Slashdot Mirror
Several Major Browsers to Prevent Disabling of Click-Tracking 'Hyperlink Auditing' (bleepingcomputer.com)
x_t0ken_407 quotes BleepingComputer: A HTML standard called hyperlink auditing that allows sites to track link clicks is enabled by default on Safari, Chrome, Opera, and Microsoft Edge, but will soon have no way to disable it. As it is considered a privacy risk, browsers previously allowed you to disable this feature. Now they are going in the opposite direction.
Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.
The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."
Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.
The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."
Went looking for how to turn it off, article was kind enough to provide the necessary about:config setting, it's "browser.send_pings".
Firefox already has it off by default. Nice! for once.
Can't you just encase the link in Javascript and get the clicked link that way? Or do webpages not do that very often?
"First they came for the slanderers and i said nothing."
Chrome is open source, so it should be simple to patch Chromium to prevent enabling it instead, maybe even to patch Chrome.
Everybody wraps their hyperlinks with tracking code anyway.
Why ... just why....
Oh. Advertising tracking. Yeah. Blah.
"Safari, Chrome, Opera, and Microsoft Edge"?
So in other words: Safari, Chrome, Chrome and Chrome.
Chrome devs have removed the hidden setting while they debate promoting it into the regular settings UI. If you want this, star the bug (but don't flood the comments too much):
Issue 935978
Turned off by default in Pale Moon too.
(I checked...)
AC
HTTP is worthless
No! You couldn't be more wrong!
HTTPS is worthless! In fact it's dangerous. It's a bear trap. Watch out!
I couldn't have said it better. I hope he rots in hell. Pure scum.
Fucking hypocrite.
Oh please! He's a businessman. What's the big deal?
“He’s not deformed, he’s just drunk!”
Devil's advocate.... ... good.
This is exactly the motivation people need to move to different F/OSS chromium forks.
Look folks, as long as Google has control of the browser engine source code, Google has you by the short hairs. Worse, control of the binaries as in Android. Open source or not. Not only is Firefox just an all round nicer browser to use (my opinion, if you disagree then please direct your fan mail to Larry Page) it is the only browser that gives a toss about your privacy.
When all you have is a hammer, every problem starts to look like a thumb.
As a forever user of Netscape, Mozilla, FF, since forever, I give you all the 1-finger salute. I feel secure. The SJW shit needs to end soon, but I'm not switching browsers.
No, "ping" isn't in the official HTML specification. What /. linked to is the Google's unofficial fork of HTML.
Wonder what the public key field is for?
eventually cave in.
Firefox users used to be able to check a preferences box to enable/disable Javascript. There were some sites I would only visit with JS disabled first, and others where I wanted it enabled. I assumed the Mozilla team would eventually do the user-friendly thing and allow preferences to be set for certain oft-visited websites (perhaps a user-editable file listing special websites and whether to enable audi,video,popups,JavaScript and preserve cookies when otherwise clearing them) but nope - they appear to have caved to ad sellers and disabled the disabling of JS.
They seem to currently also be ignoring the option to disable popups.
The users get the browser for free, so they are NOT the customer.
The advertizers are directly or indirectly donating money to the Mozilla Foundation, so THEY are the customer and they will get what they want as soon as enough people at Mozilla decide to relax their principles.
You deranged idiots are incredible. You clearly want a police state where any person can be locked up on a whim if the "right people" disagree with them, and you think of yourselves as the "right people".
History is littered with the corpses of the victims of tyranny who themselves enabled that tyranny in the dreams of using it to oppress their political opponents.
At least the Trumpsters chanting "Lock her up!" had a list of actual violations of actual laws for which they wanter her locked up. The FBI even admitted to that list when James Comey infamously stated that "no reasonable" prosecutor would prosecuter her for her crimes, and then moments later announced that if anybody else did the same thing, that person WOULD be prosecuted. You people who've been snorting some sort of drug from Rachel Maddow or Chris Hayes or Chris Cuomo, or Don Lemon, etc have no flipping idea of what laws you imagine Trump has violated.
Morons.
How long has it been since he was a CERN employee? Long enough ago that CERN is safe from his influence?
Drafts of HTLM5 included a ping attribute on the a element for doing exactly this. Anyone with a brain could see it would be an order of magnitude more exploitable and abusable than cookies. At some point it was removed from HTML5 officially, but the W3C has gotten into a habit of modularizing things.
At least you can see where you are going. Plus you can block ping with browser extensions. Redirects not so much.
This is why Firefox is doomed if it remains a hold-out. Money from the internet comes from advertising so the major platforms are going to find a way to sideline companies the size of Mozilla that spoil the party. The surprise here is that Safari has recently disabled this feature since Apple is much less beholden to advertising interests. There's a chance that the Safari change was inadvertent, or at least wan't considered very high up the corporate ladder. With luck Apple will put the feature back.
How long has it been since he was a CERN employee? Long enough ago that CERN is safe from his influence?
So... no longer a conCERN.
It must have been something you assimilated. . . .
W3C isn't a dictatorship. It has been controlled by corporate interested for over a decade. He has commented on this for years. Maybe if you would get your head out of your ass you would know this.
How is the w3c version "official" if no one is following it anymore? After the XHTML debacle the WHATWG created HTML5. The w3c tries to remain relevant by taking occasional snapshots of the WHATWG standard, but they have no real authority anymore. Calling it "Google's" unofficial fork is incorrect - it was created and is maintained by a consortium of browser developers and is the authoritative reference for HTML5.
The reason they're doing this is not to track people more. They're doing this so more developers use the ping attribute for this functionality instead of hacky JavaScript or redirects (which prevent the user from seeing what URL the link goes to, increase navigation latency since everything ends up serialized, make it hard to copy the real URL or open the URL in a new window, etc.).
If things go as they typically do, browsers will start blocking the old behavior from working or otherwise disincentivising that behavior once enough of the internet has migrated.
Perhaps. But you can't call Tim Berners-Lee a hypocrite for something that's in the WhatWG specification and not in the W3 specification.
You clearly want a police state where any person can be locked up on a whim if the "right people" disagree with them
Isn't that every country ever? A small group of people get together and tell a larger group of people how things are going to be ... or else.
Every website and their mother was moving to XHTML, the XHTML debacle is that Internet Explorer wouldn't support the application/xhtml+xml media type. That's it. It's perfectly fine to use XHTML now that IE6 is no longer a thing.
And no, their fork is not authoritative, it's only defined for Web browsers, it lacks features required for Internet media types in general, the IETF assigned authority for HTML to the W3C in RFC2854, and the IANA still registers text/html as maintained by the W3C. https://www.iana.org/assignmen...
Wonder what the public key field is for?
Why does a user need to download and install optional stuff to make the basic functionality safe?
Script blocking used to be intgrated, and frankly it is to a certain extent a vulnerability to build into Firefox the ability for a script/plugin to make changes to a basic security function like this. By all means, allow addons to automate the loading of certain pages, or filter certain content or help manage bookmarks or the way things look on screen but allowing plugins to monkey with security issues like whether remote code will be allowed to auto-execute on the desktop is a baddie.
Also, why should only the more-advanced users get these important options? They're the ones less likely to be victimized by malware.
Oh, and another thing: with JS blocking made optional in a plugin that is vulnerable to breaking in every new release, what's to prevent click tracking to eventually be migrated to a plugin at some point and making that option also unavailable to most users (Most Firefox users do not even know what a plugin is, let alone to even look for something called NoScript and even if they knew they needed it, knew what it was called, knew where to find it, and trusted the download, the odds are insanely low that they would know all that for a click tracker.
Again, my basic question: Why was a basic security function moved into a plugin? It doesn't make things better for a user and it doesn't even make the code simpler. I'm rather big on the "Why" question - I find it often elicits very interesting things.
I wonder what would come from misleading the advertisement industry targeting their own practices.
First off this was never a major feature even some power users would have known of.
Secondly link tracking is used by web masters / site owners to know what links you click on their site.
Web masters / site owners track visitors so they can better understand them *and* improve their site.
Does Firefox Focus normally stop a majority of these? The Android version is based on webview/blink, but it has an integrated adblocker.
Tor Browser will present you with many more warnings and generally provide far more security information than Firefox. The most common are: don't maximize the browser window on a desktop, and beware of fingerprinting with the canvas element, and noscript redirect warnings.
w3c publishes recommendations not specifications.
"And thirdly, it is more what you'd call guidelines than actual rules." — Captain Hector Barbossa
why is this an HTML standard?
the standard mentions that it will increase transparancy for the user, but sure looks like a heavy price to pay.
On a long enough timeline, the survival rate for everyone drops to zero.
I follow the w3c version, so your assumption is wrong.
I would argue that any software standard not tied to actual routing of packets has no authoritative source. God didn't dictate ownership of "HTML", and whoever can convince the most people to use their standard wins by default. Crying about it won't help, they can and will say "Nanny nanny boo boo, stick your head in doo-doo".
is this the HTTP_REFERER post that alot of people watch? or something else? Google Analytics on the outs?
How did this get a +1 ?
Where the fuck were YOU to protect the Internet?
Even if anyone asked Tim about it, and they probably didn't, they don't have to do what he says.
Maybe this is a reaction to the GDPR's proposed Link Tax? Did that even make it into the GDPR?
So much freedumbs!
The HTTP Referer header (i.e. short for "referrer") is defined in HTTP (RFC7231 is the latest release). It's optional but widely-deployed, and mostly intended for intra-site diagnostics, e.g. determining which pages have bad links.
There's a few other headers with similar purposes, like User-Agent (which is also widely deployed) and From (the same header as in email can also be used in HTTP, but use in HTTP is very small, usually only seen in crawlers/robots, where the user would want to be contacted by the server admin if there's a problem.) I've never seen issues with defining such a header.
Wonder what the public key field is for?
OK, but then we're back at the IE6 philosophy of Embrace, Extend, Extinguish. That set back progress in the Web by a decade.
Wonder what the public key field is for?
Browsers were also known as "User Agents", but ever since broadband reached the mainstream consumer, there has been less and less of the "User" represented by the user agent.
The original role of the browser as a computerized representative of the visitor's choices in the exchange between the consumer and the producer is all but gone now. With the most popular sites being from conglomerates and giants who lobby or buy seats at the browser standards body now, how could this ever have been expected to ended differently?
A normal linux distro from 2003 could easily have 5 browsers if you installed various Desktop Environments from the full 4GB DVD (none of the browsers were Internet Explorer even at the hight of its imperial dominance). They were ALL open source and would have easily allowed someone to compile all this stuff out of the way. Where did they all go off to die? Complexity killed them. Low mom & pop percentages killed them. Firefox killed them (just like Chromium killed Edge)
I understood that https was supposed to be more secure, what pray tell what makes it a bear trap?