Hacker News Reader

Comment by jabbany | Hacker News Reader

The real shame is why the linked page even gets referral information at all (and why we cannot disable it on a browser)...

I'd love to have a browser setting to just completely disable "Referer:" headers and blank out `document.referrer`. Like, clearly hosts can control referral information to high granularity (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...) but why can't users... (actually apparently you can set this for Firefox)

View on HN

At least for cross-domain URLs. Within a domain I could understand context, back buttons etc being useful.

firefox has 'network.http.referer.XOriginPolicy' to send referer depending on domain

0 - no restrictions (default), 1 - base domain match, 2 - fqdn match

Useful how? Within a domain/origin you can already track/control this stuff with a plethora of things: cookies, URL params, localStorage, JS access of history to implement fancy back behavior...

Exactly, so it isn't a security/privacy leak, so there's no harm in leaving it on.

No, the other forms require sites to opt-in whereas this just sends the information whether the site wants/needs it or not.

There is plenty of harm in just this fact alone, because tracking via the other methods is transparent: you know sites are doing internal tracking if you see them being used. With referral information sent by default you have no idea whether the site uses the information or just ignores it.

Either way the important thing shouldn't be how much referral information should be sent (because clearly people disagree on that). Rather all browsers should let you customize this if you want to.

I agree. I’m surprised Safari of all browsers doesn’t at least provide an option to obscure this.

Reply on news.ycombinator.com