Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why do most browsers store browsing history by default? It seems like people often have to go to the hassle of manually deleting their history or using incognito mode. Are there some major advantages to storing this data in most cases?

share|improve this question
51  
Because people also wants usability. – Benoit Esnard Jan 15 at 16:38
22  
Security at the expense of usability comes at the expense of security (Avid's rule of Usability: security.stackexchange.com/a/6116/485) – Oasiscircle Jan 15 at 16:46
9  
"It seems like people often have to go to the hassle of manually deleting their history or using incognito mode." I would go as far as saying that 99% of users don't even know that such a thing exists. For use 1 percenters, I think that Ctrl+Shift+Delete isn't too difficult to remember; unless you are referring to mobile browsers in your question :) – MonkeyZeus Jan 15 at 20:04
14  
The "back" button requires at least one line of history, more if you want to allow repeated "back"s – Hagen von Eitzen Jan 15 at 20:46
8  
Because most people like having some record of sites they've visited, so that they can return to them more easily in the future should they want to. I'd even dare to say that the vast majority of security-conscious people run with history on most of the time. (I certainly do.) For other times, you do private browsing-mode, privacy-enhancing extensions you can enable, etc. The way you asked your question presumes that most people share your values of giving ultra-high priority to preserving privacy vs. other considerations; they don't. – halfinformed Jan 15 at 22:13
up vote 54 down vote accepted

There are a lot of advantages. Here are some:

  1. Auto-completion of previously visited URLs you forgot, which can speed up the web surfing process tremendously. You might have remembered parts of a URL or website title, and your browser can usually pick those up if you typed them in. I love this feature.
    • This can offer extra security. As mentioned by kasperd, it can greatly reduce the risk of typosquatting.
  2. Storing previously-loaded data in a cache to speed up web-browsing. Great for slow connections. Great for reducing load on web servers.
  3. Storing cookies so websites remember your login information, etc.
share|improve this answer
28  
Auto-completion of URLs can even be beneficial to security because it reduce the risk of typosquatting. – kasperd Jan 15 at 20:24
1  
@kasperd Good thinking! – Mark Buffalo Jan 15 at 20:26
4  
Citation, ref. point 2, it's built into the HTTP protocol that clients can cache HTTP responses. Paraphrasing Section 13: "Caching would be useless if it did not significantly improve performance.The goal of caching in HTTP/1.1 is to eliminate the need to send [full requests and responses, reducing network round-trips and network bandwidth requirements]". Cache != browser history, but they overlap. (And in dialup days, a history allowed some level of offline browsing). – TessellatingHeckler Jan 15 at 21:35
3  
Also, HSTS and HPKP would only work if the browser stores a history of sites that it has visited in the past. – Lie Ryan Jan 16 at 1:39
2  
Every now and then, I also pull up my own history and search through it to try to find a page I visited in the past but can't remember in detail. – Kevin Jan 17 at 3:17

The HTML standard is that unvisited links and previously-visited links are styled differently. By default in most browsers, an unvisited link is blue and a visited link is pink, but nearly every web page these days overrides that. In order to do this, you have to have a list of previously visited links so that you know what style to use for every link on every page, which is to say a browser history.

share|improve this answer
1  
You do not need a list of visited links, you merely need a method that recognizes a links as visited. I could imagine that such a compare-only history (for limited time) could be implemented differently (Bloom filters) – Hagen von Eitzen Jan 15 at 20:52
4  
Actually, the standards (I'm looking at w3.org/TR/css3-selectors section 6.6.1.1) explicitly point out the privacy problem with allowing visited links to have a different style (which can allow a site's Javascript to find out whether a particular foreign URL has been visited or not) and explicitly allows browsers to take steps to plug this hole: "UAs may therefore treat all links as unvisited links, or implement other measures to preserve the user's privacy". – Henning Makholm Jan 16 at 9:24
    
@HenningMakholm: The distinction between visited and unvisited links long predates the relevant vulnerability (let alone the recognition of it). – ruakh Jan 17 at 4:14

Because it fits the majority

Surveys (e.g. http://www.aleecia.com/authors-drafts/tprc-behav-AV.pdf) show that something like ~25% of people have ever used incognito mode and ~50% of people have ever cleared browser history.

Needless to say, many of them don't do that all the time, so at any given moment a majority of users prefer to use a mode that does store browsing history, thus it's reasonable to enable it by default.

share|improve this answer
    
A follow up study should be: what percentage of people even know how to enable incognito mode or clear their browser history? – NotMe Jan 15 at 20:04
6  
That's like saying that few people only "use" an airbag in their car, hence a majority f people prefer not to have an airbag in their car. – Hagen von Eitzen Jan 15 at 20:54
2  
I don't buy this at all. For example, surveys show that much fewer than 25% of people have ever had a million dollars in their bank accounts but that doesn't mean that the majority of people prefer not being millionaires. I'd also considered exactly the same example as @HagenvonEitzen but he got their first! – David Richerby Jan 15 at 20:55
1  
@DavidRicherby 100% of people have a browser that can do that. Not only most of them didn't use it, most of them that have tried it don't use day to day - it does show an intentional preference. I'm sure that the users who tried are very happy for the feature existing when they need it, but most of the time they turn it off because it's more convenient. – Peteris Jan 15 at 20:59
1  
@DavidRicherby winlab.rutgers.edu/~janne/WPES14-privatebrowsing.pdf shows that ~1/3 of people are not informed about private browsing, so some 66% are not ignorant. crypto.stanford.edu/~dabo/papers/privatebrowsing.pdf shows that ~ 6% of sessions use private browsing. So, speaking very roughly about averages, non-ignorant people still use non-private browsing 9 times out of 10. – Peteris Jan 15 at 21:12

Typically, if you know ahead of time that you're going to want to revisit a page in the future, you'd add it to your favourites/bookmarks. The history feature is there for when you suddenly realise you want to revisit a page you were on yesterday / a week ago / a month ago. It is too late to turn the feature on.

Yes, from a security perspective it seems foolish to have the history be effectively opt-out rather than opt-in … but, if it weren't, the feature would be completely useless altogether. That's the constraint.

share|improve this answer
1  
After reading the question above, it struck me that I've never bookmarked this web site. I just type "sec" into the title bar of my web browser and hit return. That's actually easier than bookmarking web sites these days. – Simon B Jan 17 at 22:37
    
@SimonB: I use the bookmarks bar to great effect on SE, but your observation matches the way I use some other sites regularly. – Lightness Races in Orbit Jan 17 at 22:54

Almost all web browsers implement caching, so they technically have to manage a list of what is in the cache anyway. While the history feature nowadays might be implemented separately, and while you could build a cache that does not make deriving a history from it without analysing the cached content trivial (by using hashes instead of URLs as cache keys), for historic web browsers it was an opportunity to implement two features at once. And as someone mentioned, you need some history to implement a back button, and that feature - and caching the page the back button got you to - was even more necessary back then than now. So even if a modern browser lets you opt out of displaying that history, it is then just pretending not to have that information stored..

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.