Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

141–150 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#141

Post by abofh »

jrochkind1 wrote: post #27
jaywalk wrote: post #19

Earlier quoted context omitted.

It shouldn't. SSO doesn't typically work by sharing cookies, which have always been limited to a single domain in the first place.

I'm not sure about that. It depends on where the boundaries of the "cookie jar" are (through redirects and such). And I suspect it will effect it, in order to accomplish it's purpose. After all, what is tracking but a sort of "SSO" you don't know about. (OK, technically tracking is less powerful than SSO, since only the third-party needs to know your "single" identity, the first-party website doesn't actually know it…

It would break things like medium.com's constant prompt to login with this list of google accounts, but it wouldn't break SSO - SSO itself is typically handled by a series of redirections, and at the time you're redirected _to_ the SSO server, you're giving your cookies to _them_, then you're redirected back with a signed response and get cookies for the _destination_ domain - at no time during the exchange does the SSO server need to directly talk to the relying party.

Implementations may of course vary.

Re: Firefox rolls out Total Cookie Protection by default to all users

#142

Post by Strom »

rdsubhas wrote: post #119

Privacy wins aside, can anyone please help educate if third party single sign ons will still continue to work?

Depends on the specific implementation, but in theory this doesn't limit any functionality for SSO. Data can be shared via mechanisms other than cookies.

Re: Firefox rolls out Total Cookie Protection by default to all users

#144

Post by johannes1234321 »

Sohcahtoa82 wrote: post #117
Renaud wrote: post #92

Earlier quoted context omitted.

It's not that one site is seeing another site. It's that multiple sites will serve content (ads, Javascript libraries, like buttons) from a common site (eg an ad network) that uses its own domain. That domain is allowed to get the cookie for itself because it is referenced by multiple site, that's how this type of tracking works. If you go to bbc.com, it still won't be able to see cookies from cnn.com, but say if adv…

> Everyone should use FF. Wouldn't simply installing an ad/tracking blocker like uBlock Origin be just as effective, if not moreso?

Isn't it better to remove the different root problems isntead of having plugins working around?

Re: Firefox rolls out Total Cookie Protection by default to all users

#145

Post by tamha »

madmax108 wrote: post #80

I wonder if there's anyone from any advertising/ad-targeting companies on HN who can shed some light on if/how much this change may affect their "product". Asking this since I know friends working at companies that were DRASTICALLY affected by the Apple advertising changes in terms of user targetability (and hence revenue) and I'm wondering if this change will be similar.

I work in advertising. this change is nothing compared to what Apple did. Edit : It's better than ETP.

Re: Firefox rolls out Total Cookie Protection by default to all users

#146

Post by layer8 »

ravenstine wrote: post #32
agluszak wrote: post #20

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

There are legit cross-domain use cases. A good example is how someone here mentioned (comment seems deleted though) account sessions being shared between Atlassian products like JIRA and BitBucket. The problem with that is domains are a poor way of representing ownership that can be trusted. If the web was rebuilt from scratch, a better approach might be to allow cookies to be shared between secure sites using the sa…

> allow cookies to be shared between secure sites using the same certificate

Or maybe encrypting cookies using the site certificate, which would still allow cookies to be shared with domains having a different certificate, but the server needs the correct key for decryption.

Re: Firefox rolls out Total Cookie Protection by default to all users

#147

Post by GRBurst »

Very cool to see more privacy by default in Firefox.

It is still a lot of effort to have clear separations in every browsern...

I am using Firefox containers with the temporary containers plugins (with history deletion enabled) as well as cookies auto delete plugin (which supports containers).

Therefore, everything is usually isolated in a container inside a tab and only white listed cookies are kept in the named containers.

Re: Firefox rolls out Total Cookie Protection by default to all users

#148

Post by hedora »

tyingq wrote: post #34
agluszak wrote: post #20

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

RFC2109, from 1997, had this: 8.3 Unexpected Cookie Sharing A user agent should make every attempt to prevent the sharing of session information between hosts that are in different domains. Embedded or inlined objects may cause particularly severe privacy problems if they can be used to share cookies between disparate hosts. For example, a malicious server could embed cookie information for host a.com in a URI for a…

It's really weird that they claim there privacy work started in 2015. Netscape Navigator add cross site cookie blocking at some point, and firefox has always (?) had it.

The innovation here seems to be that they further partition by the URL in the address bar.

It's frustrating that browsers have been fighting and losing this war for 25 years. (Presumably they still don't block browser fingerprinting, so sites will just move to that instead...)

Re: Firefox rolls out Total Cookie Protection by default to all users

#149

Post by bitwrangler »

It would be nice to allow users to create "trusted tuples" to list small groups of domains that are allowed to share their cookies. For instance: Zendesk, Asana, Jira, etc.

But have each tuple listed still be isolated from the other, only domains listed together in a single list could share a cookie container.

Re: Firefox rolls out Total Cookie Protection by default to all users

#150

Post by cpmsmith »

Sohcahtoa82 wrote: post #117
Renaud wrote: post #92

Earlier quoted context omitted.

It's not that one site is seeing another site. It's that multiple sites will serve content (ads, Javascript libraries, like buttons) from a common site (eg an ad network) that uses its own domain. That domain is allowed to get the cookie for itself because it is referenced by multiple site, that's how this type of tracking works. If you go to bbc.com, it still won't be able to see cookies from cnn.com, but say if adv…

> Everyone should use FF. Wouldn't simply installing an ad/tracking blocker like uBlock Origin be just as effective, if not moreso?

There's some overlap, but ads aren't the only thing using this. Google Fonts is the classic example of something that does add value (nice fonts) to a webpage, and as such isn't blocked by most adblockers (including uBO) by default, but is still able to use this for tracking because the same domain serves the font files on every website using them.
Post reply on HN