Collecting User Information

[Phil]

What methods do we have of collecting information about browsing
history? We would like to see the last few links that a client
followed, prior to entering our site.

I thought $_SERVER[] object might have something like this, but I
haven't found any details, yet.

Thanks for your ideas.

Phil

[shimmyshack]

On May 31, 4:40 pm, Phil <supp...@campbe ll-graves.orgwrote :

What methods do we have of collecting information about browsing
history? We would like to see the last few links that a client
followed, prior to entering our site.

I thought $_SERVER[] object might have something like this, but I
haven't found any details, yet.

Thanks for your ideas.

Phil

that would be an invasion of privacy, unless you own the previous site
they were on. You could possibly get access to some history using
underhand js techniques, or through paying a 3rd party advertiser
(clickthrough) but none of it is reliable and its not fairplay.
When you consider what you would like you must spare a thought for
what's best for the world as well.

[Paul Herber]

On 31 May 2007 09:31:10 -0700, shimmyshack <ma********@gma il.com>
wrote:

>On May 31, 4:40 pm, Phil <supp...@campbe ll-graves.orgwrote :

>What methods do we have of collecting information about browsing
history? We would like to see the last few links that a client
followed, prior to entering our site.

I thought $_SERVER[] object might have something like this, but I
haven't found any details, yet.

Thanks for your ideas.

Phil

that would be an invasion of privacy, unless you own the previous site
they were on. You could possibly get access to some history using
underhand js techniques, or through paying a 3rd party advertiser
(clickthroug h) but none of it is reliable and its not fairplay.
When you consider what you would like you must spare a thought for
what's best for the world as well.

Any website that says it's not a 'get rich quick scheme', probably is.

"receive your customized financial analysis, a $400 value, FREE with
your order. "

"ISBN: number pending"

Sorry, sunshine, but your website has scamster written all over it.
And you want to invade privacy? Yeah, right.
--
Regards, Paul Herber, Sandrila Ltd. http://www.sandrila.co.uk/

[Phil]

You're right. Thanks, for pointing out that referring pages are
privacy issues. Many of us would include some uses of cookies in that
threat. It's a big issue that deserves discussion.

Http-header contains history. Some header information seems privacy
related (computer, OS, IP/domain, and at least the last item in the
browsing history). One posting suggested that the header goes back a
few urls.

Does everyone agree that websites should not capture http-header
information?

Phil

[Benjamin]

On May 31, 3:14 pm, Phil <supp...@campbe ll-graves.orgwrote :

You're right. Thanks, for pointing out that referring pages are
privacy issues. Many of us would include some uses of cookies in that
threat. It's a big issue that deserves discussion.

Http-header contains history. Some header information seems privacy
related (computer, OS, IP/domain, and at least the last item in the
browsing history). One posting suggested that the header goes back a
few urls.

Does everyone agree that websites should not capture http-header
information?

Yes!

>
Phil

[shimmyshack]

On May 31, 9:14 pm, Phil <supp...@campbe ll-graves.orgwrote :

You're right. Thanks, for pointing out that referring pages are
privacy issues. Many of us would include some uses of cookies in that
threat. It's a big issue that deserves discussion.

Http-header contains history. Some header information seems privacy
related (computer, OS, IP/domain, and at least the last item in the
browsing history). One posting suggested that the header goes back a
few urls.

Does everyone agree that websites should not capture http-header
information?

Phil

well it depends, http headers are of course essential, I guess we are
talking about referer which is essentially useless (can be spoofed and
isnt required) and other "custom" headers which can form part of an
application.
Referers should probably be blocked by privacy conscious users at the
browser level. They only reveal history if the web application that
the user is running (visiting) tells them to. The essential problem is
ignorance in users, they do not (and shouldnt be expected to) discern
between bad and good elements in a page. For a long time we have
followed the "if it works great" approach of companies like M$ with IE
almost designed with this ethos in mind, sooner rather than later,
there will be some high profile court case against companies which
collect data without proper consent, no doubt following yet another
uncontrolled relesase, which will result in some change or the other
to the way browsers transmit and applications can collect information,
and the implicit consent which is assumed by visiting a website.
Havent we all got to this situation via "corporatio ns" whose control
of the legal system skews rights in their direction - "companies have
to proove adherence to software licenses etc..."
Theres no short answer except the power of combined individuals. If
you dont want your history tracked, write a good article explaining
the risks and showing up a few companies that do it, and have a link
to a firefox addon, if the article is digg'd you've gone some way to
helping the situation.
I run noscript, and explicitly and temporarily allow domains if the
page doesnt work, this stops all kinds of threats including persistent
xss, and of course 3rd party privacy thieves. Combine this with
RefControl and you're done.