Hacker News

Ok, you can start with LinkedIn, I'll wait...

If you are wondering how it works. You get a link from LinkedIn, it's from an email or just a post someone shared. You click on it, the URL loads, and you read the post. When you click the back button, you aren't taken back to wherever you came from. Instead, your LinkedIn feed loads.

How did it happen? When you landed on the first link, the URL is replaced with the homepage first (location.replace(...) doesn't change the browser history). Then the browser history state is pushed to the original link. So it seems like you landed on the home page first then you clicked on a link. When you click the back button, you are taken back to the homepage where your feed entices you to stay longer on LinkedIn.

Wait, how does one website (google.com) know what happens inside my browsing session on another website (bad-blog.com) after I click over? Hmmmmm

This sort of announcement just emphasizes the extent to which Google observes ALL your web browsing behavior, thanks primarily to their eyes inside Chrome browser.

You know those warnings when you install a browser extension, about all the things that extension will be able to see and do? Well so can Chrome itself…

As usual, it's a good first step but doesn't go far enough. I don't want my back-button hijacked by _anything_.

My issue with back-button hijacking isn't even spam/ads (I use an ad-blocker so I don't see those), but sites that do a "are you sure you want to leave? You haven't even subscribed to our newsletter yet?!"

> Notably, some instances of back button hijacking may originate from the site's ... advertising platform

I feel like anything loaded from a third party domain shouldn't be allowed to fiddle with the history stack.

Great. Can we do ctrl-f search hijacking next.

So jarring when websites replace core functionality with their own broken crap because they think they’re special.

Some also seem to hijack right click menu now

The iron law of web encrapification: every web feature will (if possible) be employed to abuse the user, usually to push advertising.

That's cool if they can make it work.

I don't understand how Google's indexing work anymore. I've had some website very well indexed for years and years which suddenly disappeared from the index with no explanation, even on the Search Console ("visited, not indexed"). Simple blog entries, lightweight pages, no JavaScript, no ads, no bad practices, https enabled, informative content that is linked from elsewhere including well indexed websites (some entries even performed well on Reddit). At the same time, for the past few years I've found Google search to be a less and less reliable tool because the results are less often what I need.

Anyway, let's hope this new policy can improve things a little.

Yes please! It's very annoying how clicking an FB or Insta result from a Google search result would disallow going back to the search result!

Some Microsoft sites have been very guilty of this. They are the ones that stick in my head in recent memory.

> We believe that the user experience comes first

Bold coming from the company who gives me the most confusing “Open in app” prompts that are designed to confuse you and get you to use their app rather than the web

https://mjtsai.com/blog/2024/03/29/those-obnoxious-sign-in-w...

Click on any Youtube video from any web in android. If you press anything that is not the back button immediately, you will loose the option to go back.

So this coming from google... it's funny. Welcome, but funny.

This seems like a good time to advertise the post/redirect/get pattern.

https://en.wikipedia.org/wiki/Post/Redirect/Get

Not strictly about hijacking back navigation but it can make experience less bumpy if you've got form submissions in the middle of the path.

Ironically the only place I encounter this is using google news, where news sites seem to detect you're in google news (I don't think these same sites do it when I'm just browing normally?), and try to upsell you their other stories before you go back to the main page.

Thank you!

One of the worst is TikTok, even as a developer, when someone sends me a TikTok link and I have to visit it, I get stuck in the browser (same with the app but I uninstalled it), and it feels almost device-breaking the way they trap you in.

too little, too late. The API for interacting with the back button in Javascript should never have existed in any capacity.

Porno sites do this thing where every click is a new tab and when you refocus the previous tab, it reloads to an ad.

Or so I have been told.

A browser feature I wasn't aware of for too long: long press the back button, to get a list of recent URLs, allowing you to skip anything trying to hijack the back button.

I understand this is vague on purpose but wish there was more detail. E.g., if I am running a game in a webgl canvas and "back button" has meaning within the game UI which I implement via history states, is my page now going to be demoted? This article doesn't answer that at all.

Frustrating it took this long for something to be done about this, but glad its now got something being done.

I would like to mention that Google own SPA framework, angular, has redirect routes which effectively do back button hijacking if used, because they add the url you're redirecting from to the history.

https://angular.dev/guide/routing/redirecting-routes

I hope this applies to Android as well. Reddit is a particularly egregious offender.

But the question is: why are sites allowed to hijack the Back Button?!?

> We believe that the user experience comes first.

Excuse me??

Took long enough. Maybe I missed it, but I didn’t see them say how invested they are in tackling this. Promoting a rule is one thing, but everything SEO related becomes a cat and mouse game. I don’t have high confidence that this will work.

Almost 30 years ago I wrote an article advocating for domain level back button with a quasi mode like ctrl to traverse domains.

Would have fixed this. Too late now

Now do the Amazon app.

Number of times I've looked for something on my phone, gone through to a product page on Amazon but then have had to back out multiple times to get back to the search listing. Sometimes it's previously viewed products, sometimes it's "just" the Amazon home page. It should be one-and-done.

eBay too. I'm sure there are others.

Is there not a plugin that helps to fix this?

> Why are we taking action? We believe that the user experience comes first.

What's the real reason?

This would have been great back when I used a search engine to visit web pages.

How does this work? How can a site inject a totally different site into the history? I thought eg the History API only lets you add to the stack and pop, not modify history?

Why not fix this at the browser level? E.g. long or double click on back button = go to previous non-javascript-affected page (I mean by that: last page navigated to in the classical sense, ignoring dynamic histories altered by js and dynamic content)

Amazing change, fighting with the back button is my least favorite part of the ad web and a blindspot for ublock. I wonder how Google is going to track this and if SPA style react router sites would be downranked because of the custom back button behavior. I doubt it due to their popularity but I'm curious how they're going to determine what qualifies as spam

Does this also apply to sites like instagram that simply erase your entire back button history if you visit the site.

This is great. Can Google also stop scroll hijacking?

I'm at a stage when I click back button extremely rarely and is amazed when it works as I expected.

Google should probably talk to Microsoft about this because for me they are the biggest offenders with this back button hijacking in their support forums.

So someone developed a malicious plugin to achieve this? Otherwise, I can't imagine how they could bypass the browser to do this.

Maybe we can get facebook finally drop this dark pattern

Phew. for a moment there i thought they would start blocking alternate uses of the back button in apps (for like when it means "go back" and when it means "close everything")

That would have severely rustled my jimmies

Ironically, we have an infringing website right now on the front-page of HN (nypost).

i wonder if this includes sites that do auto-redirect: A -> B (auto-redirect) -> C

if i'm on page C and go back, page B will take me to page C again. i think this is more about techincal incompetence rather than malicious intent, but still annoying.

So why don't google just disable the possibility of hijacking the back button in Chrome, to give an example?

Reddit! I'm looking at you?

Great! So they'll fix the back button bugs on YouTube, and return me to the previous set of video recommendations when I use it on the homepage, right? Right? And let me return to the actual site when it detects that I lost the web connection for 0.01 seconds and hides all the content, and I then press the back button?

Cool, now maybe let's do something about all the shit I have to clear out out my face before I can read a simple web page. For example, on this very article I had to click "No thanks" for cookies and then "No thanks" for a survey or something. And then there was an ad at the top for some app that I also closed.

It's like walking into some room and having to swat away a bunch of cobwebs before doing whatever it is you want to do (read some text, basically).

>We believe that the user experience comes first

I’ll believe that when YouTube gives me the ability to block certain channels versus “not interested” and “don’t recommend channel” buttons that do absolutely nothing close to what I want.

Or a thousand other things, but that one in particular has been top of mind recently.

Instagram comments page requires 2 quick back press or else it won't take to previous page

is there a policy on "home button hijacking"?

I'm tired of apps that intercept home button to ask "are you sure?" - home button is home button, return me to the main phone screen

also, ads at the bottom of the screen, so that if you miss home button you open a website

Are they considering all uses of window.history.pushState to be hijacking? If so, why not remove that function from Chrome?

Now, if they only declared scroll hijacking as spam...

that's crazy things goin on

Now to prevent scroll bar hijacking.

will google really punish sites for doing this? and if so how do i report a site? i guess i could email the site with the google link and suggest they fix it first

> We believe that the user experience comes first.

If by "user" you mean advertisers, sure you do. Everyone else is an asset to extract as much value from as possible. You actively corrupt their experience.

The fact these companies control the web and its major platforms is one of the greatest tragedies of the modern era.

> Notably, some instances of back button hijacking may originate from the site's included libraries or advertising platform. We encourage site owners to thoroughly review their technical implementation...

Hah. In my time working with marketing teams this is highly unlikely to happen. They're allergic to code and they far outnumber everyone else in this space. Their best practices become the standard for everyone else that's uninitiated.

What they will probably do is change that vanity URL showing up on the SERP to point to a landing page that meets the requirements (only if the referer is google). This page will have the link the user wants. It will be dressed up to be as irresistible as possible. This will become the new best practice in the docs for all SEO-related tools. Hell, even google themselves might eventually put that in their docs.

In other words, the user must now click twice to find the page with the back button hijacking. Even sweeter is that the unfettered back button wouldn't have left their domain anyway.

This just sounds like another layer of yet more frustration. Contrary to popular belief, the user will put up with a lot of additional friction if they think they're going somewhere good. This is just an extra click. Most users probably won't even notice the change. If anything there will be propaganda aimed at aspiring web devs and power users telling them to get mad at google for "requiring" landing pages getting in the way of the content (like what happened to amp pages).

Now if only they'd do this for Android apps that hijack the back button to pop up things, or say "are you sure you want to leave?"

Google should actually fix this from the browser side instead of trying to seriously punish potentially buggy sites.

I don't trust Google.

We need to go back to an independent and competent research group designing standards. Right now Google pwns and controls the whole stack (well, not really ALL of it 1:1, but it has a huge influence on everything via the de-facto chrome monopoly).

Remember how Google took out ublock origin. They also lied about this aka "not safe standards" - in reality they don't WANT people to block ads.

Great. Now do Android phones...

Now do paywalls next.

[dead]

[dead]

Easy fix:

JS doesn't let you change back button behaviour.

Q. But what about SPA?

A. Draw your own app-level back button top left of page.

Another solution: make it a permisson.