11–20 of 103 posts
We have an app that runs in an iFrame on another site (in a Google+ Hangout). Are the cookies in the iFrame going to be considered 3rd party cookies by this if they match the domain of the iFrame source?
Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.
Considering it requires whitelisting to avoid weird and hard to diagnose issues, it seems unlikely to be added to Firefox.
1. https://addons.mozilla.org/en-US/firefox/addon/smart-referer...
Google is in the ad business making it tougher for them to go in this direction. Go Firefox
> Users of this build of Firefox must directly interact with a site or company for a cookie to be installed on their machine. There are not many users that don't interact with google. While I don't expect the chrome team to add this to their feature list (even as optional), if they did, it would not really hurt google. It would actually hurt all the other "smaller" players.
Exactly. But it's not neccesary a bad thing though.
What all the "smaller players" in emerging retracking field - where 3rd party cookies are used in the first place - are doing now is nothing conceptually different from "ah, you've added iPhone to shopping cart at shopX! Now we'll show you iPhone ads for a week on every site you visit!". And user is beating her head against the wall because she bought the iPhone offile a week ago.
If 3rd party cookies will be disabled by default in significant part of browsers, all that players will need to find a ways to add some value visible to users and show it to them and convince them to enable 3rd party cookies manually because that will be just the only way to track them.
We don't know yet what that added value(s) could be, but I'm sure they will be invented. And that would be good thing.
Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.
But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.
There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as simple as this.
Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.
I also brought up the issue on Mozilla's dev.privacy mailing list [1] recently. See:
https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdz...
In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. My proposal is to strip the Referer header down to just the origin + '/', e.g. http://example.org/ instead of http://example.org/foo?search=whatever+you+searched+for.
I think it will be difficult for us to go further than that in the default configuration any time soon (and, as you can see in that thread, there's even some pushback to my extremely reasonable proposal).
Also, I know there is active work happening to bring extra control over the Referer header to Firefox's built-in prefs. This seems to be a little bit in conflict with our "Checkboxes that kill" project so I'm not sure how it will turn out.
Google is in the ad business making it tougher for them to go in this direction. Go Firefox
Earlier quoted context omitted.
But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.
Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as s…
We have an app that runs in an iFrame on another site (in a Google+ Hangout). Are the cookies in the iFrame going to be considered 3rd party cookies by this if they match the domain of the iFrame source?
I would expect so. From the sounds of it you may have to direct users to visit your site directly before this works.