Firefox 85 cracks down on supercookies

Post by rangibaby » Tue, Jan 26, 2021, 11:07 PM UTC

notatoad wrote: post #547

avodonosov wrote: post #541

We need to acknowledge also that recognising the user as he moves across pages and domains is sometimes needed to provide valuable services to the user. Therefore, I believe, browsers have to provide a volunteer "tracking" functionality - when a web page reqests 3rd party cookies, a popup is shown to the user with the cookie values, description (as set by the owning domain), the list of domains already permitted to a…

The "problem" with that solution is that users are very willing to click any button necessary to achieve their goal, and in any dialog that prompts to allow tracking in order to achieve something else, most people will click allow. Personally I don't think this is a problem, and people should be allowed to make that choice. But most of HN seems to disagree with me there, and feels that users need to be protected from…

Post by ogre_codes » Tue, Jan 26, 2021, 11:10 PM UTC

monopoledance wrote: post #528

ogre_codes wrote: post #492

Earlier quoted context omitted.

> The latest casualty was podcasts. It's revolting. Hmm? Yes, there are adverts on all the podcasts I listen to. Many of my favorites offer members only ad-free versions. Usually I suffer through the ad supported versions because the adverts are easy enough to skip. Some podcasts have too many adverts or annoyingly inserted advertising. Those are pretty 1 and done. No point listening to them. IMO the (current) podcas…

I absolutely don't respect having my weir podcast-friendship relationship with the host exploited by fully integrated ad pieces whispered to me in a trusted voice. That. Is. Sick.

Post by aembleton » Tue, Jan 26, 2021, 11:12 PM UTC

arendtio wrote: post #471

Is there any reason to keep the Same Origin Policy after this change? I mean, shouldn't this change defeat CSRF attacks?

Post by tannhaeuser » Tue, Jan 26, 2021, 11:16 PM UTC

simias wrote: post #422

Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Post by judge2020 » Tue, Jan 26, 2021, 11:20 PM UTC

franga2000 wrote: post #410

ogre_codes wrote: post #287

Earlier quoted context omitted.

A lot of people accept that which is beyond their control. That doesn't mean they are Ok with it, just that they don't know how to do anything about it or often that it's even happening.

Wasn't there an article about paying with your face around here just a bit ago? People clearly don't just tolerate this, but embrace it. Only people from places where it's too late to go back (like China) are aware of the dangers of these systems, but they can hardly warn the rest of us and when they do, we generally don't listen as "something like that surely wouldn't happen in my free country". It would seem that p…