Slashdot Mirror
Several Major Browsers to Prevent Disabling of Click-Tracking 'Hyperlink Auditing' (bleepingcomputer.com)
x_t0ken_407 quotes BleepingComputer: A HTML standard called hyperlink auditing that allows sites to track link clicks is enabled by default on Safari, Chrome, Opera, and Microsoft Edge, but will soon have no way to disable it. As it is considered a privacy risk, browsers previously allowed you to disable this feature. Now they are going in the opposite direction.
Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.
The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."
Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.
The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."
Went looking for how to turn it off, article was kind enough to provide the necessary about:config setting, it's "browser.send_pings".
Firefox already has it off by default. Nice! for once.
Can't you just encase the link in Javascript and get the clicked link that way? Or do webpages not do that very often?
"First they came for the slanderers and i said nothing."
Chrome is open source, so it should be simple to patch Chromium to prevent enabling it instead, maybe even to patch Chrome.
"Safari, Chrome, Opera, and Microsoft Edge"?
So in other words: Safari, Chrome, Chrome and Chrome.
Chrome devs have removed the hidden setting while they debate promoting it into the regular settings UI. If you want this, star the bug (but don't flood the comments too much):
Issue 935978
Turned off by default in Pale Moon too.
(I checked...)
AC
Fucking hypocrite.
Oh please! He's a businessman. What's the big deal?
“He’s not deformed, he’s just drunk!”
Devil's advocate.... ... good.
This is exactly the motivation people need to move to different F/OSS chromium forks.
Look folks, as long as Google has control of the browser engine source code, Google has you by the short hairs. Worse, control of the binaries as in Android. Open source or not. Not only is Firefox just an all round nicer browser to use (my opinion, if you disagree then please direct your fan mail to Larry Page) it is the only browser that gives a toss about your privacy.
When all you have is a hammer, every problem starts to look like a thumb.
No, "ping" isn't in the official HTML specification. What /. linked to is the Google's unofficial fork of HTML.
Wonder what the public key field is for?
eventually cave in.
Firefox users used to be able to check a preferences box to enable/disable Javascript. There were some sites I would only visit with JS disabled first, and others where I wanted it enabled. I assumed the Mozilla team would eventually do the user-friendly thing and allow preferences to be set for certain oft-visited websites (perhaps a user-editable file listing special websites and whether to enable audi,video,popups,JavaScript and preserve cookies when otherwise clearing them) but nope - they appear to have caved to ad sellers and disabled the disabling of JS.
They seem to currently also be ignoring the option to disable popups.
The users get the browser for free, so they are NOT the customer.
The advertizers are directly or indirectly donating money to the Mozilla Foundation, so THEY are the customer and they will get what they want as soon as enough people at Mozilla decide to relax their principles.
You deranged idiots are incredible. You clearly want a police state where any person can be locked up on a whim if the "right people" disagree with them, and you think of yourselves as the "right people".
History is littered with the corpses of the victims of tyranny who themselves enabled that tyranny in the dreams of using it to oppress their political opponents.
At least the Trumpsters chanting "Lock her up!" had a list of actual violations of actual laws for which they wanter her locked up. The FBI even admitted to that list when James Comey infamously stated that "no reasonable" prosecutor would prosecuter her for her crimes, and then moments later announced that if anybody else did the same thing, that person WOULD be prosecuted. You people who've been snorting some sort of drug from Rachel Maddow or Chris Hayes or Chris Cuomo, or Don Lemon, etc have no flipping idea of what laws you imagine Trump has violated.
Morons.
How long has it been since he was a CERN employee? Long enough ago that CERN is safe from his influence?
Drafts of HTLM5 included a ping attribute on the a element for doing exactly this. Anyone with a brain could see it would be an order of magnitude more exploitable and abusable than cookies. At some point it was removed from HTML5 officially, but the W3C has gotten into a habit of modularizing things.
At least you can see where you are going. Plus you can block ping with browser extensions. Redirects not so much.
This is why Firefox is doomed if it remains a hold-out. Money from the internet comes from advertising so the major platforms are going to find a way to sideline companies the size of Mozilla that spoil the party. The surprise here is that Safari has recently disabled this feature since Apple is much less beholden to advertising interests. There's a chance that the Safari change was inadvertent, or at least wan't considered very high up the corporate ladder. With luck Apple will put the feature back.
How long has it been since he was a CERN employee? Long enough ago that CERN is safe from his influence?
So... no longer a conCERN.
It must have been something you assimilated. . . .
AC, ads, always the ads.
Domestic spying is now "Benign Information Gathering"
How is the w3c version "official" if no one is following it anymore? After the XHTML debacle the WHATWG created HTML5. The w3c tries to remain relevant by taking occasional snapshots of the WHATWG standard, but they have no real authority anymore. Calling it "Google's" unofficial fork is incorrect - it was created and is maintained by a consortium of browser developers and is the authoritative reference for HTML5.
The reason they're doing this is not to track people more. They're doing this so more developers use the ping attribute for this functionality instead of hacky JavaScript or redirects (which prevent the user from seeing what URL the link goes to, increase navigation latency since everything ends up serialized, make it hard to copy the real URL or open the URL in a new window, etc.).
If things go as they typically do, browsers will start blocking the old behavior from working or otherwise disincentivising that behavior once enough of the internet has migrated.
Every website and their mother was moving to XHTML, the XHTML debacle is that Internet Explorer wouldn't support the application/xhtml+xml media type. That's it. It's perfectly fine to use XHTML now that IE6 is no longer a thing.
And no, their fork is not authoritative, it's only defined for Web browsers, it lacks features required for Internet media types in general, the IETF assigned authority for HTML to the W3C in RFC2854, and the IANA still registers text/html as maintained by the W3C. https://www.iana.org/assignmen...
Wonder what the public key field is for?
Ah, the old fashioned "I'm just asking questions, here" guy. Why? Because they made a choice. Who gives a shit why? Reality is reality. Live with it, or don't. No one cares about AC opinions
Does Firefox Focus normally stop a majority of these? The Android version is based on webview/blink, but it has an integrated adblocker.
Tor Browser will present you with many more warnings and generally provide far more security information than Firefox. The most common are: don't maximize the browser window on a desktop, and beware of fingerprinting with the canvas element, and noscript redirect warnings.
No. In a republic, a large group of people pick a small group of people and tell the small group to tell the large group what to do. The difference is significant.
w3c publishes recommendations not specifications.
"And thirdly, it is more what you'd call guidelines than actual rules." — Captain Hector Barbossa
why is this an HTML standard?
the standard mentions that it will increase transparancy for the user, but sure looks like a heavy price to pay.
On a long enough timeline, the survival rate for everyone drops to zero.
Why does a user need to download and install optional stuff to make the basic functionality safe?
Because the browser's role is to use HTTP to access a server, process the the response and render it for the user.
The user needs to understand the range of responses that may be possible and whether to process and render them or not, including potential recommendations from the server to retrieve adverts, executable code or images of kittens playing in snow.
A browser that disables Javascript by default would be rejected by most people as it would fail miserably to correctly display the websites they want to use.
why should only the more-advanced users get these important options?
Because anybody that knows and understands that these options exist and should be considered is already immediately a more advanced user.
Again, my basic question: Why was a basic security function moved into a plugin?
Because security in IT terms is not an absolute. It's a compromise. If you want to be secure switch off your fucking computer.
You want to disable Javascript with no extension? It's easy, start the developer's console, click settings, click disable Javascript.
Now, you won't have javascript enabled. Sure, it's MUCH easier with an extension, since it's one click only. Don't blame the developer for some dream/need (only) you want. The feature is present, so don't be lazy and instead of ranting, use it.
IMHO, most user wants javascript. So any sane developer will try to satisfy the majority of his users.
I would argue that any software standard not tied to actual routing of packets has no authoritative source. God didn't dictate ownership of "HTML", and whoever can convince the most people to use their standard wins by default. Crying about it won't help, they can and will say "Nanny nanny boo boo, stick your head in doo-doo".
is this the HTTP_REFERER post that alot of people watch? or something else? Google Analytics on the outs?
Maybe this is a reaction to the GDPR's proposed Link Tax? Did that even make it into the GDPR?
Because the alternative is the page uses links to itself to a page that tracks the click and then uses a redirect header to send the user to the new page (or some javascript equivalent). In doing so, the actual destination is hidden from the user.
This is sort of a compromise, the link goes to the actual page, but it pings the site to let it know for link tracking purposes.
Basically, the sites are going to track the user clicking the link either way, it's just more transparent this way
The HTTP Referer header (i.e. short for "referrer") is defined in HTTP (RFC7231 is the latest release). It's optional but widely-deployed, and mostly intended for intra-site diagnostics, e.g. determining which pages have bad links.
There's a few other headers with similar purposes, like User-Agent (which is also widely deployed) and From (the same header as in email can also be used in HTTP, but use in HTTP is very small, usually only seen in crawlers/robots, where the user would want to be contacted by the server admin if there's a problem.) I've never seen issues with defining such a header.
Wonder what the public key field is for?
OK, but then we're back at the IE6 philosophy of Embrace, Extend, Extinguish. That set back progress in the Web by a decade.
Wonder what the public key field is for?
Because security in IT terms is not an absolute. It's a compromise. If you want to be secure switch off your fucking computer.
Based on that argument...... Chrome should eliminate HTTPS certificate verification support, accept any connection presented by default, and make that an optional Add-On that has to be installed; Rejecting old versions of SSL such as SSLv3 would also be an Optional Addon similar to the option to shut off scripting... because Security in IT terms is not an absolute, and verifying TLS connections has nothing to do with processing HTTP requests.
I know. It's almost as though the browser manufacturers aren't consistent in where they choose the balance between security and providing a user experience.
You should write to them all suggesting they sort it out.