Google Webfonts, the Spy Inside?

Re:Google Webfonts, the Spy Inside? by MichaelGG on Friday February 20, 2015 @07:57PM (#9084151)

A simple "noreferrer" (or referer if you like) tag on elements or in pages would solve a lot of this. 3rd parties would obviously still get the request, but they wouldn't know what page it comes from.

Interesting that "norel" got adopted so quickly for spam. So it shouldn't be hard to have a "noreferrer" tag added, right?

Yes, users can install addons to modify header behaviour, but site designers should be able to use third parties without disclosing things, too. Not just privacy, but security. Currently, apps need to implement a bouncer page to hide sensitive referrers.

[ Parent | on HN ]

Re:Google Webfonts, the Spy Inside? by petercooper on Friday February 20, 2015 @09:04PM (#9084365)

So it shouldn't be hard to have a "noreferrer" tag added, right?

It's so not hard that it's actually already a part of HTML5 and supported by several browsers :-) http://www.w3.org/TR/html5/links.html#rel-noreferrer

[ Parent | on HN ]

Re:Google Webfonts, the Spy Inside? by MichaelGG on Friday February 20, 2015 @09:18PM (#9084395)

Seems like it isn't on link, image, or script elements though, which is the way most third party content gets loaded.

[ Parent | on HN ]

Re:Google Webfonts, the Spy Inside? by cromwellian on Friday February 20, 2015 @08:24PM (#9084244)

I like this proposal. Although as you say, it only cuts the direct link between the site and the resource.

[ Parent | on HN ]