by rat_on_the_run
9 subcomments
- I wish the browsers had a function of disabling all keyboard shortcuts of a website. I binded Ctrl+E to opening a new tab just beside the current tab (built-in hotkey in Brave). It's frustrating to see it changed to something like opening the emoji menu on Discord.
- That's cool if they can make it work.
I don't understand how Google's indexing work anymore. I've had some website very well indexed for years and years which suddenly disappeared from the index with no explanation, even on the Search Console ("visited, not indexed"). Simple blog entries, lightweight pages, no JavaScript, no ads, no bad practices, https enabled, informative content that is linked from elsewhere including well indexed websites (some entries even performed well on Reddit).
At the same time, for the past few years I've found Google search to be a less and less reliable tool because the results are less often what I need.
Anyway, let's hope this new policy can improve things a little.
by merelysounds
3 subcomments
- Looks like there is also a client side solution for that, at least in Firefox; it's possible to prevent a page from modifying browser history:
> Open the about:config page in Firefox
> Search for "pushstate"
> Double-click "browser.history.allowPushState"
source: https://superuser.com/a/1688290
by firefoxd
12 subcomments
- Ok, you can start with LinkedIn, I'll wait...
If you are wondering how it works. You get a link from LinkedIn, it's from an email or just a post someone shared. You click on it, the URL loads, and you read the post. When you click the back button, you aren't taken back to wherever you came from. Instead, your LinkedIn feed loads.
How did it happen? When you landed on the first link, the URL is replaced with the homepage first (location.replace(...) doesn't change the browser history). Then the browser history state is pushed to the original link. So it seems like you landed on the home page first then you clicked on a link. When you click the back button, you are taken back to the homepage where your feed entices you to stay longer on LinkedIn.
by al_borland
5 subcomments
- Some Microsoft sites have been very guilty of this. They are the ones that stick in my head in recent memory.
by vashchylau
2 subcomments
- I initially thought this is for Android.
Which has a long overdue problem of "Tap Back again to exit" type hijacks.
Or feed-based apps (hi Reddit, TikTok, Instagram) refreshing your timeline in hopes you reconsider exiting and keep doomscrolling.
One can only hope…
by jbonatakis
0 subcomment
- > We believe that the user experience comes first
Bold coming from the company who gives me the most confusing “Open in app” prompts that are designed to confuse you and get you to use their app rather than the web
https://mjtsai.com/blog/2024/03/29/those-obnoxious-sign-in-w...
- This seems like a good time to advertise the post/redirect/get pattern.
https://en.wikipedia.org/wiki/Post/Redirect/Get
Not strictly about hijacking back navigation but it can make experience less bumpy if you've got form submissions in the middle of the path.
- As usual, it's a good first step but doesn't go far enough. I don't want my back-button hijacked by _anything_.
My issue with back-button hijacking isn't even spam/ads (I use an ad-blocker so I don't see those), but sites that do a "are you sure you want to leave? You haven't even subscribed to our newsletter yet?!"
- I would like to mention that Google own SPA framework, angular, has redirect routes which effectively do back button hijacking if used, because they add the url you're redirecting from to the history.
https://angular.dev/guide/routing/redirecting-routes
by andreareina
8 subcomments
- > Notably, some instances of back button hijacking may originate from the site's ... advertising platform
I feel like anything loaded from a third party domain shouldn't be allowed to fiddle with the history stack.
- But the question is: why are sites allowed to hijack the Back Button?!?
by CableNinja
1 subcomments
- Frustrating it took this long for something to be done about this, but glad its now got something being done.
- A browser feature I wasn't aware of for too long: long press the back button, to get a list of recent URLs, allowing you to skip anything trying to hijack the back button.
- Ironically the only place I encounter this is using google news, where news sites seem to detect you're in google news (I don't think these same sites do it when I'm just browing normally?), and try to upsell you their other stories before you go back to the main page.
- Porno sites do this thing where every click is a new tab and when you refocus the previous tab, it reloads to an ad.
Or so I have been told.
- An interesting variant of a web phishing attack is to combine the back button hijacking with information that comes from the HTTP referer header. HTTP referer discloses from which website the user is coming from, when the user click the back button, the malicious site can take the user to the site that looks identical (except for the URL), but is attacker controlled.
- Great. Can we do ctrl-f search hijacking next.
So jarring when websites replace core functionality with their own broken crap because they think they’re special.
Some also seem to hijack right click menu now
- I understand this is vague on purpose but wish there was more detail. E.g., if I am running a game in a webgl canvas and "back button" has meaning within the game UI which I implement via history states, is my page now going to be demoted? This article doesn't answer that at all.
- Took long enough. Maybe I missed it, but I didn’t see them say how invested they are in tackling this. Promoting a rule is one thing, but everything SEO related becomes a cat and mouse game. I don’t have high confidence that this will work.
by mancerayder
0 subcomment
- Do we include reddit.com here, or too big to influence?
- Broken back buttons have been one of my biggest complaints since we enabled SPAs to access the history API in the first place. I don't see it as a net win so far, but maybe a decade later we can solve it?
by kristopolous
0 subcomment
- Almost 30 years ago I wrote an article advocating for domain level back button with a quasi mode like ctrl to traverse domains.
Would have fixed this. Too late now
- Finally! (For this feature to be shipped).
Almost unrelated, but.. I wonder ..if there was an APM intern[1] behind this, or maybe this was this project. Because, this, would have been an excellent one!
[1] I had the fortune to be one myself in June 2012 for the Chrome Team.
- The iron law of web encrapification: every web feature will (if possible) be employed to abuse the user, usually to push advertising.
- Now do the Amazon app.
Number of times I've looked for something on my phone, gone through to a product page on Amazon but then have had to back out multiple times to get back to the search listing. Sometimes it's previously viewed products, sometimes it's "just" the Amazon home page. It should be one-and-done.
eBay too. I'm sure there are others.
- What about map applications which manipulate the history to store the position of the map as users drag and release to make back and forward work to the users expectation in a single page app? It’s not malicious, but will Google flag it?
- > We believe that the user experience comes first.
Excuse me??
- what about back buttons reloading the page so to have any continuity you have to open everything in a separate tab? youtube for example
by snowwrestler
2 subcomments
- Wait, how does one website (google.com) know what happens inside my browsing session on another website (bad-blog.com) after I click over? Hmmmmm
This sort of announcement just emphasizes the extent to which Google observes ALL your web browsing behavior, thanks primarily to their eyes inside Chrome browser.
You know those warnings when you install a browser extension, about all the things that extension will be able to see and do? Well so can Chrome itself…
- I use Chrome on my Android and Mac. For a while I've appreciated the seemingly built-in anti-hijacking measure that always does what I expect on the second Back press. (The first Back may pop up a subscription box for example, but the second will always return me to where I came from).
I actually felt that this was a solved problem, so I'm surprised to see so many people still suffer getting stuck in redirect loops.
- Yes please! It's very annoying how clicking an FB or Insta result from a Google search result would disallow going back to the search result!
by wafflemaker
0 subcomment
- I sometimes forget there's good people working at Google too.
Sorry for every time I called Google the Satan and didn't add exception for the good people working there!
by chakintosh
0 subcomment
- Google should probably talk to Microsoft about this because for me they are the biggest offenders with this back button hijacking in their support forums.
- Since this is Google we’re talking about, I’m fully expecting them to penalize benign uses of the back button override.
- Amazing change, fighting with the back button is my least favorite part of the ad web and a blindspot for ublock. I wonder how Google is going to track this and if SPA style react router sites would be downranked because of the custom back button behavior. I doubt it due to their popularity but I'm curious how they're going to determine what qualifies as spam
by youknownothing
0 subcomment
- Isn't this going to break a lot of React Router navigation? Are they going to manually check every website to see if their manipulation of the history is legit or spammy?
by davidczech
0 subcomment
- There should be some browser-level enforcement of this. For example, it would seem possible to detect a user frustratingly mashing the back button, and offer a remediation dialog to disable any hackery that's hijacking the back buttons.
- I assume this is not going to negatively impact well behaved use of the History API to facilitate back/forward navigation within SPAs?
- Thank you!
One of the worst is TikTok, even as a developer, when someone sends me a TikTok link and I have to visit it, I get stuck in the browser (same with the app but I uninstalled it), and it feels almost device-breaking the way they trap you in.
- It's about time.
Google is doing so much to keep the web usable. They're the only ones with the teeth to back up standards for mobile web load time, max sender spam rates, leaving browser history alone, etc.
- I hope this applies to Android as well. Reddit is a particularly egregious offender.
- > Why are we taking action? We believe that the user experience comes first.
What's the real reason?
- Why not fix this at the browser level? E.g. long or double click on back button = go to previous non-javascript-affected page (I mean by that: last page navigated to in the classical sense, ignoring dynamic histories altered by js and dynamic content)
- i wonder if this includes sites that do auto-redirect: A -> B (auto-redirect) -> C
if i'm on page C and go back, page B will take me to page C again. i think this is more about techincal incompetence rather than malicious intent, but still annoying.
by cientifico
0 subcomment
- Click on any Youtube video from any web in android. If you press anything that is not the back button immediately, you will loose the option to go back.
So this coming from google... it's funny. Welcome, but funny.
by transcriptase
2 subcomments
- >We believe that the user experience comes first
I’ll believe that when YouTube gives me the ability to block certain channels versus “not interested” and “don’t recommend channel” buttons that do absolutely nothing close to what I want.
Or a thousand other things, but that one in particular has been top of mind recently.
- Ironically, we have an infringing website right now on the front-page of HN (nypost).
- Reddit! I'm looking at you?
- Phew. for a moment there i thought they would start blocking alternate uses of the back button in apps (for like when it means "go back" and when it means "close everything")
That would have severely rustled my jimmies
- Is there any click-bait news site that DOESN'T do this? You hit back and land on a list of their click-bait articles and add links instead of the page you expect.
- Maybe we can get facebook finally drop this dark pattern
by halfmatthalfcat
0 subcomment
- I remember when I worked at HuffPo and they started doing this. I called out the org and they all just shrugged.
- So someone developed a malicious plugin to achieve this? Otherwise, I can't imagine how they could bypass the browser to do this.
by seanalltogether
0 subcomment
- Does this also apply to sites like instagram that simply erase your entire back button history if you visit the site.
by TehCorwiz
1 subcomments
- I want my browser history to be immutable and operate like a tree and not like a stack.
- So why don't google just disable the possibility of hijacking the back button in Chrome, to give an example?
- I'm at a stage when I click back button extremely rarely and is amazed when it works as I expected.
- Are they considering all uses of window.history.pushState to be hijacking? If so, why not remove that function from Chrome?
- Instagram comments page requires 2 quick back press or else it won't take to previous page
by NooneAtAll3
0 subcomment
- is there a policy on "home button hijacking"?
I'm tired of apps that intercept home button to ask "are you sure?" - home button is home button, return me to the main phone screen
also, ads at the bottom of the screen, so that if you miss home button you open a website
- Great! So they'll fix the back button bugs on YouTube, and return me to the previous set of video recommendations when I use it on the homepage, right? Right? And let me return to the actual site when it detects that I lost the web connection for 0.01 seconds and hides all the content, and I then press the back button?
- This would have been great back when I used a search engine to visit web pages.
by taco_emoji
0 subcomment
- Really wish this was applied to phone apps. In Android at least, app A linking to app B will FREQUENTLY break the "back" functionality, allowing app B to handle the "back" action instead of doing what every user would expect 100% of the time, which is to go back to app A.
by bschwindHN
5 subcomments
- Cool, now maybe let's do something about all the shit I have to clear out out my face before I can read a simple web page. For example, on this very article I had to click "No thanks" for cookies and then "No thanks" for a survey or something. And then there was an ad at the top for some app that I also closed.
It's like walking into some room and having to swat away a bunch of cobwebs before doing whatever it is you want to do (read some text, basically).
- This is great. Can Google also stop scroll hijacking?
by mrheosuper
0 subcomment
- Nice. This has been existed for too long.
- Microsoft joke support forum stil does this?
- How does this work? How can a site inject a totally different site into the history? I thought eg the History API only lets you add to the stack and pop, not modify history?
- Is there not a plugin that helps to fix this?
by arewethereyeta
0 subcomment
- 20 years too late SEO fix.
by TexanFeller
1 subcomments
- When I first heard of the APIs that allowed websites to modify browser history it sounded like a huge mistake. I still feel that way to this day.
- It seems like a lot of the APIs that make a website act like an application need to be disabled by default; and some kind of friction needs to exist to enable them.
Edit: I'm not sure what kind of friction is needed, either an expensive review process (that most application developers would complain about but everyone else would roll their eyes) or a reputation system. Maybe someone else can think of a better approach than me?
by hmokiguess
0 subcomment
- It's getting very tiring seeing things that could be first-class user defined controls baked in the browser so that you have true agency over the behaviour being done like this
It's like the other thread from before where LinkedIn scans for your extensions, the fact they can do that without prompting for permission from the user is baffling
- Popups were dealt in a way that could be useful here, they're only permitted when the user directly generates the interaction that creates the popup (not scripted). The back button could use the same algorithm back in history, only go back to screens that the user directly navigated.
- That's a great step in the right direction since that happens to me all the time. But the penalty of "Manual spam action or automated demotion in Google Search results (as a 'malicious practices' spam violation)" seems a bit lenient.
- I never understood why browsers ever allowed this in the first place. It's obviously bad. Yeah, yeah there are "reasons" but it's still obviously a bad solution to whatever "problem" they were trying to solve.
- Ah the irony. Wouldn't let me go back without clicking the cookie thing.
by sidewndr46
0 subcomment
- too little, too late. The API for interacting with the back button in Javascript should never have existed in any capacity.
by kartik_malik
0 subcomment
- that's crazy things goin on
- > We believe that the user experience comes first.
If by "user" you mean advertisers, sure you do. Everyone else is an asset to extract as much value from as possible. You actively corrupt their experience.
The fact these companies control the web and its major platforms is one of the greatest tragedies of the modern era.
- > Notably, some instances of back button hijacking may originate from the site's included libraries or advertising platform. We encourage site owners to thoroughly review their technical implementation...
Hah. In my time working with marketing teams this is highly unlikely to happen. They're allergic to code and they far outnumber everyone else in this space. Their best practices become the standard for everyone else that's uninitiated.
What they will probably do is change that vanity URL showing up on the SERP to point to a landing page that meets the requirements (only if the referer is google). This page will have the link the user wants. It will be dressed up to be as irresistible as possible. This will become the new best practice in the docs for all SEO-related tools. Hell, even google themselves might eventually put that in their docs.
In other words, the user must now click twice to find the page with the back button hijacking. Even sweeter is that the unfettered back button wouldn't have left their domain anyway.
This just sounds like another layer of yet more frustration. Contrary to popular belief, the user will put up with a lot of additional friction if they think they're going somewhere good. This is just an extra click. Most users probably won't even notice the change. If anything there will be propaganda aimed at aspiring web devs and power users telling them to get mad at google for "requiring" landing pages getting in the way of the content (like what happened to amp pages).
by charcircuit
3 subcomments
- Google should actually fix this from the browser side instead of trying to seriously punish potentially buggy sites.
- Now if only they'd do this for Android apps that hijack the back button to pop up things, or say "are you sure you want to leave?"
by incognito124
0 subcomment
- Now, if they only declared scroll hijacking as spam...
by globalnode
1 subcomments
- will google really punish sites for doing this? and if so how do i report a site? i guess i could email the site with the google link and suggest they fix it first
- Now to prevent scroll bar hijacking.
- Great. Now do Android phones...
- Maybe there should be a policy against links that display one destination but actually go somewhere else by changing the target with an onclick event.
oh wait.. that won't happen: google is the biggest offender, using that technique to surveil browsing activity.
by shevy-java
1 subcomments
- I don't trust Google.
We need to go back to an independent and competent
research group designing standards. Right now Google
pwns and controls the whole stack (well, not really
ALL of it 1:1, but it has a huge influence on everything
via the de-facto chrome monopoly).
Remember how Google took out ublock origin. They also lied
about this aka "not safe standards" - in reality they don't
WANT people to block ads.
by tgsovlerkhgsel
1 subcomments
- Now do paywalls next.
by purushpsm147
0 subcomment
- [dead]
- [dead]
by Serhii-Set
0 subcomment
- [dead]
by andrewmcwatters
0 subcomment
- [dead]
by urbandw311er
0 subcomment
- The idea of Google lecturing anybody about hijacking UI for dark patterns is absurd.
The company that hijacked an open source mobile OS and turned it into a closed source profit machine.
The company that hijacked the web so “accelerated mobile pages” could effect a walled garden.
The company that hijacked a browser and turned it into an anti-privacy tracking system.
It’s like R. Kelly giving a keynote on safeguarding minors.
EDIT: …but, yes, to be clear, I loathe the hijacking of back buttons too. Just a shame I have to read this sanctimonious shit from a company with such a terrible track record on trust.
by dnnddidiej
4 subcomments
- Easy fix:
JS doesn't let you change back button behaviour.
Q. But what about SPA?
A. Draw your own app-level back button top left of page.
Another solution: make it a permisson.
Hacker News