Slashdot Mirror
Several Major Browsers to Prevent Disabling of Click-Tracking 'Hyperlink Auditing' (bleepingcomputer.com)
x_t0ken_407 quotes BleepingComputer: A HTML standard called hyperlink auditing that allows sites to track link clicks is enabled by default on Safari, Chrome, Opera, and Microsoft Edge, but will soon have no way to disable it. As it is considered a privacy risk, browsers previously allowed you to disable this feature. Now they are going in the opposite direction.
Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.
The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."
Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.
The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."
Went looking for how to turn it off, article was kind enough to provide the necessary about:config setting, it's "browser.send_pings".
Firefox already has it off by default. Nice! for once.
Can't you just encase the link in Javascript and get the clicked link that way? Or do webpages not do that very often?
"First they came for the slanderers and i said nothing."
Chrome devs have removed the hidden setting while they debate promoting it into the regular settings UI. If you want this, star the bug (but don't flood the comments too much):
Issue 935978
Turned off by default in Pale Moon too.
(I checked...)
AC
There's always tampermonkey
Assuming it works... anyone got a site with these ping links?
Look folks, as long as Google has control of the browser engine source code, Google has you by the short hairs. Worse, control of the binaries as in Android. Open source or not. Not only is Firefox just an all round nicer browser to use (my opinion, if you disagree then please direct your fan mail to Larry Page) it is the only browser that gives a toss about your privacy.
When all you have is a hammer, every problem starts to look like a thumb.
No, "ping" isn't in the official HTML specification. What /. linked to is the Google's unofficial fork of HTML.
Wonder what the public key field is for?
You deranged idiots are incredible. You clearly want a police state where any person can be locked up on a whim if the "right people" disagree with them, and you think of yourselves as the "right people".
History is littered with the corpses of the victims of tyranny who themselves enabled that tyranny in the dreams of using it to oppress their political opponents.
At least the Trumpsters chanting "Lock her up!" had a list of actual violations of actual laws for which they wanter her locked up. The FBI even admitted to that list when James Comey infamously stated that "no reasonable" prosecutor would prosecuter her for her crimes, and then moments later announced that if anybody else did the same thing, that person WOULD be prosecuted. You people who've been snorting some sort of drug from Rachel Maddow or Chris Hayes or Chris Cuomo, or Don Lemon, etc have no flipping idea of what laws you imagine Trump has violated.
Morons.
More like Practically Chrome, Chrome, Chrome, and Chrome
Can I get spam with that?
Chrome and Safari are based on Konqueror, which is a KDE project. Apple always copies somebody else's code, but retains many lawyers to keep others from copying theirs.
Drafts of HTLM5 included a ping attribute on the a element for doing exactly this. Anyone with a brain could see it would be an order of magnitude more exploitable and abusable than cookies. At some point it was removed from HTML5 officially, but the W3C has gotten into a habit of modularizing things.
At least you can see where you are going. Plus you can block ping with browser extensions. Redirects not so much.
This is why Firefox is doomed if it remains a hold-out. Money from the internet comes from advertising so the major platforms are going to find a way to sideline companies the size of Mozilla that spoil the party. The surprise here is that Safari has recently disabled this feature since Apple is much less beholden to advertising interests. There's a chance that the Safari change was inadvertent, or at least wan't considered very high up the corporate ladder. With luck Apple will put the feature back.
On page link they talk about this, with
To create a hyperlink auditing URL, you can simply create a normal hyperlink HTML tag, but also include a ping="[url]" variable.
<a href="https://www.google.com/"
ping="https://www.bleepingcomputer.com/pong.php"> Ping Me</a>
To wit: Ping Me
This will render on the page as a normal link to google.com and if you hover over it, will only show you the destination URL. It does not show you the ping back URL , so users will not even realize this is happening unless they examine the sites source code. Scripts that receive the ping POST request, can then parse the headers in order to see what page the ping came from and where the hyperlink audited link was going to.
The headers associated with the information sent in the ping request are shown below.
[HTTP_PING_FROM] => https:/ www.bleepingcomputer.com/ping.html
[HTTP_PING_TO] => https:/ www.google.com/
[CONTENT_TYPE] => text/ping
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
Or go around the other way - use this to generate faked pingbacks in large volume rendering the data collected useless.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
AC, ads, always the ads.
Domestic spying is now "Benign Information Gathering"
How is the w3c version "official" if no one is following it anymore? After the XHTML debacle the WHATWG created HTML5. The w3c tries to remain relevant by taking occasional snapshots of the WHATWG standard, but they have no real authority anymore. Calling it "Google's" unofficial fork is incorrect - it was created and is maintained by a consortium of browser developers and is the authoritative reference for HTML5.
Every website and their mother was moving to XHTML, the XHTML debacle is that Internet Explorer wouldn't support the application/xhtml+xml media type. That's it. It's perfectly fine to use XHTML now that IE6 is no longer a thing.
And no, their fork is not authoritative, it's only defined for Web browsers, it lacks features required for Internet media types in general, the IETF assigned authority for HTML to the W3C in RFC2854, and the IANA still registers text/html as maintained by the W3C. https://www.iana.org/assignmen...
Wonder what the public key field is for?
w3c publishes recommendations not specifications.
"And thirdly, it is more what you'd call guidelines than actual rules." — Captain Hector Barbossa