Sunday, April 3, 2005

Just when you thought it was safe to surf the Internet again - up pops another worrisome browser "feature" , this time in Mozilla-based browsers including Firefox.

This feature goes by the name of prefetch, and it's been around for several years but has never got much attention until Google announced the introduction of "Enhanced searching with Firefox".

Google says: "When you do a search on these browsers, we instruct them to download your top search result in advance, so ... you'll get to that page even more quickly.". What this means is: the link for the top search result will be constructed in such a way that Mozilla (I'll use Mozilla from now on to mean all Mozilla-based browsers including Firefox) will download the linked page in the background automatically without any action from the user.

The problem

Why is this a cause for concern? Quite simply: privacy. Searching for a site and visiting a site are two different activities. Now though, a Google search using Mozilla may mean you visit sites you didn't intend to: the site will have a record of your visit and will also have been able to set a cookie; and the visit will be in your browser history and that of any logging proxies, as are typically found in company networks.

This could be an issue if a visit to the site involved is not desirable for some particular reason; for example the site contains content which goes against company Internet usage policies; a business wishes to research competitors, but not risk their IP address showing in their competitors' logs; a particularly invasive marketing site wishes to push its cookies as far and wide as possible,

To put this in perspective: amongst all the other "dangers" involved in a simple Internet search session, it's not something to lose sleep over. It is however an issue to be aware of if you wish to minimize your exposure to potential privacy risks. It is also possble that malicious server operators could find some way of misusing prefetch in the future.

Note also that currently Google only creates prefetch links for the top result, and only if its algorithm determines that it is very likely the user will click on that link. Although the exact details of the algorithm are not public, some experimentation suggests that it is only employed when a high-ranking is the first result and the search term is in part of the domain name,

The technology

So what exactly is prefetch? It's an option in Mozilla which responds to HTML tags of the form <link href="http://www.example.com" rel="prefetch" />; the URL linked to will be fetched automatically without this action being visible to the user. Only the page at the URL referenced will be fetched, but no images or other objects referenced from the page will be retrieved, nor any JavaScript executed. However, any cookies set in the headers returned will be acted upon.

The prefetch option is on by default in all current Mozilla versions. It can be turned off in three ways:

• Adding user_pref("network.prefetch-next",false); to your prefs.js file;
• Typing about:config into Mozilla's URL field; set the option network.prefetch-next to false (right-click on the Value column; select Modify, and enter false;
• Via the menu setting Edit->Preferences->Cache->Link Prefetching.

Note that the last option is only available in Mozilla itself, not Firefox.

The Mozilla Link Prefetching FAQ is located at http://www.mozilla.org/projects/netlib/Link_Prefetching_FAQ.html.

Google's take on the subject is here: http://www.google.com/help/features.html#prefetch.

Posted at 5:24 PM |Comments (0)