Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Container for Firefox

mozilla.org

Post reply on HN
Print view View original

391–400 of 406 posts

Re: Facebook Container for Firefox

#391

Post by eugeniub »

user5994461 wrote: post #385
eugeniub wrote: post #331

Earlier quoted context omitted.

I don't think it has so much to do with reCAPTCHA as much as it has to do with Cloudflare and website owners themselves. Most reCAPTCHA challenges come in the form of Cloudflare challenge passage pages. Website owners have 5 options to choose from regarding challenges:[1] — Essentially off: Challenges only the most grievous offenders — Low: Challenges only the most threatening visitors — Medium: Challenges both moder…

It doesn't ruin the experience of anyone except a couple of overly technical users and customers in the wrong locations. It's very good at blocking malicious traffic though and it's totally worth losing a pair of users for that.

Yes, it's the users that are wrong!

Re: Facebook Container for Firefox

#392

Post by __blockcipher__ »

cornholio wrote: post #200

Third party cookies, and any way to fingerprint a specific user starting from high entropy user agents to screen resolution, font fingerprinting or canvas data, should be considered a breach of the browser security model. All sites should run in containers and no advertiser should be able to track you across sessions. When I want 3rd party interaction, I should need to opt in and connect the current site with Faceboo…

Wow. Obviously this idea gets thrown around HN a lot, but you deserve props for phrasing it so perfectly.

Re: Facebook Container for Firefox

#393

Post by bzbarsky »

Tepix wrote: post #220
cornholio wrote: post #200

Third party cookies, and any way to fingerprint a specific user starting from high entropy user agents to screen resolution, font fingerprinting or canvas data, should be considered a breach of the browser security model. All sites should run in containers and no advertiser should be able to track you across sessions. When I want 3rd party interaction, I should need to opt in and connect the current site with Faceboo…

Indeed. Safari blocks 3rd party cookies by default, I see no reason why Firefox can't do the same. The fact that they don't is a direct contradiction to their claims that they care about user privacy. The only explanation I have is that they do not want to anger their long-time money sources Google and other advertisers.

Safari's third-party cookie blocking is not the same as Firefox's, last I checked.

Firefox just blocks them. Safari blocks them unless you visited that site in a first-party context. Shipping the thing Firefox implements breaks a lot more than what Safari ships.

So for example, if you visited facebook normally, third-party Facebook cookies won't get blocked in Safari.

Firefox _could_ ship the same thing as Safari. The upshot is entrenching existing monopolies, because only big enough players are then able to track you via third-party cookies.... This is the main reason Firefox hasn't done this, as far as I know.

Disclaimer: I work on Firefox, but not on the cookie bits.

Re: Facebook Container for Firefox

#394

Post by dingo_bat »

dao- wrote: post #316
dingo_bat wrote: post #141

Earlier quoted context omitted.

Apple makes 97% of its revenue from Google? Because Mozilla does. Your comparison is not valid. Source: https://www.mozilla.org/en-US/foundation/annualreport/2016/

What I said is perfectly valid. Parent company is a well-defined term that doesn't apply here. Now, may Google try to put pressure on Mozilla? Sure. Would Mozilla obey? Possibly...? None of this means that this has actually happened or will happen. Stop spreading conspiracy theories.

> Now, may Google try to put pressure on Mozilla? Sure.

There is an implicit pressure when the existence of the company depends on one entity.

> Would Mozilla obey? Possibly...?

Would they rather put 100s of people out of a job? Close down shop? Because 97% reduction in revenue can cause that.

Re: Facebook Container for Firefox

#395

Post by loeg »

andai wrote: post #68
loeg wrote: post #61

Earlier quoted context omitted.

I've definitely run into problems with ecommerce sites (really just Tarsnap) and embedded iframes from 3rd party payment services, while using the Chrome equivalent of this Firefox setting.

How do you do this in Chrome?

chrome://flags/#enable-site-per-process

Strict site isolation > Enable.

Re: Facebook Container for Firefox

#396

Post by loeg »

cperciva wrote: post #213
loeg wrote: post #61

Earlier quoted context omitted.

I've definitely run into problems with ecommerce sites (really just Tarsnap) and embedded iframes from 3rd party payment services, while using the Chrome equivalent of this Firefox setting.

In case it's useful: This was due to a bug in Chrome which has since been fixed. (Chrome was losing the "POST" flag when sending a redirect message between processes.)

Any idea what version of Chrome fixed it? I refill my Tarsnap balance only occasionally.

Re: Facebook Container for Firefox

#397

Post by cperciva »

loeg wrote: post #396
cperciva wrote: post #213

Earlier quoted context omitted.

In case it's useful: This was due to a bug in Chrome which has since been fixed. (Chrome was losing the "POST" flag when sending a redirect message between processes.)

Any idea what version of Chrome fixed it? I refill my Tarsnap balance only occasionally.

The bug was fixed on January 26th and was being merged to older supported branches expeditiously -- I don't know the exact version numbers but I'm sure that any releases they rolled after mid-February would have the fix.

Re: Facebook Container for Firefox

#398

Post by dao- »

dingo_bat wrote: post #394
dao- wrote: post #316

Earlier quoted context omitted.

What I said is perfectly valid. Parent company is a well-defined term that doesn't apply here. Now, may Google try to put pressure on Mozilla? Sure. Would Mozilla obey? Possibly...? None of this means that this has actually happened or will happen. Stop spreading conspiracy theories.

> Now, may Google try to put pressure on Mozilla? Sure. There is an implicit pressure when the existence of the company depends on one entity. > Would Mozilla obey? Possibly...? Would they rather put 100s of people out of a job? Close down shop? Because 97% reduction in revenue can cause that.

It's quite unlikely that the options would be as clear cut as "delete the Google container addon or close down Mozilla." Note that Mozilla has just recently operated roughly two years I think without a contract with Google.

Re: Facebook Container for Firefox

#399

Post by dao- »

kgoutham93 wrote: post #387
dao- wrote: post #108

Earlier quoted context omitted.

As the page explains: it prevents Facebook from tracking you across the Web.

No I read it, but I want to understand the technical details like how is this different from using Facebook in incognito window.

Using Facebook in private windows only is a reasonable workaround that achieves roughly the same if you're disciplined. The addon is more user friendly.

Re: Facebook Container for Firefox

#400

Post by afx »

vidyesh wrote: post #148
epsilon_machine wrote: post #127

Earlier quoted context omitted.

What about browser fingerprinting ( https://panopticlick.eff.org/ )? Unless you are using the Tor browser, this appears "uncontainable" especially for folks not using Chrome over Windows 10 or another super generic combination.

Blocking your canvas to avoid being fingerprinted/tracked is like walking under the CCTV with a hoodie and cap on. Unless everyone under the CCTV does the same you will not be detected but will be tracked. It might be hard to identify you but you will standout. So instead of standing out of the crowd why not disguise so well that the tracker doesn't know the real you. The idea is to use something that gives a fake re…

> The idea is to use something that gives a fake readout of your fingerprint thus making you look normal but keep changing it occasionally so it leads no where for long time.

What is "normal" in this case? One correct way to counter fingerprinting is to standardize the fake readouts to a specific value and not change it every so often. So if everyone's browser is reporting the same value for this feature that feature will become meaningless in the context of fingerprinting since its entropy is very low.

That's what Tor Browser has been doing with font enumeration, reported windows size, screen resolution etc. - they all report the same value. On the other hand, you can correlate these values and identify Tor Browser users.

Post reply on HN