Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#21

Post by lucasyvas »

ziddoap wrote: post #14
lucasyvas wrote: post #3

How does this relate to the existing tracking protection settings - should I turn off "block all third party cookies"? That setting breaks a few things, but mostly works OK. I'm confused which protection level this new capability corellates to.

This seems to be a middle-ground. You can more confidently allow third-party cookies, which means that certain features that broke with the blocking of all third-party cookies will now be able to work, but you maintain most of the protections that you gained when you used to block them.

So.. Standard? or Off? Ever since this has been announced, I understand how it works, but the browser does not communicate at all which setting level it maps to, or if I even need ETP on at all and it's just always on.

Re: Firefox rolls out Total Cookie Protection by default to all users

#22

Post by ravenstine »

legalcorrection wrote: post #4

I wonder why Microsoft doesn't make Edge a privacy-oriented browser. I'm surprised they think they can make more from the data economy than they would gain by seriously hurting Google et al.

Because Microsoft has had a history of caring about privacy?

I'd expect something like this from Apple with Safari, but not Microsoft. M$ can't even give its own developer base privacy by allowing all telemetry to be disabled.

Re: Firefox rolls out Total Cookie Protection by default to all users

#23

Post by Xylakant »

agluszak wrote: post #20

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

Cookies were invented at Netscape like 25 years ago, nobody considered the current situation.

Re: Firefox rolls out Total Cookie Protection by default to all users

#24

Post by imbnwa »

TAForObvReasons wrote: post #18
Saint_Genet wrote: post #12

Earlier quoted context omitted.

I guess you could set up custom stylesheets, at least for sites you commonly browse.

The time-based light/dark mode setting requires the current time. It is not currently accessible from CSS and is blocked by resistFingerprinting

Does that for extensions like Dark Reader Pro too?

Re: Firefox rolls out Total Cookie Protection by default to all users

#25

Post by mlindner »

jokoon wrote: post #9

I really want to enable resist fingerprinting, unfortunately it disables dark theming on github, ddg and other websites. I wish I could add an exception rule to this...

I've had it on a for a while and I don't seem to have any issues getting dark theming to stick.

Re: Firefox rolls out Total Cookie Protection by default to all users

#26

Post by ajvs »

lucasyvas wrote: post #3

How does this relate to the existing tracking protection settings - should I turn off "block all third party cookies"? That setting breaks a few things, but mostly works OK. I'm confused which protection level this new capability corellates to.

Total Cookie Protection is the same as the Tor Browser's first-party isolation sandboxing - third-party cookies can't be used to track you across sites because they're only accessible within the domain they were created on. So you don't have to block 3rd-party cookies anymore, since they'll be sandboxed and unable to be used for tracking.

Re: Firefox rolls out Total Cookie Protection by default to all users

#27

Post by jrochkind1 »

jaywalk wrote: post #19
xnorswap wrote: post #7

Does this affect single-sign-on implementations?

It shouldn't. SSO doesn't typically work by sharing cookies, which have always been limited to a single domain in the first place.

I'm not sure about that. It depends on where the boundaries of the "cookie jar" are (through redirects and such). And I suspect it will effect it, in order to accomplish it's purpose. After all, what is tracking but a sort of "SSO" you don't know about.

(OK, technically tracking is less powerful than SSO, since only the third-party needs to know your "single" identity, the first-party website doesn't actually know it, where in SSO it does)

I mean, to be clear -- I mean the new thing might make you enter your username and password to SSO login on each site, whereas ordinarily if you have an active SSO session you don't need to re-enter username and password to login with SSO on a new site. Will it break SSO even if you are fine re-entering username and password every time you SSO login? I am not sure, but I definitely wouldn't be confident 'no' without more details/testing.

Re: Firefox rolls out Total Cookie Protection by default to all users

#28

Post by ajvs »

xnorswap wrote: post #7

Does this affect single-sign-on implementations?

It shouldn't. "Exceptions are made for cross-site cookies when they're needed for non-tracking purposes, such as those used by popular third-party login providers."[1]

[1] https://blog.mozilla.org/security/2021/02/23/total-cookie-pr...

Re: Firefox rolls out Total Cookie Protection by default to all users

#29

Post by 8organicbits »

jokoon wrote: post #9

I really want to enable resist fingerprinting, unfortunately it disables dark theming on github, ddg and other websites. I wish I could add an exception rule to this...

For GH you can set your theme preference in your account settings.

Re: Firefox rolls out Total Cookie Protection by default to all users

#30

Post by svieira »

xnorswap wrote: post #7

Does this affect single-sign-on implementations?

SSO, probably not - embedding, possibly.

If you're just worried about logging in through sso.coolcorp.com to third-party.corp using any of the normal methods (OAuth, SAML, Kerberos, etc.) then you're probably fine.

If you're worried about composing a page made up of lots of custom embedded components and those components _don't_ use SSO (or if they do, but they authenticate invisibly using an iframe instead of authenticating entirely server-side) then you may have some things to switch up.

Post reply on HN