Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

131–140 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#131

Post by Sohcahtoa82 »

mastermedo wrote: post #73

I remember losing a bet a while back, because I was naive enough to think that was how cookies worked in the first place. Why did other sites ever have access to cookies they didn’t create was beyond me.

> Why did other sites ever have access to cookies they didn’t create was beyond me.

They don't.

If you go to example.com, and it loads an ad on tracker.com, then tracker.com will create a cookie. example.com WILL NOT be able to see that cookie. Likewise, if you were to log into example.com, tracker.com WILL NOT see the example.com cookie.

What happens (Without third party cookie blocking or FF's TCP) is if you then go to anothersite.com, and it also loads an ad from tracker.com, then the same cookie sent to it while visiting example.com will be sent, resulting in tracker.com knowing that you visited both sites. The admins of both example.com and anothersite.com will then be able to look at analytics and see that the visitors of their site also visit the other.

At no point is one site ever able to see a cookie they didn't create. Otherwise, this would be a MASSIVE security hole as it would make session stealing trivial.

However, a site is able to see a cookie they created while visiting another site.

Maybe this is what you meant, but it wasn't entirely clear.

Re: Firefox rolls out Total Cookie Protection by default to all users

#132

Post by logifail »

Vinnl wrote: post #79
logifail wrote: post #68

Earlier quoted context omitted.

> so they can use server-side ID syncs Does this only work if you use the same email across multiple sites? If so it's yet another reason to use a different email address with every site you sign up at.

Which incidentally Mozilla also has a product for: https://relay.firefox.com (Disclosure: I work on Firefox Relay :) And yes, I know some people also have their own domain with unlimited email addresses.)

> I know some people also have their own domain with unlimited email addresses

A friend of mine does it the hardcore way, through DNS. He adds MX records for subdomains corresponding to the name of the site he's signing up for. Lets say his domain name is example.com:

bob@hilton.example.com bob@ycombinator.example.com bob@firefox.example.com and so on

He also does it for friends(!) meaning when he gives you "his" email, it's always of the form bob@.example.com

If he tires of you or your comms get too spammy, he just bins the relevant DNS record. No more mail from you!

Re: Firefox rolls out Total Cookie Protection by default to all users

#133

Post by Sohcahtoa82 »

robin_reala wrote: post #83
throwaway0x7E6 wrote: post #50

Earlier quoted context omitted.

with mozilla's 2% browser market share, as a developer you don't need to worry at all

Given the number of Firefox users that block Google Analytics, I wouldn’t be convinced about a 2% figure.

You can block Google Analytics all you want. Unless you're spoofing your User-Agent, servers still know what browser you're using.

Re: Firefox rolls out Total Cookie Protection by default to all users

#134

Post by pvg »

chasd00 wrote: post #94

given that Electron is really just a featureless browser shouldn't it be straightforward to make your own browser now? An address bar, navigation, and bookmarks ought to be enough to get you there. Seems like you should be able to make a browser for your specific needs/wants pretty easily these days. I'm not suggesting some sort of money making venture where you're beholden to investors to try and turn revenue with i…

given that Electron is really just a featureless browser shouldn't it be straightforward to make your own browser now?

That's not what Electron is but there are piles of fork-ish browser projects out there statistically nobody uses. This also answers the second question in the negative - it is not straightforward to make your own browser that's as useful as the browser you're likely using.

Re: Firefox rolls out Total Cookie Protection by default to all users

#135

Post by gspr »

rkk3 wrote: post #115
unicornporn wrote: post #97

Earlier quoted context omitted.

Firefox has a sub 8% market share, so I doubt this will make a drastic change to how they operate.

Surprised it's even that high, I tried to switch to Firefox the other month for privacy but gave up because it crashed on me it-least once a day. Edit: thanks for the downvotes, I would have preferred if it worked but it didn't. I tried basic troubleshooting, disabling extensions etc. but didn't find it usable on macOs Monterey, think it doesn't play well with youtube.

I don't think I've ever used another browser for as long as Firefox has existed. I think I can count crashes on one hand.

Re: Firefox rolls out Total Cookie Protection by default to all users

#136

Post by YetAnotherNick »

madmax108 wrote: post #80

I wonder if there's anyone from any advertising/ad-targeting companies on HN who can shed some light on if/how much this change may affect their "product". Asking this since I know friends working at companies that were DRASTICALLY affected by the Apple advertising changes in terms of user targetability (and hence revenue) and I'm wondering if this change will be similar.

Cookies are the easiest way to shore and share information but far from the only way. If it affects someone's product, it is not hard to fingerprint browsers.

Re: Firefox rolls out Total Cookie Protection by default to all users

#137

Post by robin_reala »

Sohcahtoa82 wrote: post #117
Renaud wrote: post #92

Earlier quoted context omitted.

It's not that one site is seeing another site. It's that multiple sites will serve content (ads, Javascript libraries, like buttons) from a common site (eg an ad network) that uses its own domain. That domain is allowed to get the cookie for itself because it is referenced by multiple site, that's how this type of tracking works. If you go to bbc.com, it still won't be able to see cookies from cnn.com, but say if adv…

> Everyone should use FF. Wouldn't simply installing an ad/tracking blocker like uBlock Origin be just as effective, if not moreso?

uBlock Origin works best on Firefox anyway: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...

Re: Firefox rolls out Total Cookie Protection by default to all users

#138

Post by mmis1000 »

dev_tty01 wrote: post #70

Is this better or worse than Safari's "Prevent cross-site tracking" feature? https://support.apple.com/guide/safari/prevent-cross-site-tr... It appears Safari is just blocking the cookies, while Firefox is isolating the cookies. I guess Safari has to keep track of who to block while Firefox just isolates everybody. Are there other benefits to the Firefox approach? Frankly, I have a hard time understanding why this Co…

Sites that use cross site resource will still work. Except the cross domain resource provider will always see the same domain coming to get resource.

For example, if you are on Site A and use cross site resource from Site C. The site C will get a cookie C('A)

And in another day, you visited a Site B that also use resource from Site C. The site C get a cookie C('B).

And C('A) != C('B)

Although these cookie are both issued by Site C. They are associated to different first party domain and can't be connected directly.

It's just like you open a private browser session for every site you visit.

I think it is a extension usage from Firefox's container technology.

Re: Firefox rolls out Total Cookie Protection by default to all users

#139

Post by jalk »

rdsubhas wrote: post #119

Privacy wins aside, can anyone please help educate if third party single sign ons will still continue to work?

I don't think they rely on third party cookies. You are redirected to the SSO provider which then issues a token which it transports back to the requesting site through other means than cookies (i.e. post body / query string)

Re: Firefox rolls out Total Cookie Protection by default to all users

#140

Post by permo-w »

rkk3 wrote: post #115
unicornporn wrote: post #97

Earlier quoted context omitted.

Firefox has a sub 8% market share, so I doubt this will make a drastic change to how they operate.

Surprised it's even that high, I tried to switch to Firefox the other month for privacy but gave up because it crashed on me it-least once a day. Edit: thanks for the downvotes, I would have preferred if it worked but it didn't. I tried basic troubleshooting, disabling extensions etc. but didn't find it usable on macOs Monterey, think it doesn't play well with youtube.

I switched to ff a month or two ago for the integrated tree-style tabs extension that you can't get on chromium-based browsers

I didn't really have any huge problem with firefox specifically, but Brave just feels a bit slicker, the adblocker is in-built and stronger, and it manages multiple windows better, so I've slowly switched back to brave for general use, and use ff for work and projects

Post reply on HN