SSL weakness affecting links from pa
sameer
sameer at c2.net
Mon Apr 14 12:43:14 PDT 1997
> information. This is a security hole in the web site, not in the
> browser. The browser follows the HTTP specification. If you have a
[. . .]
>
> In the eyes of some, the referer header is a privacy violation. It
> allows a site to see what site you visited before coming there. In the
> case of Navigator, we ONLY send the referer header when you click on a
> link. Not when you select a bookmark. Not when you type a URL into the
> location field. This allows web sites to see who links to them. I
> think that's something that a web author is entitled to know.
GET forms aren't the only thing wrong with referer, btw. An
associate of mine discovered some prioprietary Netscape information
from the Referer: headers on hits to his website from Netscape
employees, even.
I commend Netscape for providing users with the ability to
turn off referers.
--
Sameer Parekh Voice: 510-986-8770
President FAX: 510-986-8777
C2Net
http://www.c2.net/ sameer at c2.net
More information about the Testlist
mailing list