Wikipedia talk:Village pump (policy)/RfC: Wikimedia referrer policy

Response to RFC

In the Technology department at the WMF, we take very seriously our role in reviewing and implementing the software and hardware decisions that ensure the security and privacy of users in compliance with our Privacy policy. Ultimately, our goal is to maintain, and where possible, improve the privacy control for our end users while also providing technologies that don’t interfere with the goals of the movement. We understand that privacy is important to users across the Wikimedia movement, and it is always a central factor in our engineering and technical decisions. Security configurations are made across all Wikimedia properties by our Engineering teams in order to ensure consistency of compliance with the promises made to users in our Privacy policy.

The advisory English Wikipedia RFC brought renewed interest to the 2016 Referral Header Change. In light of that interest, we reevaluated the 2016 analysis of the technological solution for silent referral policies in terms of its effect on privacy and its effectiveness in supporting the privacy and security of concerned individuals and relative impact on the community. In this particular situation, our engineers found that:

• The current referral policy provides more protection than the the default HTTPS configuration, which allowed very specific urls for referral traffic between HTTPS sites.
• The current configuration provides sufficient anonymization of user information to provide privacy and security for the vast majority of users.
• Individuals with higher individual threat models should consider taking more extensive precautions to protect all of their Internet browsing activity. Silencing the referrer policy on one web-property, while the user’s browser shares referrer information as a common practice among many other properties, provides very limited protection in the best of circumstances. We have published recommendations to that effect at: https://meta.wikimedia.org/wiki/HTTP_Referral_Headers . We would appreciate linking to those recommendations wherever communities might find this advice useful.
• Silencing referral traffic entirely would undermine our larger technical efforts to make the impact of our projects transparently measurable. Wikimedia projects are a major driver of attention and readership to a number of websites (from broad scientific repositories and general interest information websites with which our movement has few interactions to individual GLAM, Educational and other institutions with whom we have partnered). The Wikimedia movement, more generally, benefits from broad awareness of our impact.

In light of this analysis, the Wikimedia Foundation does not plan to change the existing referral header policy, which is in compliance with the Foundation’s privacy policy and our commitment to protect user privacy. If new security or privacy concerns are identified in the future, we will reassess our current solution. I invite those with questions to post on my talk page. VColeman (WMF) (talk) 02:19, 6 September 2017 (UTC)

It should be noted that two questions were posted to VColeman (WMF)'s talk page on 7 September 2017[1] and there has been no reply. Combined with the lack of response to suggestions posted to Phabricator, it appears that the only way to get a reply from the WMF is to post an advisory RfC. --Guy Macon (talk) 11:58, 28 March 2018 (UTC)