10

Why do most browsers store browsing history by default? It seems like people often have to go to the hassle of manually deleting their history or using incognito mode. Are there some major advantages to storing this data in most cases?

unor
  • 1,769
  • 1
  • 19
  • 39
Esteemator
  • 242
  • 2
  • 8

5 Answers5

54

There are a lot of advantages. Here are some:

  1. Auto-completion of previously visited URLs you forgot, which can speed up the web surfing process tremendously. You might have remembered parts of a URL or website title, and your browser can usually pick those up if you typed them in. I love this feature.
    • This can offer extra security. As mentioned by kasperd, it can greatly reduce the risk of typosquatting.
  2. Storing previously-loaded data in a cache to speed up web-browsing. Great for slow connections. Great for reducing load on web servers.
  3. Storing cookies so websites remember your login information, etc.
Community
  • 1
Mark Buffalo
  • 22,508
  • 8
  • 74
  • 91
  • 30
    Auto-completion of URLs can even be beneficial to security because it reduce the risk of [typosquatting](https://en.wikipedia.org/wiki/Typosquatting). – kasperd Jan 15 '16 at 20:24
  • 3
    @kasperd Good thinking! – Mark Buffalo Jan 15 '16 at 20:26
  • 5
    Citation, ref. point 2, it's built into the HTTP protocol that clients can cache HTTP responses. Paraphrasing [Section 13](https://www.ietf.org/rfc/rfc2616.txt): *"Caching would be useless if it did not significantly improve performance.The goal of caching in HTTP/1.1 is to eliminate the need to send [full requests and responses, reducing network round-trips and network bandwidth requirements]"*. Cache != browser history, but they overlap. (And in dialup days, a history allowed some level of offline browsing). – TessellatingHeckler Jan 15 '16 at 21:35
  • 3
    Also, [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) and [HPKP](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) would only work if the browser stores a history of sites that it has visited in the past. – Lie Ryan Jan 16 '16 at 01:39
  • 2
    Every now and then, I also pull up my own history and search through it to try to find a page I visited in the past but can't remember in detail. – Kevin Jan 17 '16 at 03:17
12

The HTML standard is that unvisited links and previously-visited links are styled differently. By default in most browsers, an unvisited link is blue and a visited link is pink, but nearly every web page these days overrides that. In order to do this, you have to have a list of previously visited links so that you know what style to use for every link on every page, which is to say a browser history.

Mike Scott
  • 10,134
  • 1
  • 28
  • 35
  • 1
    You do not need a list of visited links, you merely need a method that recognizes a links as visited. I could imagine that such a compare-only history (for limited time) could be implemented differently (Bloom filters) – Hagen von Eitzen Jan 15 '16 at 20:52
  • 4
    Actually, the standards (I'm looking at http://www.w3.org/TR/css3-selectors/ section 6.6.1.1) explicitly point out the privacy problem with allowing visited links to have a different style (which can allow a site's Javascript to find out whether a particular foreign URL has been visited or not) and _explicitly allows browsers_ to take steps to plug this hole: "UAs may therefore treat all links as unvisited links, or implement other measures to preserve the user's privacy". – hmakholm left over Monica Jan 16 '16 at 09:24
  • @HenningMakholm: The distinction between visited and unvisited links long predates the relevant vulnerability (let alone the recognition of it). – ruakh Jan 17 '16 at 04:14
6

Because it fits the majority

Surveys (e.g. http://www.aleecia.com/authors-drafts/tprc-behav-AV.pdf) show that something like ~25% of people have ever used incognito mode and ~50% of people have ever cleared browser history.

Needless to say, many of them don't do that all the time, so at any given moment a majority of users prefer to use a mode that does store browsing history, thus it's reasonable to enable it by default.

Peteris
  • 8,389
  • 1
  • 27
  • 35
  • A follow up study should be: what percentage of people even know how to enable incognito mode or clear their browser history? – NotMe Jan 15 '16 at 20:04
  • 6
    That's like saying that few people only "use" an airbag in their car, hence a majority f people prefer not to have an airbag in their car. – Hagen von Eitzen Jan 15 '16 at 20:54
  • 2
    I don't buy this at all. For example, surveys show that much fewer than 25% of people have ever had a million dollars in their bank accounts but that doesn't mean that the majority of people prefer not being millionaires. I'd also considered exactly the same example as @HagenvonEitzen but he got their first! – David Richerby Jan 15 '16 at 20:55
  • 1
    @DavidRicherby 100% of people have a browser that can do that. Not only most of them didn't use it, most of them that *have* tried it don't use day to day - it does show an intentional preference. I'm sure that the users who tried are very happy for the feature existing *when* they need it, but most of the time they turn it off because it's more convenient. – Peteris Jan 15 '16 at 20:59
  • @Peteris Doesn't ignorance seem like a more probable explanation than a decision not to use the feature? – David Richerby Jan 15 '16 at 21:02
  • @DavidRicherby yes, ignorance explains a large quantity that has never tried the feature. It doesn't explain people who have tried it but don't use it - I mean, even if we discount those who have tried but might have forgotten, people who use incognito mode frequently but occasionally (and thus are definitely not ignorant) outnumber people who use it all the time or most of the time. – Peteris Jan 15 '16 at 21:05
  • 1
    @DavidRicherby http://www.winlab.rutgers.edu/~janne/WPES14-privatebrowsing.pdf shows that ~1/3 of people are not informed about private browsing, so some 66% are not ignorant. http://crypto.stanford.edu/~dabo/papers/privatebrowsing.pdf shows that ~ 6% of sessions use private browsing. So, speaking very roughly about averages, non-ignorant people still use non-private browsing 9 times out of 10. – Peteris Jan 15 '16 at 21:12
2

Typically, if you know ahead of time that you're going to want to revisit a page in the future, you'd add it to your favourites/bookmarks. The history feature is there for when you suddenly realise you want to revisit a page you were on yesterday / a week ago / a month ago. It is too late to turn the feature on.

Yes, from a security perspective it seems foolish to have the history be effectively opt-out rather than opt-in … but, if it weren't, the feature would be completely useless altogether. That's the constraint.

Lightness Races in Orbit
  • 2,163
  • 2
  • 15
  • 15
  • 1
    After reading the question above, it struck me that I've never bookmarked *this* web site. I just type "sec" into the title bar of my web browser and hit return. That's actually easier than bookmarking web sites these days. – Simon B Jan 17 '16 at 22:37
  • @SimonB: I use the bookmarks bar to great effect on SE, but your observation matches the way I use some other sites regularly. – Lightness Races in Orbit Jan 17 '16 at 22:54
1

Almost all web browsers implement caching, so they technically have to manage a list of what is in the cache anyway. While the history feature nowadays might be implemented separately, and while you could build a cache that does not make deriving a history from it without analysing the cached content trivial (by using hashes instead of URLs as cache keys), for historic web browsers it was an opportunity to implement two features at once. And as someone mentioned, you need some history to implement a back button, and that feature - and caching the page the back button got you to - was even more necessary back then than now. So even if a modern browser lets you opt out of displaying that history, it is then just pretending not to have that information stored..

rackandboneman
  • 975
  • 4
  • 9