Hacker News Reader

Comment by greglindahl | Hacker News Reader

The google redirect does tracking and referer hiding. You'll want to be sure that your browser does referer hiding if you go direct to the link.

View on HN

After some testing, it appears that this plugin offers better referer hiding than Google's redirect. I've verified that it completely hides the referer, whereas Google at least reveals that you're coming from Google (which makes sense, since website owners will see this and it can encourage them to subscribe to Google Analytics so they can see some of those hidden details).

Also, referer hiding does not justify URL substitution as a result of right-clicking a link. That just forces less savvy users to give Google an additional clickthrough when all they want is the URL.

Hopefully you've verified that the referer hiding is due to the plugin and not your personal settings. That's a great feature in a plugin, since many users appreciate referer hiding being the default for search engine clicks.

Yes, good point, and it was easy to verify. Disable plugin; search "what is my referer"; click on first result: Your HTTP referer is google.ca.

Enable plugin; repeat: Your HTTP referer is No referer / hidden.

Can someone explain why my browser provides referer info at all? Why isn't this a permission I need to give away? What common features that the user needs on the web rely on it?

The RFC suggested that permissions should be asked for.

https://tools.ietf.org/html/rfc1945#section-10.13

    Note: Because the source of a link may be private information or
          may reveal an otherwise private information source, it is strongly
          recommended that the user be able to select whether or not the
          Referer field is sent. For example, a browser client could have a
          toggle switch for browsing openly/anonymously, which would
          respectively enable/disable the sending of Referer and From
          information.

Not that it should be asked for; just that it should be configurable. Subtle but important difference. Firefox is following this recommendation, but doesn't ask for it explicitly.

It's one of these things that were added once, pages started to rely on it and now nobody wants to turn it off globally because things will break. They've added ways for sites to control if/how much information is sent on outgoing links though in recent browsers.

e.g. in HN's HTML you find

    <meta name="referrer" content="origin">

which tells the browser to only send the domain, but not the exact URL.

>What common features that the user needs on the web rely on it?

- Website owners and content creators use the Referer to see where their users are coming from, which allows them to make content which is more suitable, which indirectly benefits the user.

- It helps prevent hotlinking, so it can protect small websites from getting hammered, which again could indirectly benefit the user.

I guess the point is that everyone's a "user" of HTTP, including website owners, and their interests are partly linked to yours. In an objective sense I find the standard still makes sense. In an individualistic sense, things are more complicated.

If you are using Firefox, you can disable referrer info without using a plugin. Here‘s how:

In the URL bar, type the following and press enter:

  about:config

Now search for the following entry on the page:

  network.http.sendRefererHeader

The default value is 2. Change this to 0. This disables the referrer header.

Note that some sites won‘t allow you to sign in or register if the referrer header is disabled (e.g. Pinterest), so you may have to temporarily enable the referrer header in those instances.

A final point is that this Firefox setting obviously has no effect if referral info is already appended to the URL (as is the case with Google search results).

There's also an intermediate value of 1, which AFAICS disables referer sending on requests for embedded images:

http://kb.mozillazine.org/Network.http.sendRefererHeader

Alternatively, you can instead set

    network.http.referer.spoofSource

The default value is false. Change it to true. This causes Firefox to instead submit the website being requested as the referrer; leaking no information, but breaking fewer sites.

Why is the referrer hiding important? The most that the destination page will get is what my search query is.

Many people consider that to be an important privacy leak.

To put this into perspective: I used to have a webpage which ranked quite highly for searches related to chastity belts. Do you think the average visitor would appreciate me knowing the exact search terms that landed them on my page?

Doesn't Google Analytics provide you the exact search terms that Google phished out?

Google Analytics doesn't associate search terms with IP addresses or times.

I'm sure Google does internally.

Honestly, I trust Joe Random Webmaster a lot more than I trust Google, because some small site manager doesn't already have a vast corpus of data about me.

Well, yeah, Google has logs of what what people search on their search engine.

I actually trust Joe Random Webmaster a lot less than Google. Google has a lot of power, but from past experience, I've run into many privacy issues with malicious or misguided website owners while I'm unlikely to run into a serious one with Google.

At least assuming none of their employees goes very rogue and starts leaking data en masse, or has a personal vendetta against me or something. I know something like that happened once (https://www.wired.com/2010/09/google-spy/), but the odds are probably still pretty low.

It's the aggregation of all those little bits of data into a giant profile where the risk lies.

Are you aware that the NSA used (and probably still uses) Google's data? Once you collect data in a central place you attract malicious interests.

Yes, but my adversary in that case is the NSA. Even if Google (or other similar companies) didn't exist, NSA would try to get that data one way or another.

Also, though it may be naive, I believe Google does not intend to cooperate with the NSA any more than they're absolutely legally required to.

Your known adversary is the NSA.

The NSA aren't the only parties attracted by Googles large Data are Liability stash.

That's true. Thankfully, Google has a pretty solid security team (the Chinese breach notwithstanding...).

I agree that's the biggest risk.

Not when GA is blocked like it is by any privacy-concerned individual.

I used to host a site for a local youth sports team.

Almost all the referrer logs from Google Images had search terms like "hot under 13 girls". I banned the Google Image robot from the site, since no useful visitors arrived this way.

Referrer hiding is important to Google itself: https://googleblog.blogspot.com/2011/10/making-search-more-s... Previously, some (generally scammy) websites used these keywords forwarded from Google to actually change the content.

By concealing the keywords people were searching for to land on your website, they force content hosters and ad networks to depend on the Google analytics + ads ecosystem. With these keywords, you could gather information about your Google rank for queries.

Whether it's net beneficial for you as a browser owner to pass referrer information - probably it is if you like the people hosting the content you read, as it helps them understand their traffic and improve their service. If you don't like them (probably because they are spam) then this just helps them be more effective spammers.

The refferer can be sensitive both security and integrity wise. Would you like any destination to find out that you came from any of these sites: example.com/admin/?password=xyz or gaymidgetporn.com/forum/how-to-enlarge-penis

On the other hand, if you suddenly have 100 times the traffic an image on your server got hotlinked elsewhere, wouldn't you want to know what is going on? There's upsides and downsides.. I can't really make up my mind what I'd prefer, other than the utopian option of "all users know what they're doing and how to configure their browsers".

Does it have to be so freaking long?

They have 512+ bits of various IDs and tracking data in there, that's enough to identify every person on this earth ... a bazillion times over.

Why is it so bad that a webmaster gets to know I found them through Google?

to prevent them from doing silly things like paywall blocking, except when via a google search.

Reply on news.ycombinator.com