Mozilla's position on the 'ping' attribute for hyperlink auditing

The Bleeping Computer portal contacted Mozilla, and it was found out its position regarding the click tracking mechanism for hyperlinks using the attribute “ping“, which is currently disabled by default in Firefox. Interest in the “ping” attribute arose after the removal of options to disable it in Chrome and Safari.

Mozilla representatives stated:

We agree that enabling the “ping” attribute, which is typically used for hyperlink auditing, is not a privacy issue but rather a task to enhance user experience by providing websites with a more optimal solution for hyperlink auditing that does not entail the performance drops associated with other tracking methods mentioned in the publication the WebKit developer blog. In fact, we already support the API sendBeacon and the reason we have not yet enabled the “ping” attribute is that our implementation of this function is still not ready..

We do not believe that merely providing an option to disable the ping attribute will lead to any noticeable improvement in user privacy, as websites can (and often do) identify various mechanisms supported by each browser for hyperlink auditing, and disabling the more “user-friendly” mechanisms will only lead to a fallback to less “user-friendly” methods without actually disabling hyperlink auditing itself.

When using the “ping=URL” attribute in the tag, the browser sends a POST request to the URL specified in the attribute, transmitting information about the transition through the HTTP_PING_TO header. Without the ping attribute, websites can implement hyperlink auditing by replacing the actual link with an intermediate link or by sending information via XMLHttpRequest or sendBeacon calls, which have long been used in Google search, when clicking on external links in the social network VK, and in the browser add-ons repository addons.mozilla.org. Since such substitution can be done with the intermediate link hidden using JavaScript, just like with the ping attribute, it is impossible to determine whether auditing is applied to the current link without code analysis.

Source: opennet.ru