[537] in cryptography@c2.net mail archive
Re: SSL weakness affecting links from pa
daemon@ATHENA.MIT.EDU (sameer)
Mon Apr 14 16:35:41 1997
From: sameer <sameer@c2.net>
To: tomw@netscape.com (Tom Weinstein)
Date: Mon, 14 Apr 1997 12:42:40 -0700 (PDT)
Cc: toto@sk.sympatico.ca, stewarts@ix.netcom.com, AGRAPA@banamex.com,
markm@voicenet.com, cypherpunks@toad.com, cryptography@c2.net
In-Reply-To: <3351F2DF.7DC26A1A@netscape.com> from Tom Weinstein at "Apr 14, 97 02:03:27 am"
> information. This is a security hole in the web site, not in the
> browser. The browser follows the HTTP specification. If you have a
[. . .]
>
> In the eyes of some, the referer header is a privacy violation. It
> allows a site to see what site you visited before coming there. In the
> case of Navigator, we ONLY send the referer header when you click on a
> link. Not when you select a bookmark. Not when you type a URL into the
> location field. This allows web sites to see who links to them. I
> think that's something that a web author is entitled to know.
GET forms aren't the only thing wrong with referer, btw. An
associate of mine discovered some prioprietary Netscape information
from the Referer: headers on hits to his website from Netscape
employees, even.
I commend Netscape for providing users with the ability to
turn off referers.
--
Sameer Parekh Voice: 510-986-8770
President FAX: 510-986-8777
C2Net
http://www.c2.net/ sameer@c2.net
