6

It occurred to me that the HTTP 'referer' header field leaks information about your browsing history.

In the flurry of recommendations and tips on how to guard your privacy / stay anonymous online that I have seen over the past year (such as the BestVPN.com list), I don't recall seeing the HTTP 'referer' header mentioned. But I could just not have been paying attention to the correct channels.

I figured that if any project would be sensitive to this kind of leak, it would be the Tor project. So, using the latest version of the Tor Browser, I created a hyperlink to the following URL on a test web page of mine:

http://www.whatismyreferer.com/

Sure enough, clicking on the test link on my personal webpage took me to that URL, and the webpage dutifully reported the HTTP 'referer' header information. It was not blocked nor obscured.

The problem is that people might visit websites that fully or partially identify them, and then follow links to sites that will then track/log the HTTP 'referer' information.

It's not clear to me how much damage could be caused by this kind of information leak, but I thought I would ask Tor experts as to whether this is a legitimate concern or not.

Improve this question

2 Answers 2

Reset to default
2

The Tor Browser design document explains:

We haven't disabled or restricted the Referer ourselves because of the non-trivial number of sites that rely on [it]

But there is a bug report that suggests to disable the refer(r)er. So the discussion of what's the best trade-of is still open.

Improve this answer
5

This was changed several years ago in ticket #3809, Remove referer spoofing support:

Referer spoofing breaks browser navigation due to an interaction with our content policy. We could alter the content policy, but that would make the toggle model even less safe, because of Firefox API limitations. Basically the fix would increase the probability that some requests might leak through from one torbutton state to another.

I am kind of torn. On the one hand, since we're don't really support the toggle model, it might be fine to make it (more) insecure. However, I don't really think the referrer blocking feature is very useful, and I am planning on removing it in the next major release.. So to break it for this reason seems kind of silly.

Hence, let's hide the referer spoofing option, demoting it to an about:config pref only, to prevent people from breaking their TBBs with it.

We will remove the pref entirely in a future release.

Improve this answer
3
  • Thank you for your fast answer. What does "interaction with our content policy" mean? What is a "toggle model"? Can you adapt your answer so that it addresses more 'why' (rather than 'how') this behavior is the best design? Currently the answer seems to require TOR-devel knowledge of terminology in order to be understood.
    – taltman
    May 14, 2014 at 21:48
  • Well I'm afraid I don't quite understand all the terms there either. I just remembered that this changed a while ago, so I searched google and found the relevant ticket. I included it here because you didn't seem to have known about that.
    – Greg Hewgill
    May 14, 2014 at 21:57
  • Is this the argument? One, spoofing the referer header is pointless, because it's been superseded by other ways to track referer. Two, spoofing the referer header breaks TBB. Yes?
    – mirimir
    May 16, 2014 at 1:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .