News for hackers. Stuff that matters.

A comment on Firefox 59 to strip path information from referrer values for 3rd parties. Parent comment

Re:Firefox 59 to strip path information from referrer values... by groovecoder on Thursday February 01, 2018 @10:09PM (#16288095)
Disclaimer: I'm the Firefox engineer who wrote the patch and the post.

We did a user research study measuring website breakage under various privacy protections:

https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...

tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we started by implementing this protection in Private Browsing.

However, note that some advertisers demand that AdTech vendors must not serve their ads on certain kinds of pages. (e.g., https://support.google.com/adsense/answer/1348688?hl=en&topi...) Many of those agreements require full referrers to be able to audit the ad inventory.

So there are some concerns and trade-offs to make in this space.

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by rrcaptain on Friday February 02, 2018 @04:27AM (#16289412)
In all seriousness: why should we care what ad companies want? Mozilla makes a browser, not an ad platform. Advertisers may have to adapt, but that's their problem.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by paulie_a on Friday February 02, 2018 @06:22AM (#16289755)
In my opinion Mozilla should be actively hostile to ad companies, and go out of their way to ruin metrics
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by gregknicholson on Friday February 02, 2018 @06:36AM (#16289803)
I don't think that's a good tactic. Google and other ad companies have plenty of money to spread disinformation against Mozilla, if they wanted to.

If Mozilla's users are saying “yes, this is good; please do more”, Mozilla can use that as a defence against any resistance from advertisers.

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by narag on Friday February 02, 2018 @11:47AM (#16291955)
Then it would be better if Mozilla remains closer to neutral but leaves maximum space to the user for custom configurations, maybe using extensions.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by jdavis703 on Thursday February 01, 2018 @11:00PM (#16288307)
Many of the ad serving SDKs slurp up all this data anyways and send it down using a request body, query string, or something that isn't the "Referer" HTTP header. I'm not sure how ad verification providers get this data, but if anything it's just going to mean less information leaking out from systems like DFP to the smaller ad tech firms. But firms like Google will still be able to figure out what path you were on.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by sleavey on Friday February 02, 2018 @02:27AM (#16289012)
Why don't websites just remove ad code from pages they don't want ads to appear on, instead of telling the ad server to not display it on such pages by using the referrer information? Seems like a convoluted way to solve the problem.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by groovecoder on Friday February 02, 2018 @08:40AM (#16290402)
https://lists.w3.org/Archives/Public/public-webappsec/2014De... is a good run-down of referrer uses from the AdSense perspective.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by fiddlerwoaroof on Friday February 02, 2018 @03:03AM (#16289148)
No, the advertiser doesn’t want their ad to appear on a certain publisher’s web page (e.g. banks often can get in trouble if their ads are associated with certain kinds of content).
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by sleavey on Friday February 02, 2018 @03:25AM (#16289227)
Ah ok. But why then doesn't the ad's embed code just contain the URL of the page it's on in the query string / POST data? The (website that shows the ad's) server knows what page it is providing.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by andrewaylett on Friday February 02, 2018 @04:48AM (#16289486)
I suspect it does? But that's spoofable by the ad aggregator in a way that the Referer header isn't. So much of ad design is (for better or occasionally for worse) defending against bad actors.
[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by proactivesvcs on Friday February 02, 2018 @12:06PM (#16292132)
Thank you for your efforts. Features such as this are appreciated by, I'm sure, many of your users. It's a shame that the slating Mozilla has had recently hasn't been met by praise for work like this.
[ Parent | on HN ]