有时，如果将信息发送到另一个资源，新手或无辜用户可能会被诱骗在不知不觉中参与。这可能会增加隐私风险。例如，HTML5向网络添加了一项称为超链接审核^{(Hyperlink Auditing)}的功能。如果您不了解此功能，超链接^(Hyperlink)审核将添加到网页或由具有 ping 属性的区域元素创建。

超链接审核 Ping

网站通常使用它来跟踪链接点击，但也被发现被网络犯罪分子滥用，将大量网络请求传递给网站，试图使它们脱机。那么，如何在Chrome或Firefox浏览器中禁用此功能？另外，让我们尝试回答一些与之相关的问题。

我们将分两步进行-

1. 禁用超链接审核
2. 确定超链接^(Hyperlink)审计是好是坏

超链接^(Hyperlink)审核是一种HTML标准，它允许创建特殊链接，当它们被单击时，这些链接会 ping 回指定的 URL。这些 ping以对指定网页的POST请求的形式完成，然后可以检查请求标头以查看单击了链接的页面。

1]禁用超链接审核

Firefox是少数默认禁用 ping 属性的浏览器之一。您可以通过打开浏览器并查看 about:config >  browser.send_pings条目值来验证它。有关更多信息，请参阅下面的屏幕截图。

Chrome计划在未来的版本中移除此功能。但是，您仍然可以通过打开 chrome://flags#disable-hyperlink-auditing并将标志设置为 Disabled 来禁用它。

为了您在较新版本中的信息，默认情况下将启用超链接^(Hyperlink)ping 跟踪功能，因此您可能不会在浏览器中看到这些标志。

2]超链接^(Hyperlink)审计是好是坏

早些时候有报道；它表明一种新型DDoS 攻击^{(DDoS attack)}滥用了基于HTML5 Ping 的超链接审计功能。

该攻击主要涉及用户无意中访问带有两个外部JavaScript^(JavaScript)文件的精心制作的网页。其中一个包括一个包含URL^(URLs)的数组（被认为是DDoS攻击的目标。第二个JavaScript文件具有一个函数，该函数从数组中随机选择一个 URL，创建具有“ping”属性的标签，并以编程方式单击每秒链接一次。这使得攻击者能够在网页打开时向目标发送超链接审计 ping。因此，攻击依赖于将合法功能转变为攻击工具，而不是漏洞。

这是一个令人担忧的趋势，因此超链接^(Hyperlink)审计通常不是一个好主意。

Hyperlink Auditing in Chrome & Firefox browsers

Sometimes, novice or innocent users can be tricked to unwittingly participate if sends information to another resource. This may add a privacy risk. For іnstance, HTML5 has added a feature to the web called Hyperlink Auditing. If you are not aware of this feature, Hyperlink auditing is added to a web page or created by an area element that has a ping attribute.

Hyperlink Auditing Pings

It is normally used by sites to track link clicks but has also been found to be abused by cyber-criminals to pass the massive amount of web requests to sites in an attempt to take them offline. So, how to disable this feature in your Chrome or Firefox browser? Also, let us try to answer a few questions related to it.

We’ll proceed in 2 steps-

1. Disable Hyperlink auditing
2. Determine if Hyperlink auditing good or bad

Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on.

1] Disable Hyperlink auditing

Firefox is one of the few browsers that have the ping attribute disabled by default. You can verify it by opening the browser and taking a look at about:config >  browser.send_pings entry value. See the screenshot below for more information.

Chrome is planning to remove this ability in future versions. However, you can still disable it by opening chrome://flags#disable-hyperlink-auditing and setting the flag to Disabled.

For your information in newer versions, Hyperlink ping tracking feature will be enabled by default, and so you may not see these flags in your browser.

2] Is Hyperlink auditing good or bad

There was a report sometime earlier; it suggested that a new type of DDoS attack abuses the HTML5 Ping-based hyperlink auditing feature.

The attack primarily involves users innocently visiting a crafted web page with two external JavaScript files. One of which includes an array containing URLs (believed to be targets of the DDoS attack. The second JavaScript file had a function that randomly selected an URL from the array, created the <a> tag with a ‘ping’ attribute, and pro-grammatically clicked the link every second. This enabled attackers to send hyperlink auditing ping to the target so long the web page was opened. As such, rather than vulnerability, the attack relied on turning a legitimate feature into an attack tool.

This is a worrying trend, and so Hyperlink auditing is generally not considered as a good idea.

Related posts

• FIX：Recaptcha不在Chrome，Firefox或任何浏览器中工作

• 如何在Edge，Chrome and Firefox browsers之间同步Tabs

• Windows 10 Google Chrome vs Firefox Quantum

• 如何将网页保存为Chrome or Firefox中的PDF

• 400 Bad Request，Cookie Too Large - Chrome，Edge，Firefox，即

• 如何禁用内置Password Manager在Chrome，z810​​2448，z810​​8625

• 如何使用Chrome，Edge，Firefox，Opera浏览器作为Notepad

• Share Button Plugins为Chrome，Firefox and Edge browsers

• 浏览Chrome，Firefox，Edge，Internet Explorer的禁用图像，同时浏览

• 关闭所有在一次Chrome，Edge，或Firefox打开browser tabs

• Chrome，Firefox，Edge，即Opera Block or Allow Third-Party Cookies

• 如何改变Default Font在Chrome，Edge，Firefox browser

• 如何在Chrome，Firefox and Edge中翻译Web page

• 如何在Chrome，Firefox，Edge浏览器中黑名单或块网站

• 免费Web Cache Viewer用于Chrome，Firefox and Edge browsers

• 禁用Chrome，Edge，Firefox，Opera，Internet Explorer中的禁用JavaScript

• 如何在Chrome，Edge，Firefox中浏览仅纯文本Mode

• 在Chrome，Firefox，Edge中删除所有Saved Passwords

• 如何在Full Screen mode开设Chrome，Edge or Firefox browser

• 如何清除Cache，Cookies，Browsing History在Chrome and Firefox