Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First-party isolation in Firefox: what breaks if you enable it?

ctrl.blog

Post reply on HN
Print view View original

81–90 of 120 posts

Re: First-party isolation in Firefox: what breaks if you enable it?

#81

Post by frenchy »

jimmaswell wrote: post #73
jasonkostempski wrote: post #40

Earlier quoted context omitted.

Advertise natively, don't track. It's that simple, no need for research. Our ancestors did it for hundreds of years. There is no acceptable level of tracking.

> There is no acceptable level of tracking. On what grounds do you make this sweeping absolute statement? I'm personally willing to accept lots of tracking by Google, Facebook, etc. in exchange for free or cheaper services.

It's fine that you are, but some of us are not. I'm fine seeing plain ads, just not traking ads. If the website owner doen't want to show plain ads then that's their choice.

(note, I don't use an ad blocker, just a tracking blocker)

Re: First-party isolation in Firefox: what breaks if you enable it?

#82

Post by user812 »

fredsir wrote: post #62

So after enabling it, is there some easy way to see if it actually works?

Go into your FF profile, open SiteSecurityServiceState.txt - it will show every HSTS entry separated into firstparty domains.

Similar, in the storage folder in your FF profile you can see that every firstparty website has it's own folder and third party cookies are places inside that folder and can not share data with other folders.

Re: First-party isolation in Firefox: what breaks if you enable it?

#83

Post by fredsir »

erinnh wrote: post #51

Ive been using it since Firefox 58, where they fixed a bug that broke cookie-whitelisting. Ive been pretty happy. The only website where it really is a problem is Playstation Network, but I have an addon that disables FPI when I really need to temporarily.

How can you tell it works? I've been trying now 5 times to enable it, and testing if it works. If I understand correctly, if I log in to gmail.com (mail.google.com), google.com should be logged in, but google.dk and youtube.com shouldn't since First-Party Isolation should be isolating them, but no matter how hard I try, it doesn't work. If I log in to mail.google.com, I get logged into youtube.com, google.com and google.dk.

Am I misunderstanding how it is supposed to work?

I've tried completely uninstalling firefox 5 times now - including wiping the profile from my machine - but the same thing keeps happening.

Re: First-party isolation in Firefox: what breaks if you enable it?

#84

Post by CogitoCogito »

jedberg wrote: post #70

I've been doing this the hard way for years -- running four browsers at all times, each for different things. Chrome is logged into Google, Firefox is logged into Facebook, Safari is for HN/Reddit, and Chrome canary is for other random sites that I don't want to have already logged in, like when I use the AWS console. And then I also use incognito windows for going to forums and deal sites and all those sites known f…

I do something similar. For example, for Facebook I create a profile (using Firefox's profile manager which I access as `$ firefox --ProfileManager` from the command line, but I'm sure there's a simpler way) and I just call it "Facebook". Then I have a script called e.g. `firefox_facebook` like this:

    #!/bin/bash

    nohup /usr/lib/firefox-esr/firefox-esr \
        --no-remote \
        -P Facebook \
        1>/dev/null 2>&1 \
        &
Then I put a file like this in `/home/user/.local/share/applications/facebook.desktop`:

    [Desktop Entry]
    Type=Application
    Name=Facebook
    Icon=/home/user/.local/share/applications/facebook.ico
    Exec=/home/user/bin/facebook_facebook
I also even have an icon in there. The result is that I have a single Firefox profile devoted to facebook and it comes with an icon in my start menu with a facebook image (it's just one of their blue F facebook logos) which is totally isolated from everything else.

I also have a similar version which just copies an empty profile to a random folder in /tmp and then uses that freshly separated from everything else.

This seems like a complicated process, but it's trivial to add more in later and I can basically have as many as I want. I did it as a bit of an experiment to see if something like this feasible (not technically, but more socially). I.e. will I get lazy and stop using it soon. So far it's pretty easy and is a nice way to take webapps and basically devote a firefox profile to it in a way that makes it seem almost like an electron app, but without all the extra useless stuff.

Tldr: I do something similar except I only use Firefox and it's profiles.

edit: Also should say I run debian with cinammon desktop so this probably won't work for most people here, but something similar is probably possible on every system.

Re: First-party isolation in Firefox: what breaks if you enable it?

#85

Post by lima »

jedberg wrote: post #70

I've been doing this the hard way for years -- running four browsers at all times, each for different things. Chrome is logged into Google, Firefox is logged into Facebook, Safari is for HN/Reddit, and Chrome canary is for other random sites that I don't want to have already logged in, like when I use the AWS console. And then I also use incognito windows for going to forums and deal sites and all those sites known f…

I do the same thing, I just use different Chrome profiles (don't want to multiply my attack surface by using different browsers).

Re: First-party isolation in Firefox: what breaks if you enable it?

#87

Post by dang »

mixmastamyk wrote: post #76
jimmaswell wrote: post #73

Earlier quoted context omitted.

> There is no acceptable level of tracking. On what grounds do you make this sweeping absolute statement? I'm personally willing to accept lots of tracking by Google, Facebook, etc. in exchange for free or cheaper services.

Well, bootlickers are a thing, sure. We don't have to optimize for them.

Personal attacks will get you banned here. Please don't post like this again.

https://news.ycombinator.com/newsguidelines.html

Re: First-party isolation in Firefox: what breaks if you enable it?

#88

Post by flotzam »

fredsir wrote: post #83
erinnh wrote: post #51

Ive been using it since Firefox 58, where they fixed a bug that broke cookie-whitelisting. Ive been pretty happy. The only website where it really is a problem is Playstation Network, but I have an addon that disables FPI when I really need to temporarily.

How can you tell it works? I've been trying now 5 times to enable it, and testing if it works. If I understand correctly, if I log in to gmail.com (mail.google.com), google.com should be logged in, but google.dk and youtube.com shouldn't since First-Party Isolation should be isolating them, but no matter how hard I try, it doesn't work. If I log in to mail.google.com, I get logged into youtube.com, google.com and goo…

Cooperating websites can subvert first-party isolation by redirecting the top level page through multiple first-party domains (with an ID in the URL). And Google does exactly that when you login. How to properly prevent it is still an open question:

https://bugzilla.mozilla.org/show_bug.cgi?id=1319839

Re: First-party isolation in Firefox: what breaks if you enable it?

#90

Post by bugmen0t »

olliej wrote: post #77

The biggest problem is SSO and similar - especially across organizations that have multiple domains (think the various google properties for instance). Part of how they work is the login process cycling through multiple domains when you click the login button. Dealing with that, and making everything work without also making the same technique work for tracking is ... challenging.

every SSO is different. But mine all worked.
Post reply on HN