Hacker News Reader

Your presumption is the correct way to use nofollow. If you have actual sensitive information it should be locked behind some sort of authentication.

Yes back in the day - SEO’s would “link sculpt” internal do follow links as an on-site optimization technique. The idea being to give the do followed pages all of the link juice to rank their key pages for sales/conversion etc

Seos did it to help pass PageRank to the more important pages, sure. But it’s also about not really allowing the bots to follow certain other pages like links to tags pages or other pretty much useless pages on the site. I’ve also seen people add nofollow on links to privacy policy and terms of service pages.

What you are saying is the same.

It's mainly for comments, as you want to decrease the reason for spambots to create links.