untangling_the_web

DID: 4046925
UNCLA551FIEDHFOR OFflClaliL USE ONLY
Disable or Defeat the HTTP-Referrer
The "http referrer" variable (often misspelled "referer"184) may be a serious
concern. This variable lets a site you are visiting know which site you just came from
(which site referred you to them). Usually, the value of the "referrer" field is the uri of
the page you last visited. The problem is that the http-referrer variable gives out
more information. If you use a search engine to find a site and then click on that
site, the http-referrer will provide the entire query you used to find the site!
Furthermore, it is possible that other sensitive types of information, such as
username, password, email address, or even a credit card number, could be sent as
part of an http-referrer variable.l'"
There are ways around this problem. Here are three solutions:
1. Don't click on a link from a search engine; instead right-click on the link and
select Copy Link Location (Mozilla) or Copy Shortcut (IE6); paste the link in the
address window, and go to the link from the new browser window. Your query will
not be provided. Remember: you must copy the link to the address bar; it is not
sufficient to right-click and "open in new window" or "open in new tab."
2. Use a browser-based service that blocks the http-referrer, such as Webwasher
or Guidescope, both of which are free to individual users, or any number of products
that can be purchased for this purpose.
Webwasher 186
http://www.cyberguard.com/products/webwasher/webwasherproducts/classic/index.html
Guidescope
http://www.guidescope.com/home/
3. Disable the http-referrer in Netscape 7 and Firefox (you cannot do this in
Internet Explorer). In the Address/Location bar, type about:config and find
network. http.sendRefererHeader. This variable can be set to 0, 1, or 2:
2-default; send referrer for all requests
1-do not send referrer for images
184 The actual "referrer" code uses the incorrect spelling "referer," which may say something about the
spelling skills of programmers.
185 For an excellent overview of the legitimate use of and problems with the http-referrer, see, Lincoln
D. Stein, "Referer Refresher, " New Architect, September 1998,
(14 November 2006).
186 Webwasher Classic is now owned by Cyberguard and is still free, though the company does
request a donation.
UNCLA55IFIEDI'ifiOR OFflOlaliL USE ONLY 539