Firefox to Block All 3rd Party Trackers by Default • Hacker News Board

Re: Firefox to Block All 3rd Party Trackers by Default

#101

Post by blntechie » Fri, Feb 22, 2019, 2:06 PM UTC

darkpuma wrote: post #34

rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.

I just use incognito/private mode all the time for my browsing. Signing in each time is not really a big pain with password managers.

Re: Firefox to Block All 3rd Party Trackers by Default

#102

Post by folkrav » Fri, Feb 22, 2019, 2:17 PM UTC

reitanqild wrote: post #73

aboutruby wrote: post #67

Earlier quoted context omitted.

And users who report having issues with Firefox will be told to use Chrome (that is what's already happening)

And we will shout back : ) I'm already on it as might be seen here. Feel free to complain loud and clear if it doesn't work in FF. Make it clear that FF support isn't optional. Also on my to do list: complain even more, including to relevant authorities about Googles abuse of market position to push their browser. Feel free to join me here as well. (And to be sure: feel free to complain when supposedly mainstream sit…

We make noise, we will shout back, but even if the noise we're making eventually resolves to something positive, let's not kid ourselves, it will take _time_.

In the meantime, FF support (while, for now, relatively inexpensive/free if you just use web standards) will just continue being optional considering Chromium's quasi-monopoly.

Re: Firefox to Block All 3rd Party Trackers by Default

#103

Post by wodenokoto » Fri, Feb 22, 2019, 2:19 PM UTC

Yoric wrote: post #72

rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

Note that Mozilla has been working on that feature for at least five years. For a very long time, it was not possible to land this without breaking gazillions of sites. Apple can afford to be more aggressive, and force features such as ITP 2+, because of their iOS monopoly, and expect webdevs to scramble for fixes, but Mozilla doesn't have such leverage, so they need to avoid breaking the web.

Also, they got their ass handed to them in a smear campaign when they tried blocking 3rd party cookies the first time around in 2013 [1] and ended up accepting these by default again.

https://www.consumeraffairs.com/news/web-advertisers-attack-...

Re: Firefox to Block All 3rd Party Trackers by Default

#104

Post by DCKing » Fri, Feb 22, 2019, 2:23 PM UTC

wbxrs wrote: post #8

I think this is a bad idea. Even though I personally block 3rd party trackers by default, breaking the web by default will cause problems. Also, ad blocking will start being a problem when enough people start doing it. I still remember the days of no websites yelling at you for blocking their ads. Things are going to get much worse.

It's worth noting that historically that RFC 2109 and RFC 2965 specified that user agents should respect the user's privacy and not allow cross-server cookies. Since browsers have flat out ignored this recommendation since the beginning this never meant anything, and newer RFCs explicitly allow the default. But if we had been a little more prescient this mess could have been avoided.

It's also worth noting that anecdotically, blocking all third party cookies and running an adblocker has not lead to "breaking the web" in my personal use. I can count any issues I encountered on one hand, and I've run this setup for years. It might me that my internet use is weird (I don't believe so) but it makes me feel the consequences for users for this is overblown.

Re: Firefox to Block All 3rd Party Trackers by Default

#105

Post by maltalex » Fri, Feb 22, 2019, 2:33 PM UTC

adtac wrote: post #82

rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

I wish DNT was honoured, but it's as good as a "do not commit crime" sign.

It’s an Evil Bit: https://en.m.wikipedia.org/wiki/Evil_bit

Re: Firefox to Block All 3rd Party Trackers by Default

#106

Post by aembleton » Fri, Feb 22, 2019, 2:39 PM UTC

discreditable wrote: post #55

fimdomeio wrote: post #11

One thing mentioned on the responses that might be really concerning is the fact that this will mean that for a lot of analytics it will look like firefox usage is close to zero. No usage data, devs caring less about firefox, users having more problems when using firefox, less users using firefox, less users having 3rd party trackers blocked, chrome monopoly growing.

I run into a similar issue at work. I deploy ad-blockers on all student and staff machines. This makes our users invisible in Google Analytics. Supposedly our top browser is Mobile Safari.

Wouldn't it be easier to use something like PiHole to block requests to ad and analytics servers at the network level?

Re: Firefox to Block All 3rd Party Trackers by Default

#107

Post by chongli » Fri, Feb 22, 2019, 2:40 PM UTC

puffy_magicdrgn wrote: post #85

chongli wrote: post #70

Earlier quoted context omitted.

I thought the whole purpose of using third party JavaScript and third party cookies in advertising is that the advertisers don't trust the host backends. What's to stop a site operator from "boosting" the stats in order to make more money?

So you just do a get adprovider.foo/track/ from the browser with no cookies and batch send from your backend -- they then just make sure the data you send them roughly matches? For most big sites this isn't a problem as you're not going to be gaming the stats (presumably the legal costs outweigh the benefit) -- for the scammy small sites faking ad rev.. Well, if this kills them then good riddance ?

Can't the big sites negotiate directly with advertisers? I thought I read somewhere that the New York Times does this. In that case, why bother with the bloat of ad networks and their monstrous JavaScripts and other garbage?

If it's (as you say) good riddance to the small, scammy sites then I think it's the medium-sized sites which will really have a problem. Not big enough to negotiate directly, not small enough to disappear overnight.

Re: Firefox to Block All 3rd Party Trackers by Default

#108

Post by discreditable » Fri, Feb 22, 2019, 2:43 PM UTC

aembleton wrote: post #106

discreditable wrote: post #55

Earlier quoted context omitted.

I run into a similar issue at work. I deploy ad-blockers on all student and staff machines. This makes our users invisible in Google Analytics. Supposedly our top browser is Mobile Safari.

Wouldn't it be easier to use something like PiHole to block requests to ad and analytics servers at the network level?

My web filter blocks ads, but ublock is better. It blocks off-campus and handles first-party ads. It also hides ad content frames better than dns-level blocking does. It's also easy for users to turn off when some site doesn't agree with it. My network level ad filtering has to be simple to avoid breakage since it's harder to work around.

Re: Firefox to Block All 3rd Party Trackers by Default

#109

Post by AdmiralAsshat » Fri, Feb 22, 2019, 2:49 PM UTC

traderjane wrote: post #19

Firefox's Container's approach has been quite interesting to use, but if a suggestion could get out to the Firefox team, I would advise improved streamlining of workflow for the extension, including with sync and returning browser setup, and for organizing and setting up new containers (configuring them to always open for a domain, putting them in folders).

Containers are amazing. The only headache I've run across so far has been a dungeon of my own design--I have certain sites that are confined to my Shopping container (Amazon, PayPal, eBay, couple others). What's bitten me more than once is trying to purchase from a site where I forgot to re-open it in the Shopping container, get to checkout, try to pay via Amazon or Paypal, and have the payment fail because the login cookie is in a different container.

Re: Firefox to Block All 3rd Party Trackers by Default

#110

Post by beatgammit » Fri, Feb 22, 2019, 2:50 PM UTC

xoa wrote: post #81

darkpuma wrote: post #34

Earlier quoted context omitted.

I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.

> I only permit it on sites I sign into and want to remember me, which are very few. I don't know if I'm an outlier, but I hate having to resign back into sites I use even semi-regularly unless its for administrative access or purchase confirmation. Regular "auto sign outs" already happens with a few due to a snafu somewhere along the stack, for me The Economist and Foreign Affairs are the major ones where it seems l…

I use a password manager, so it's really only slightly annoying unless I've set up 2FA, at which point I probably care enough to either put it with it or allow it to use cookies.