Firefox to Block All 3rd Party Trackers by Default • Hacker News Board

Re: Firefox to Block All 3rd Party Trackers by Default

#71

Post by scrollaway » Fri, Feb 22, 2019, 12:38 PM UTC

wbxrs wrote: post #32

zaarn wrote: post #29

Earlier quoted context omitted.

What if the website told the browser to load malware? Browsers in the modern web need to defend the user, not execute arbitrary instructions from random websites that nobody cares about.

A website cannot tell a browser to "load malware", unless we're talking about a exploit, which should be patched. (Please don't say "if I send you a malformed png file you have to execute the exploit, otherwise your argument breaks down".)

Malware is software that is explicitly designed to disrupt, damage, or gain unauthorized access to a machine.

You are covering the unauthorized access but disrupting/damaging is absolutely possible using plain old HTML and JS.

Privacy advocates argue that it's not only possible but many trackers are guilty of exactly that.

So the browser is in fact blocking malware.

... And yes, if you think about it, that definition does apply to ads as well. Really says something doesn't it :)

Re: Firefox to Block All 3rd Party Trackers by Default

#72

Post by Yoric » Fri, Feb 22, 2019, 12:43 PM UTC

rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

Note that Mozilla has been working on that feature for at least five years. For a very long time, it was not possible to land this without breaking gazillions of sites.

Apple can afford to be more aggressive, and force features such as ITP 2+, because of their iOS monopoly, and expect webdevs to scramble for fixes, but Mozilla doesn't have such leverage, so they need to avoid breaking the web.

Re: Firefox to Block All 3rd Party Trackers by Default

#73

Post by reitanqild » Fri, Feb 22, 2019, 12:43 PM UTC

aboutruby wrote: post #67

Jonnax wrote: post #47

Earlier quoted context omitted.

Nah. People making decisions don't care. Firefox usage will be reported as super low, and it won't be tested.

And users who report having issues with Firefox will be told to use Chrome (that is what's already happening)

And we will shout back : )

I'm already on it as might be seen here.

Feel free to complain loud and clear if it doesn't work in FF. Make it clear that FF support isn't optional.

Also on my to do list: complain even more, including to relevant authorities about Googles abuse of market position to push their browser. Feel free to join me here as well.

(And to be sure: feel free to complain when supposedly mainstream sites doesn't work in any major browser - safari, edge, FF and even Chrome : )

Re: Firefox to Block All 3rd Party Trackers by Default

#74

Post by phkahler » Fri, Feb 22, 2019, 12:45 PM UTC

darkpuma wrote: post #34

rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.

>> I, and probably many other users, have begun blocking all first-party cookies by default.

So this change should have no effect on you right? You're blocking all cookies? I like that idea, but how many things does it break?

Re: Firefox to Block All 3rd Party Trackers by Default

#75

Post by islon » Fri, Feb 22, 2019, 12:45 PM UTC

senorjazz wrote: post #69

darkpuma wrote: post #34

Earlier quoted context omitted.

I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.

I've never used umatrix and just stuck with noscript over the years due to the lengthy process of allowing scripts / domains, going through random external scripts required to make pages work that are not self-explanatory. Is there anything in umatrix to make the switch worthwhile?

I use uMatrix since 2 years or so and it works out of the box for 70/80% of websites. By working I mean they are not completely broken.

For the ones that don't work it's normally 1 or 2 clicks in the UI to allow some 3rd parties and save it.

Sometimes a site works by default in the "broken" state but as soon as I give it more permissions it breaks by adding a paywall or some modal window.

uMatrix is like linux: it requires more work upfront but give you more control and customization options.

Re: Firefox to Block All 3rd Party Trackers by Default

#76

Post by drukenemo » Fri, Feb 22, 2019, 12:46 PM UTC

darkpuma wrote: post #34

rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.

I don't believe that many users are blocking first-party cookies. Source: I'm a web analyst managing large sites and can see how many visitors block all cookies. It's minimal. Also blocking first-party cookies requires a degree of tech-savviness and it prevents many websites from working properly.

Re: Firefox to Block All 3rd Party Trackers by Default

#77

Post by reitanqild » Fri, Feb 22, 2019, 12:47 PM UTC

darkpuma wrote: post #36

traderjane wrote: post #19

Firefox's Container's approach has been quite interesting to use, but if a suggestion could get out to the Firefox team, I would advise improved streamlining of workflow for the extension, including with sync and returning browser setup, and for organizing and setting up new containers (configuring them to always open for a domain, putting them in folders).

Yeah the UX of Multi-Account Containers is awful. The number of steps the user is required to follow to make a website always open in a particular container is absurd. 1) Create a new container 2) Open a new tab with that container 3) Open the website in that container 4) Check "Always open in [container name]" 5) Open a new tab and load that page again. 6) Click "Remember my decision" 7) Click "Open in [container na…

> Also, why a limit of 8 colors and 12 icons? Why not an arbitrary number of colors and user definable icons?

If I had to guess it would be UX designers: users are really dumb so lets make sure we make this simple enough.

Of course they don't say these words but sometimes I feel this attitude shines through everywhere :-/

Re: Firefox to Block All 3rd Party Trackers by Default

#78

Post by phkahler » Fri, Feb 22, 2019, 12:49 PM UTC

fimdomeio wrote: post #11

One thing mentioned on the responses that might be really concerning is the fact that this will mean that for a lot of analytics it will look like firefox usage is close to zero. No usage data, devs caring less about firefox, users having more problems when using firefox, less users using firefox, less users having 3rd party trackers blocked, chrome monopoly growing.

Websites can look at their own usage stats. As with some other aspects of this, people will have to actually do some work in-house.

Re: Firefox to Block All 3rd Party Trackers by Default

#79

Post by pdkl95 » Fri, Feb 22, 2019, 12:52 PM UTC

fimdomeio wrote: post #11

One thing mentioned on the responses that might be really concerning is the fact that this will mean that for a lot of analytics it will look like firefox usage is close to zero. No usage data, devs caring less about firefox, users having more problems when using firefox, less users using firefox, less users having 3rd party trackers blocked, chrome monopoly growing.

> this will mean ... No usage data

This presupposes that the current tracking (spyware) data is a reasonably accurate representation of reality. This assumption could be tested by comparing the "analytics" data to the server logs. but who wants to use accurate first-party data when delusions about "analytics" can tell you what you want to hear.

Re: Firefox to Block All 3rd Party Trackers by Default

#80

Post by drukenemo » Fri, Feb 22, 2019, 12:55 PM UTC

salawat wrote: post #54

anc84 wrote: post #10

What is a "tracker" here? How will Firefox determine that?

A tracker is a script included as part of a webpage's content, often utilizing some combination of tracking pixels (an http request for a 1x1 image file from the tracking script's providers domain), a persistent cookie, and increasingly some form of browser/device fingerprint which is used to identify a particular machine. The user's machine presents back to the tracking network the cookie and a bunch of http params…

But Firefox also identify as trackers APIs - see here https://ibb.co/QFXYjhL

Firefox uses the Disconnect blocking list to determine what is tracking, and Disconnect doesn't only filter out cookies.

https://support.mozilla.org/en-US/kb/content-blocking

"Disconnect Private Browsing automatically detects when your browser tries to make a connection to anything other than the site you are visiting. We call these other attempted connections “network requests" https://disconnect.me/help