1816916 - Hide Onion Referrers by default

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Tom Ritter [:tjr]]

We have a network.http.referer.hideOnionSource pref we built for Tor that refuses to send a referrer from an onion site. The purpose of this is that an onion address is a secret url. No one knows it until you publicize it. If a private onion site embeds or links to another website (onion or otherwise) - we don't want to leak the onion site address.

This is off in Firefox because we don't use Tor and Tor Browser turns it on.

However... some people use Firefox, with Tor, despite all the recommendations not to do this. These people are risking their own security and privacy. But we shouldn't automatically risk the onion site's privacy also. So let's enable the pref in Firefox by default.

Comment 1

[Tom Ritter [:tjr]]

Attachment: Bug 1816916: Hide onion referers by default r?freddyb

Comment 2

[morgan (Tor Project)]

Yes please :)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/203989862c02
Hide onion referers by default r=freddyb,tjr

Comment 5

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/203989862c02