Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox getting smarter about third-party cookies

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 103 posts

Re: Firefox getting smarter about third-party cookies

#21

Post by Retric »

abcd_f wrote: post #15
Achshar wrote: post #5

Earlier quoted context omitted.

But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.

Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as s…

How about newspapers that show articles when a user comes from Google but not otherwise?

Re: Firefox getting smarter about third-party cookies

#23

Post by brandnewlow »

mccr8 wrote: post #8
uulbiy wrote: post #4

Earlier quoted context omitted.

> Users of this build of Firefox must directly interact with a site or company for a cookie to be installed on their machine. There are not many users that don't interact with google. While I don't expect the chrome team to add this to their feature list (even as optional), if they did, it would not really hurt google. It would actually hurt all the other "smaller" players.

It is my understanding that Google uses separate domains like doubleclick.net for serving ads, not google.com, so they won't gain any particular advantage there. Of course, that could change.

As I understand it, they serve those assets from the Google.com domain for safari and could do so for this.

Re: Firefox getting smarter about third-party cookies

#24

Post by cbr »

hiddenfeatures wrote: post #13

Does this affect Google Analytics (or any analytics software for that matter)? if so: How would a webmaster deal with that?

Google Analytics javascript runs on your domain and the cookies it uses are on your domain. So it should count as "first party" here.

Re: Firefox getting smarter about third-party cookies

#25

Post by Silhouette »

briansmith wrote: post #17
abcd_f wrote: post #2

Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.

First, there are already multiple Firefox extensions that will let you totally control the Referer header. (In general, if there's something that you want to change about Firefox, you should search https://addons.mozilla.org to find a solution, because somebody's probably already created an extension that does what you want.) I think one such extension is called "RefControl." I also brought up the issue on Mozilla's…

FWIW, I just followed your advice, searching Firefox Addons for "Referer". The results were not helpful at all for the goal abcd_f mentioned of blocking cross-site referrers. [Edit: Sorry, it looks like I mistyped "Referer". There is at least one promising addon on the first page.]

Also FWIW, I agree that this is indeed becoming a significant privacy issue. I too don't see why Google or Typekit or some widely used CDN should be gifted a convenient history of my web browsing just because they host popular JavaScript libraries or web fonts.

I'm intrigued by this comment:

In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites.

Is this because some of the third party resources are only authorised for use by certain sites and rely on Referer to establish whether a given request qualifies? Given that there is no security or verification for Referer headers, that seems like a rather broken model to start with.

I can't help thinking that if one of the big browsers forced the issue then those services would have to reconsider and do things a smarter way. That seems likely to inherently reduce the amount of unnecessary information being passed across to those third party services in the first place.

Re: Firefox getting smarter about third-party cookies

#26

Post by ubercow13 »

Silhouette wrote: post #25
briansmith wrote: post #17

Earlier quoted context omitted.

First, there are already multiple Firefox extensions that will let you totally control the Referer header. (In general, if there's something that you want to change about Firefox, you should search https://addons.mozilla.org to find a solution, because somebody's probably already created an extension that does what you want.) I think one such extension is called "RefControl." I also brought up the issue on Mozilla's…

FWIW, I just followed your advice, searching Firefox Addons for "Referer". The results were not helpful at all for the goal abcd_f mentioned of blocking cross-site referrers. [Edit: Sorry, it looks like I mistyped "Referer". There is at least one promising addon on the first page.] Also FWIW, I agree that this is indeed becoming a significant privacy issue. I too don't see why Google or Typekit or some widely used CD…

Is this not what you want? Third search result:

https://addons.mozilla.org/en-US/firefox/addon/smart-referer...

Re: Firefox getting smarter about third-party cookies

#28

Post by cbr »

abcd_f wrote: post #15
Achshar wrote: post #5

Earlier quoted context omitted.

But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.

Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as s…

    Referrers are used exclusively for tracking purposes
    and carry zero positive benefits for the users.
This is short sighted. Sites can respond to referrers by improving themselves and better adapting to what users are looking for.

Re: Firefox getting smarter about third-party cookies

#29

Post by icebraining »

abcd_f wrote: post #15
Achshar wrote: post #5

Earlier quoted context omitted.

But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.

Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as s…

Anti-hot-linking may be dumb to protect the content, but it's very useful to protect others from abusing sites as if they were free image hosters.

I run a small site, and we would occasionally get hotlinked by random people searching for images on Google, which would kill our bandwidth caps. If it weren't for referer filters, we'd have to hide any image for unregistered users.

That said, keep just first-party referers would be fine - we'd just block any image request without referer.

Re: Firefox getting smarter about third-party cookies

#30

Post by epmatsw »

Retric wrote: post #21
abcd_f wrote: post #15

Earlier quoted context omitted.

Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as s…

How about newspapers that show articles when a user comes from Google but not otherwise?

How is that a better experience? This is a legitimate question, I don't think I understand what you're referring to.
Post reply on HN