Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to Block All 3rd Party Trackers by Default

twitter.com

Post reply on HN
Print view View original

171–180 of 190 posts

Re: Firefox to Block All 3rd Party Trackers by Default

#171

Post by sp332 »

cpeterso wrote: post #163
fooqux wrote: post #151

Earlier quoted context omitted.

You can tell how bad the lack of support / teeth is when people start using the flag to not track them as an extra way of tracking people. That's extremely telling... but sadly not unexpected by many of us.

Should Mozilla remove the DNT header from Firefox like Apple did in Safari? When DNT does nothing except give trackers one more bit of fingerprint entropy, is there any value in users still allowing users to send DNT? "DNT: I am one of those people who does not want you to track even though I know you will."

I think it's fine since it's opt-in. Maybe there could be a warning in the UI though.

Re: Firefox to Block All 3rd Party Trackers by Default

#172

Post by tomjen3 »

adtac wrote: post #82
rbinv wrote: post #15

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.o…

I wish DNT was honoured, but it's as good as a "do not commit crime" sign.

There are millions of Do not Trespass signs out there, the difference is that they have some legal weight.

Ten years ago it would have been a different matter, but it doesn't seem that far fetched to get do not track to be the legal equivalent of a "no" on those GDPR consent forms, but with no options for dark patterns and no way to re-query on every page load for those who opt-out.

Re: Firefox to Block All 3rd Party Trackers by Default

#173

Post by reitanqild »

scriptkiddy wrote: post #155
reitanqild wrote: post #73

Earlier quoted context omitted.

And we will shout back : ) I'm already on it as might be seen here. Feel free to complain loud and clear if it doesn't work in FF. Make it clear that FF support isn't optional. Also on my to do list: complain even more, including to relevant authorities about Googles abuse of market position to push their browser. Feel free to join me here as well. (And to be sure: feel free to complain when supposedly mainstream sit…

This is why I use FF for development(and all other browsing). I get firefox support by default on all my work.

Same here : )

Only once have I experienced that something I'd actually write for production only worked in FF and not across all modern browsers.

Protip for anyone who reads this and thinks "but my employer doesn't care about Firefox':

I typically used FF also while testing other peoples work and if it didn't work in Firefox then 9 out of 10 times it didn't work in any other browser than Chrome (had some devs on my team who really didn't seem to care about cross browser compability but it would work in most browsers before it was approved :-))

Re: Firefox to Block All 3rd Party Trackers by Default

#174

Post by fxfan »

dontbenebby wrote: post #136
stunt wrote: post #40

Earlier quoted context omitted.

> firefox should ship a 'power user' edition If you have Firefox-Sync enabled. You will get all your extensions anyway. so it is a one time setup for all those extensions that you need. First time hearing Tridactyl! I'm using Vimium. Does it have any advantage over Vimium?

>If you have Firefox-Sync enabled. You will get all your extensions anyway. so it is a one time setup for all those extensions that you need. Yes, but it's still annoying to set up the containers and set up that certain sites only open in certain containers. Also if I'm on a work device I may not want to sign into Firefox Sync for privacy reasons.

Same reason as mine- separation of work and private profiles

Re: Firefox to Block All 3rd Party Trackers by Default

#175

Post by dredmorbius »

slasaus wrote: post #138

I think this is huge. It reminds me of the early days of Firefox (back then still known as Phoenix) in a world where IE6 and pop-up ads dominated. At launch IE6 was really the best and most innovative browser of it's time (IMHO). But after IE6 had beaten Netscape, Microsoft stopped putting money in IE development and the situation got worse over time. It was Phoenix with, among other things, a pop-up blocker that was…

Google may be innovating Chrome, but few of those enhancents proide me, as user, any value, and many subtract from it.

Firefox has an opportunity.

Re: Firefox to Block All 3rd Party Trackers by Default

#176

Post by KozmoNau7 »

rejberg wrote: post #154
KozmoNau7 wrote: post #64

Earlier quoted context omitted.

And that is exactly why I would like it to not be forced on (or off). I want my browser to report no DNT setting at all, to reduce my fingerprinting profile.

https://panopticlick.eff.org/ reports that 1 in 1.67 browsers send the DNT header, so the best option fingerprinting-wise might be to leave it on, at least information-wise. Of course, that ratio will likely change when Safari drops support for DNT entirely. See discussion here https://news.ycombinator.com/item?id=19101156

They send the header, but with which value? I probably didn't express myself well enough, I want my browser to send the "DNT not configured" value.

Re: Firefox to Block All 3rd Party Trackers by Default

#178

Post by londons_explore »

chongli wrote: post #107
puffy_magicdrgn wrote: post #85

Earlier quoted context omitted.

So you just do a get adprovider.foo/track/ from the browser with no cookies and batch send from your backend -- they then just make sure the data you send them roughly matches? For most big sites this isn't a problem as you're not going to be gaming the stats (presumably the legal costs outweigh the benefit) -- for the scammy small sites faking ad rev.. Well, if this kills them then good riddance ?

Can't the big sites negotiate directly with advertisers? I thought I read somewhere that the New York Times does this. In that case, why bother with the bloat of ad networks and their monstrous JavaScripts and other garbage? If it's (as you say) good riddance to the small, scammy sites then I think it's the medium-sized sites which will really have a problem. Not big enough to negotiate directly, not small enough to…

> why bother with the bloat of ad networks

Except a few very rare cases, ad networks can statistically deliver a far more effective ad than a manually curated ad.

The network also has the infrastructure in place to track the user all the way from the ad click to completing a purchase, potentially across many devices or even in a physical store. They use those numbers to demonstrate their value with hard figures rather than marketing fluff.

Re: Firefox to Block All 3rd Party Trackers by Default

#179

Post by londons_explore »

icebraining wrote: post #90
puffy_magicdrgn wrote: post #68

Earlier quoted context omitted.

You send tracking events to your analytics/tracking partner from your backend instead of from the browser and they combine the cookie ids.

> and they combine the cookie ids. And how do they do that? The "advantage" of third-party tracking is that a cookie set by the analytics service on site A gets sent back when the user goes to site B and C and D (etc). Without that, they have to somehow figure out that user 34 on site A is the same as user 95 on site B. That's often possible, but much less reliable.

Site B has an iframe back to site A and the 'user 34' cookie can still be read.

All these protections only prevent setting cookies, not reading them again.

Re: Firefox to Block All 3rd Party Trackers by Default

#180

Post by icebraining »

londons_explore wrote: post #179
icebraining wrote: post #90

Earlier quoted context omitted.

> and they combine the cookie ids. And how do they do that? The "advantage" of third-party tracking is that a cookie set by the analytics service on site A gets sent back when the user goes to site B and C and D (etc). Without that, they have to somehow figure out that user 34 on site A is the same as user 95 on site B. That's often possible, but much less reliable.

Site B has an iframe back to site A and the 'user 34' cookie can still be read. All these protections only prevent setting cookies, not reading them again.

It does prevent them from reading too: "Domains classified as trackers are not able to access or set cookies, local storage, and other site data when loaded in a third-party context." (emphasis mine)

https://blog.mozilla.org/security/2018/10/23/firefox-63-lets...

Post reply on HN