the default policy.

The only reason I can see Google still doing rewriting is to protect very old browsers and laziness.

Are there any extensions that can rewrite these in the meantime?

Not using gmail works

I wrote Intercept Redirect to skip these redirect services. It doesn't change the URLs that appear on sites but intercepts the requests and instantly redirects them to the intended URL. It also requests the are minimum of permissions and collects no data.

Seems to work well, you should directly link to the Firefox extension

Thanks for trying it out and leaving a review. It's available for most browsers at https://intercept-redirect.bjornstar.com

does gmail rewrite links? AFAIK it's not rewriting any of the links in my emails. Maybe I have some setting or environment where it doesn't

why tf should removing Referer break sites? who uses Referer?! the only thing that Referer brought were privacy leaks.

I recently had to enable it for some login to work, unfortunately can't remember which website.

I've had to enable it for Atlassian's login to work.

I turned it off once and the most common breakages were usually authentication that involves some kind of OpenID delegation.

Yeah, we (Azure AD) got a couple of "login is broken" escalations when Chrome made this change. A couple vendors use it to validate a request is coming from the upstream IDP, to block drive by attacks I assume.

Some websites would whitelist referrers to prevent hotlinking resources from other websites (incurring potentially high bandwidth costs).

But overall I'm all for getting rid of it. It's a remnant of the early web that doesn't make a lot of sense these days, and creates more problems than it solves.

EDIT: Although I just realized that strict-origin-when-cross-origin (the new policy) would still let the hotlinking detection use case work, since you typically only need domain information for that. I initially thought that they would use same-origin or something like that. It'll teach me to comment before I read the linked story.

VictorOps uses referrers as a "security measure" on login. So I just have a separate profile of firefox without my antireferrer addon

> VictorOps uses referrers as a "security measure" on login.

Using the referrer header as a security and privacy measure is prevalent among service providers. Vimeo even hilariously charges for this feature which is trivially bypassed; and I'd reckon their paying customers aren't even aware of it: https://vimeo.zendesk.com/hc/en-us/articles/224819527-Changi...

Talk about smoke and mirrors.

Maybe they advertise it as a security feature but it's still a good way to prevent unauthorized hotlinking that burns your vimeo bandwidth, costing you money (assuming it does indeed prevent random websites from embedding your videos).

This reminds me of some vague memories of a time long ago where some websites had a secure login page that asks for a username&pw but every other page after just checked the referall header. It wasn't a very secure system and people shared the header values needed to bypass logging in.

That's basically a degenerate form of capability-based security. Sharing the referrer header is delegating access rights. Of course, that's not actually a property you want in this case.

I've started to see quite a bit of that on websites dealing with transfer of medical data. I figured it was probably some sort of an effort to handicap MITM potential of impostor websites that were trying to steal credentials. My theory is that it might be some sort of a tripwire for the website to detect fishiness and lock the account.

Twitter does this and more

I can't think of a single use case where a user would want a target site to know where they came from. Put that in the URL or something less nefarious if you want to communicate state.

Twitter have started doing this via their embed widgets/scripts.

I want some news sites to think I came from Google, because they will give up whole articles that are otherwise paywall-blocked. It's a dark SEO trick.

I believe jwz rather famously does. Let's see:

https://www.jwz.org/blog/2021/03/cursed-keyboard-image/

His use only needs the domain, so should be unaffected? That said, something from my browser, probably ETP strict mode, appears to be stripping out the referrer entirely already anyway.

I'm not following that on the assumption is he the guy that shows HN users the goatse image?

If so then please mark your link up as NSFW/NSFL.

It's not goatse, but it is NSFW.

Not goatse, and I wouldn't consider it to be NSFW, but some folks might. Apologies for not marking it; I've missed the edit window.

jwz has got a rather ... interesting use case for it relating to HN

And slashdot before that.

Ah jwz did this for /. too? If he did then it seems like he has switched it off, because I cannot reproduce it

I just tried to find references to it, but couldn’t. I’m wondering if my memory is broken. Slashdot is old though, we used to get worked up about bugs in X11 screensavers, and GNAA trollers.

It was a somewhat common “security” feature to check referer, especially in the days before you could rely on CSP.

The first thing I thought of was when you go to a URL but it requires a login so it redirects you to the login page but then redirects you back to your original page after you login. Pretty sure it’s easily remedied without referer but that was the first thing I thought about.

If the login is on the same site, this change won't affect that, as this change only applies to cross-original requests.

that is a security issue on it's own. you should never have an openredirect bug, that's why openid servers need to store redirect uris somewhere and validate them.

Some ad networks use(d to use) referers for brand safety when resource serving an ad is embedded iframe. For example if the parent URL contains "osama-bin-laden-killed", don't display ad about nice family moments together (or anything else, likely)

Or keep track of your internet history to have a more accurate profile of you. This is not a good thing and it's precisely why it's a privacy leak.

Some sites use referrer as their "cookie session". One site use Cloudflare Anti-DDOS referrer as their cookie. Removing that referrer will cause the browser to infinity loop in CF Anti-DDOS because the site is expecting that referrer before entering the site.

I hate sharing Amazon shopping links because Amazon packs much referrer as possible in the link. Amazon uses the referrer to track who am I sharing to and use it for data for them to sells.

Are you conflating Referer with URL parameters? (Amazon calls them "ref tags" (referrer tags) but that's not HTTP Referer. It's not even possible to do what you are imagining with HTTP Referer, since Referer is only inside a browser session, not across from you to your friend.

Dang it, I didn't realize it was specific to HTTP. Thank you for pointing it out, all I see referrers (I somehow blank on HTTP) and I thought it was about the referrer tags.

who uses Referer?!

How can you tell it's Monday morning on HN?

Someone starts pontificating, "I don't use this, so there is no conceivable reason that anyone else on the planet should ever need this ever!"

See also: Half of StackOverflow questions.

Well, who does?

pcpartpicker does

And likewise, the other sign it's Monday morning is when someone starts pontificating "this exists for some reason, so there must be someone using it for non-malicious purposes".

Which very well might be true, but that was exactly the question: who?

I use it to understand which site or link the user used to find an outdated link on our site. It's very helpful to know how he got there because often the references to that obsolete link are all purged in the code but somewhere deep inside the database or CMS somebody still put a link to the obsolete page.

well you can turn the header off pretty easily and you won't see many sites are breaking (alexa top 100), of course some wierd sites think it's important to use it, but because of the madness of referer there are so many things that will leak your privacy extremly, it came to the point that it's necessary to have extensions to remove the header or at least inject noreferer into a tags.

Referer is an important way to maintain the security of an OAuth flow.

I don't know how commonly it would break that flow, but it certainly could depending on implementation details that are not narrowly prescribed by the OAuth2 spec.

no referer is an important way to screw your security in an oauth2 flow. with oauth2 a correct configuration would be Referrer-Policy: no-referrer and enforcing a secure state param and csrf.

> Referer is an important way to maintain the security of an OAuth flow.

How? Referrer can be easily spoofed.

The scenario is that the user is being phished with an uncompromised, modern browser. The idea is that if the attacker doesn't have control of the browser, they can't spoof the referer.

Isn't it also sort of useful information for site owners even if they are not maliciously slurping your private information?

For example you might not know that important site X linked to you and is driving Y% of your audience. You are not necessarily interested in the individuals following the links when you discover that.

This change only trims the referrer string, it doesn't remove the origin domain info. You can still tell that "important site X linked to you and is driving Y% of your audience." You just wouldn't be able to get any more granular than that.

We use them to prevent other websites to hotlink our dynamic map tiles. Not a big protection of course but useful anyway.

Loads of cashback systems use it. You get directed to Lieferando or whatever and the "click" is registered using the referrer.

there are other ways to do the same, like a URL parameter. Referrer affects the privacy of everyone and the entire web. The fact that cashback systems for some small subset of internet users will be affected (and they have alternatives like URL parameters, they did not need to use referrer) is irrelevant.

And to note the obvious... the companies that you might think would be most opposed to it (e.g. facebook, google) really don't care because their page tracking hooks are omnipresent so they're not missing out on any precious meta data.

Yeah, I was gonna say; isn't this part of the spec? Seems like it is; at least in the latest editor's draft: https://w3c.github.io/webappsec-referrer-policy/#default-ref...

That doesn't appear to be accurate in Chrome, in 89 I am getting no-referrer-when-downgrade.

For example, I clicked a link on old reddit and saw the full referer being sent to another origin.

Ah, that explains why the old "come from Google" trick for bypassing paywalls stopped working a while ago.

This doesn't change my opinion. This is like saying, "The soviet union gulags their people too and did it first. It's fine."

Whataboutism re: corporate control of web standards.

That's probably because if you run Chrome, you're already Google's executable on your system. I mean they can track you using gazillion of other, more precise meanings and this is something they shut it to keep the pie for themselves. I do not use Chrome anymore, switched to Firefox a year and a half ago - best decision ever.

Reply on news.ycombinator.com