Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

121–130 of 786 posts

Re: Firefox 85 cracks down on supercookies

#121
post #107

Good job Mozilla! Do what Google never will - put users' privacy front and center. On a sidenote, I might now re-enable cache that I kept disabled (well - cleared on exit) because of supercookies. I don't care that much if a single page tracks me, but I _really_ don't want Google to track me across sites. If Firefox protected me against that.. they would have one very grateful user. :) EDIT: this also highlights why…

From the article: " These impacts are similar to those reported by the Chrome team for similar"

Re: Firefox 85 cracks down on supercookies

#122
post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

That idea of having JS files hosted elsewhere always struck me as a Girardian scam (e.g. "everybody else does it") and always getting voted down when I showed people the reality factor.

Nobody seemed to think it was hard to host a file before this came along, just as nobody thought it was hard to have a blog before Medium.

Of course this creates the apocalyptic possibility that one of these servers could get hacked (later addressed with some signing) but it's also not easy to say you're really improving the performance of something if there is any possibility you'll need to do an additional DNS lookup -- one of the greatest "long tails" in performance. You might improve median performance, but people don't 'experience' median performance in most cases (it goes by too fast for them to actually experience it), they 'experience' the 5% of requests that are the 95% worst, and if they make 100 requests to do a task, 5 of them will go bad.

People are miseducated to think caching is always a slam dunk and sometimes it is but often it is more nuanced, something you see in CPU design where you might "build the best system you can that doesn't cache" (and doesn't have the complexity, power and transistor count from the cache -- like Atmel AVR8) to quite a bit of tradeoff when it comes to 'computing power' vs 'electrical power' and also multiple cores that see a consistent or not view of memory.

Re: Firefox 85 cracks down on supercookies

#123

Earlier quoted context omitted.

In a parallel reality: "Firefox 85 Cracks Down on Fingerprinting" "Is this really important given that supercookies can almost always persist between sessions and across domains?" ---- If you want to fix a problem, there are going to be points during that process where the problem is partially fixed. This only becomes an issue if we're headed in the wrong direction, or focusing on a sub-problem that would be better a…

You're right, of course. But let's not forget that fingerprinting exists and is going to be tough to eliminate.

let's also not forget that firefox has spent the last few years aggressively investing in anti-fingerprinting tech

Re: Firefox 85 cracks down on supercookies

#124

Earlier quoted context omitted.

A much more significant performance issue with web tracking is usually the absurd amount of JS loaded. It's almost impressive how they manage to load so much crap. Just visit a site like mediaite.com, the list of trackers is damn long.

Yup. The really frustrating thing about this bit is that because it disables optimizations, it potentially impacts sites where they don't actually use tracking.

Note that this particular change does not apply to non-third-party resources. That's why performance impact is minimal.

Re: Firefox 85 cracks down on supercookies

#125

I'm still trying to imagine the way one exploits a lack of partitioning in the DNS cache... 1. It seems like client web pages cannot directly view the DNS information for a given domain name. So I would think embedding identifying information in something like a CNAME or TXT record directly wouldn't work. 2. I suppose a tracker could try to create unique records for a given domain name and then use request/responses…

DNS could respond with unique IPv6 addresses and echo back on HTTP request.

But it's more likely they just use a large set of (sub)domains and measure timing.

Re: Firefox 85 cracks down on supercookies

#126

Earlier quoted context omitted.

Yes, you can do that via whitelist/blacklist: https://docs.pi-hole.net/guides/misc/whitelist-blacklist/

allowlist/denylist

You and everyone else who exhibit this are reading into things that don't exist. Language has context, words are part of language and so therefore words have context too.

Re: Firefox 85 cracks down on supercookies

#127

How is that even legal

Because enough people think making laws restricting companies in any way prevents "innovation". Corporations should be able to do whatever they want because if they were truly bad, they would just go out of business, right? It's the worldview of a third grader.

I don't know why your getting downvoted, this is clearly the dominating ideology of Silicon Valley.

Re: Firefox 85 cracks down on supercookies

#128

Doesn't NoScript do the same job?

Perhaps you are trolling? NoScript is a giant hammer that smashes 90% of the functioning parts of most modern web pages. This new feature in Firefox partitions caching in a way that mostly won't affect how a site works but will block one nefarious tracking technique.

It is just one or two clicks away to load website, it also safer to browse internet this way, in my no expert opinion.

Re: Firefox 85 cracks down on supercookies

#129

These advertising networks are destroying web performance. Most of these "Supercookies" are optimizations to improve performance. By abusing them, advertisers have turned what should be a great performance tool into a liability. I know FF suggests this won't significantly affect most websites performance, but web advertising and trackers are already responsible for a huge chunk of performance issues already. Of cours…

This is akin to the whole class of CPU vulnerabilities we've seen (Spectre/Meltdown/CacheOut/...) where performance optimizations are at odds with security.

It is remarkably similar. If it weren't for the assholes trying to steal from us, our whole computing experience would be faster.

Re: Firefox 85 cracks down on supercookies

#130
post #107

Good job Mozilla! Do what Google never will - put users' privacy front and center. On a sidenote, I might now re-enable cache that I kept disabled (well - cleared on exit) because of supercookies. I don't care that much if a single page tracks me, but I _really_ don't want Google to track me across sites. If Firefox protected me against that.. they would have one very grateful user. :) EDIT: this also highlights why…

Eh, Google was first to implement this: https://developers.google.com/web/updates/2020/10/http-cache... .

[deleted]
Post reply on HN