Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

411–420 of 786 posts

Re: Firefox 85 cracks down on supercookies

#411

Post by ghostpepper »

14 wrote: post #341
dyingkneepad wrote: post #309

Earlier quoted context omitted.

I had to use a Fax machine in 2018. In the United States. As the only acceptable way to submit certain documents. I should also point to non-Unitedstatians that checks (that physical paper worth as much money as you write and sign on it) are still in use in the USA.

Checks still in use in Canada as well. I had a person today tell me they had 3 checks stolen and cashed and my response was “people still use checks?”.

In Canada it's spelled cheque, I have no idea why.

Re: Firefox 85 cracks down on supercookies

#412

Post by ogre_codes »

letitbeirie wrote: post #307
Average_ wrote: post #141

Earlier quoted context omitted.

Well that's interesting. For me 99.5% of websites work perfectly using ublock origin. The only .5% remaining are websites that actively refuse to serve any kind of adblock users, not because it breaks functionality on their site. I don't think I can recall having visited a single website that would have features break unintentionally because of ublock in the past few years.

The Denver Post just lost my business over this. They have one of those things that scrambles all the words for any user with the audacity to not want to see video+audio ads while reading their newspaper. Is it their content to do what they want with? Sure. Does the same logic apply to the $9 I used to give them each month? You're damn right.

Hard agree. If I'm paying for content, I'd accept a small number of discrete advertising. Video advertising on a text/ photo site pisses me off in general and if I was paying for it? No chance I'd let that fly.

Re: Firefox 85 cracks down on supercookies

#413

Post by [deleted] »

ericholscher wrote: post #243
Nextgrid wrote: post #235

Earlier quoted context omitted.

This is great. How are the ads paid for though - is it billed per click or per impression, or is it billed per an approximate amount of time the ad will be displayed for? The problem with charging per click or impression is that you're vulnerable to fraud which means you either lose money/trust or you have to do invasive tracking to detect & prevent fraud (which you'll be unlikely to achieve as well as the big player…

We are doing CPC & CPM pricing. I don't believe anyone has asked us for "time seen" pricing. I don't even really know how that would work, and why it wouldn't be open to fraud in a similar fashion. Do you have a good example of how this is priced, and how it would work in practice?

[deleted]

Re: Firefox 85 cracks down on supercookies

#415

Post by rmdashrfstar »

alfalfasprout wrote: post #360
floatingatoll wrote: post #322

Earlier quoted context omitted.

Doing this will make it trivially easy to fingerprint and track you on the web, as the set of people who use non-defaults like this list is 0.000001% of the total possible user space for their area, and your IP address probably only changes rarely or never A better way to protect yourself is to use a browser with tracking protections on by default, and leave the settings alone. You may see a few more ads but you’ll b…

If you live in the Bay Area chances are plenty of others do the same thing.

And for the rest of the globe?

Re: Firefox 85 cracks down on supercookies

#416

Post by beefield »

silentsea90 wrote: post #380
TedDoesntTalk wrote: post #326

Earlier quoted context omitted.

To me, there is no such thing as an “ethical ad”. You are trying to steal my attention, my time. You don’t get to do that. My time on Earth is limited and you don’t get a millisecond of it if I can help it. If I want to buy something, I seek it out. Anything else is a waste of my time and a waste of the advertisers money. I long ago decided to throw out every piece of physical ad mail I receive without even glancing…

Great morally charged argument, but I am not sure how you expect content creators to monetize.

Well, to be blunt, in my humble opinion more than 90% of "content creators" trying to monetize their content with ads currently produce content of so low quality, that world would be a better place without their content. So if my ad blocker helps any of those to change their career, I am happy.

Re: Firefox 85 cracks down on supercookies

#417

Post by gilrain »

marvinblum wrote: post #351
jb1991 wrote: post #333

Can anyone explain the fingerprinting issue, unrelated to cookies. Visit any one of these many sites that show you what your browser knows about you, it doesn’t matter if using Firefox with fingerpring blocking enabled, the site reveals a tremendous amount of information in your fingerprint. Firefox doesn’t stop any of that, despite its settings that purport to do so. It's always the same information, not scrambled o…

Which actually makes sense. If you have a "zero-fingerprint" browser it will become useless, because you cannot use any advanced features other than displaying HTML.

Brave's method of slightly randomizing the metrics gets around that. They call it farbling.

Re: Firefox 85 cracks down on supercookies

#418

Post by bawolff »

kag0 wrote: post #305
bawolff wrote: post #289

Wait does that mean hsts cache is per origin? That seems like it would make tls stripping attacks a lot easier.

Maybe. But a more clever approach might be to limit the size of the HSTS cache per second-level-domin per orign. Or to randomly respect the cache. Or to simply make every request to both the TLS and non-TLS port but do so in parallel and discard the non-TLS response if the domain was in the HSTS cache. I'm not saying any of those approaches is bulletproof, just that maybe they have a more complex strategy in mind to…

Those would be much worse strategies than even just not supporting hsts at all.

> Or to randomly respect the cache

If the goal is to manipulate a single request to insert malicious js that gets cached, you only need a single non tls request. If you're an on path attacker, you can probably get the user to request things multiple times (e.g. randomly break and unvlbreak internet connectivity) until you get lucky with an unencrypted connection. If you're trying to make a super cookie you can just repeat and average out the random failures (random pertubation almost never prevents a side channel leak, at most it makes it more expensive)

>Or to simply make every request to both the TLS and non-TLS port but do so in parallel and discard the non-TLS response if the domain was in the HSTS cache.

Fails at confidentiality 100% of the time

Re: Firefox 85 cracks down on supercookies

#419

Post by jjgreen »

xorcist wrote: post #140
paulpauper wrote: post #6

Twitter uses these type of cookies. They even use cookies that do not contain any reference to the twitter domain. It is how they track people who have been suspended on the platform

Browse twitter through nitter and all these problems go away, and it's actually a usable interface on top.

... and if you use the FF extension "Privacy Redirect", then all twitter links are redirected to nitter, which is sweet.
Post reply on HN