It used to be like that when they still used "/url?..." redirect links, which have the destination URLs clearly exposed. Maybe it's an intended feature for checking out where does the link leads to. That behavior can be prevented by browser extensions.
Now, on desktop Firefox (private browsing mode, logged out), I see that it always links to the opaque goto URLs, instead of only overwriting on interaction.
Using Google Search while logged in on Chrome Android still presents the older non-opaque /url?... links though.
It's unfortunate that we cannot immediately inspect what the link will lead to, whether the link is the intended (and safe/expected) destination or not.
I encountered that on Firefox (with privacy setting both on strict, and I think also on default protection last time I encountered that) both on Android and desktop, and also Safari (iOS). Not sure about Chrome though.
- Censorship bypass tools triggering destination server's firewall (suspicious TLS fingerprint or connection characteristics, or bad proxy IP)
- Bad ISP (e.g. one ISP IP address or range of addresses shared by so many users that could create collateral damage if one or more user gone rogue)
- Actual botnet/hidden residential proxy exit node on the same IP/local network (e.g. TV boxes or SDKs embedded inside apps that users are not aware of)
- Strict privacy settings (unlikely to cause 403 straight away), or obscure browsers (also unlikely, but can trigger firewall because of connection fingerprint/characteristics)
Your 4th hypothesis is equivalent, not "other," to mine. But I agree that it could be anything you mentioned, as all of them have crossed my mind as possible reasons why I experience "verifying you are human" and "find the motorcycles / busses / traffic lights" more often on my residential ISP than on my cellular or work ISPs, and the unknown botnet/exit node seems most probable (by far) when considering my own traffic. I never have the 403 problem discussed here, luckily.
Okay, I've figured it out, thanks to the "test distros online" thingy to test version 145 and 148 as I previously mentioned.[0]
From Firefox 148 release notes for developers:[1]
> The overflow, overflow-x, and overflow-y CSS properties can now be used on replaced elements such as images, in the same way that they are used with other elements. Prior to this, replaced elements were always clipped to their bounding container. (Firefox bug 1999100).
Now, on desktop Firefox (private browsing mode, logged out), I see that it always links to the opaque goto URLs, instead of only overwriting on interaction.
Using Google Search while logged in on Chrome Android still presents the older non-opaque /url?... links though.
It's unfortunate that we cannot immediately inspect what the link will lead to, whether the link is the intended (and safe/expected) destination or not.
reply