this post was submitted on 14 Apr 2026
248 points (99.2% liked)

Technology

6589 readers
602 users here now

Which posts fit here?

Any news that are at least tangentially connected to the technology, social media platforms, informational technologies or tech policy.

Post guidelines

[Opinion] prefixOpinion (op-ed) articles must use [Opinion] prefix before the title.

Rules

1. English onlyTitle and associated content has to be in English.
2. Use original linkPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
3. Respectful communicationAll communication has to be respectful of differing opinions, viewpoints, and experiences.
4. InclusivityEveryone is welcome here regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
5. Ad hominem attacksAny kind of personal attacks are expressly forbidden. If you can't argue your position without attacking a person's character, you already lost the argument.
6. Off-topic tangentsStay on topic. Keep it relevant.
7. Instance rules may applyIf something is not covered by community rules, but are against lemmy.zip instance rules, they will be enforced.

Companion communities

!globalnews@lemmy.zip
!interestingshare@lemmy.zip

Icon attribution | Banner attribution

If someone is interested in moderating this community, message @brikox@lemmy.zip.

founded 2 years ago
MODERATORS
BrikoX@lemmy.zip
248
Websites that hijack your back button must stop by June 15 or face Google's wrath (arstechnica.com)
submitted 5 days ago by schnurrito@discuss.tchncs.de to c/technology@lemmy.zip
36 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] lvxferre@mander.xyz 4 points 5 days ago* (last edited 5 days ago) (1 children)

If you develop some feature (or bug!) of course some people will find a decent way to use it. That doesn't mean the feature should be there on first place, specially when the possibility of abuse is so obvious. Plus if the pressure behind this anti-feature was "only" single page applications, and nothing else, I bet it would be implemented in a different way.

Also, look at the big picture. In isolation, one could argue giving pages access to your browsing history was a necessary albeit poorly thought feature; but when you look at other stuff browsers nowadays are supposed to do, you notice a pattern:

  • Browsers giving more info to the page about your system than just "I'm a browser, I can browse pages": the browser software, its version, the operating system, the fonts you have installed, your screen dimensions…
  • Letting pages decide the behaviour of mouse clicks. And if the window is focused or not.
  • The ability to show pop-up messages.
  • etc.

Are you noticing it? All those "features" are somewhat useful, but with such obvious room for abuse it would be insane to add them, in retrospect. And that abuse is usually from money hoarders, or people controlled by them.

Worse: all of them crammed into what was supposed to be a system to show you content, but eventually got bloated into a development platform, transforming browsers into those bloody abominations of nowadays, with a huge barrier of entry, dominated by a single vendor (and where the vassal of said vendor got ~3% market share). I'd say that not having a monopoly is more important than all those features together.

And odds are the ones pushing for those features (like Google) knew they were insane, and that they would raise the barrier of entry for new browsers. But that was their goal, innit? Enshittify the web while claiming control over it.

[–] pivot_root@lemmy.world 12 points 5 days ago* (last edited 5 days ago)

I think you are misunderstanding what is possible with the history API.

Pages can't read your navigation history.
Pages can't manipulate history prior to their loading.

The original history API is a careless mistake. It can:

  • Tell the browser to navigate forward n entries.
  • Tell the browser to navigate backward n entries.
  • See the length of the history stack.

Seeing the length is a privacy problem. Allowing arbitrary forward navigation is a usability problem that's ripe for abuse. Allowing back navigation to be more than a single page is a usability problem.

The newer pushState and replaceState APIs are fine. As their names imply, they push a new URL or replace the current URL in the navigation stack. The URLs are also subject to same-origin constraints, so you can't just replace the current page with an entirely different domain.

Using a replaceState followed by pushState to insert a dummy marker that runs history.go(1) when the popState event is fired allows pages to prevent users from navigating away from the website. That's shitty and abusive, yes.

Do you know what else can do that, though?

if (window.location.hash != "no_redirect")
    setTimeout(() => { window.location.hash = "no_redirect"; }, 1000)

Or

<?php
if ($_GET["no_redirect"] != "1")
    echo '<meta http-equiv="refresh" content="1; url=?no_redirect=1 />';
?>

Back button hijacking is an infuriating problem, but it's not a new one exclusive to SPAs. This fuckery has existed for a long time.

Edit: I don't like the state of the modern web either, but as you also noted, the problem with it is by and large Google's monopolistic dominance over web browsers and their incentive to not take privacy seriously. The only non-Blink browser engine with any notable market share is WebKit2, and that's only because Apple is abusing their own position.