[deleted]
Firefox rolls out Total Cookie Protection by default to all users
161–170 of 339 posts
Re: Firefox rolls out Total Cookie Protection by default to all users
#162Earlier quoted context omitted.
they can still track you based on your account (e.g. Gmail, Hotmail, iCloud) Really? I don't think so. How would that work? If you visit www.somesite.com - how would javascript on that site identify you via Gmail?
Because Google's, Apple's and Microsoft's accounts specifically are tied to their particular browser and/or OS, not just the websites you're on. So are Firefox accounts but they probably don't have the numbers to engage in any particularly egregious behavior.
Are you saying that Google is using their control of the user agent to specifically tie a Google auth cookie to an individual third-party-context web request even when third party cookies are blocked? If so, that would be a major scandal. What evidence do you have that this is the case?
Re: Firefox rolls out Total Cookie Protection by default to all users
#163Privacy wins aside, can anyone please help educate if third party single sign ons will still continue to work?
Single sign on doesn't need cookies. The data is passed in the URL when redirecting back and forth between the website and the SSO provider.
Re: Firefox rolls out Total Cookie Protection by default to all users
#164given that Electron is really just a featureless browser shouldn't it be straightforward to make your own browser now? An address bar, navigation, and bookmarks ought to be enough to get you there. Seems like you should be able to make a browser for your specific needs/wants pretty easily these days. I'm not suggesting some sort of money making venture where you're beholden to investors to try and turn revenue with i…
given that Electron is really just a featureless browser shouldn't it be straightforward to make your own browser now? That's not what Electron is but there are piles of fork-ish browser projects out there statistically nobody uses. This also answers the second question in the negative - it is not straightforward to make your own browser that's as useful as the browser you're likely using.
> > given that Electron is really just a featureless browser [...]
> That's not what Electron is
I mean...isn't it?
Forget the idea of what it's used for and just look at how it works. It's a framework for making apps that uses Chromium for rendering and a Node backend. Strip off the Node backend and you're left with Chromium.
And Chromium on its own is a web browser. Electron just doesn't show the controls for it.
As far as I'm concerned, Electron is a featureless web browser with a backend added to do things a browser normally can't do on its own, like reading local files without presenting a dialog.
Re: Firefox rolls out Total Cookie Protection by default to all users
#165Cool. Just a heads' up that I had to disable it on Zendesk and Asana so they could talk to each other - you might experience similar issues.
EDIT: Nvm, I found it. Thank you.
Re: Firefox rolls out Total Cookie Protection by default to all users
#166Earlier quoted context omitted.
they can still track you based on your account (e.g. Gmail, Hotmail, iCloud) Really? I don't think so. How would that work? If you visit www.somesite.com - how would javascript on that site identify you via Gmail?
Okay: 1) you visit to www.somesite.com 2) it serves an ad 3) your browser does a request to google. It sends: a) your login cookie from your gmail session (or ...) b) the referrer header tells it which site to serve the ad on c) any information the site itself wants to attach to the request 4) Google/Microsoft/Apple store this information and can provide advertisers with your identity, all sites you visit that have t…
Okay, but: a) is blocked by site partitioning, b) doesn't have per-user tracking information, and c) only works (of course) if you've explicitly signed in with Google on that site. I don't think Google supports third-party tracking for ads via that personalization path yet, but plenty of non-Google advertisers do: they take your hashed email address and use that to replace their third-party tracking cookies. This is what the ad community is hailing as their "privacy first" approach that breaks Google's "monopoly"—sending your email address to every single advertiser who they partner with.
Re: Firefox rolls out Total Cookie Protection by default to all users
#167Earlier quoted context omitted.
There are legit cross-domain use cases. A good example is how someone here mentioned (comment seems deleted though) account sessions being shared between Atlassian products like JIRA and BitBucket. The problem with that is domains are a poor way of representing ownership that can be trusted. If the web was rebuilt from scratch, a better approach might be to allow cookies to be shared between secure sites using the sa…
There’s no technical reason why this has to be hard. If jira was at jira.atlassian.com and bitbucket was bitbucket.atlassian.com, they would have the same origin, plus they would make the relationship between them visible to any moderately savvy user. It’s only complicated because they allow their marketing dept to make it complicated.
I think that’s unfair. By tying things to domains that way, you also make it potentially difficult to change URL structure (look at how long the various go.com domains lasted across all Disney/ABC properties. I know of teams that had very real problems years later b/c the infra was still based on domain stuff that was setup 15 years prior when the parent company thought internet portals were worth spending billions on), not to mention if you want to spin-off or sell an asset. Or if you acquire an asset!
To say nothing of SSOs, where you might not want to carry your login across, but you’d like to have the option of saying “yes, I’d like to use this account here too” and then authenticate.
Re: Firefox rolls out Total Cookie Protection by default to all users
#168I've never understood the thinking that went behind allowing one site to see the existence of another site's cookie in the first place. I don't think I'm even coming at this with the security hindsight of decades, it's just common sense, isn't it?
Sites can't see the existence of other sites' cookies. They can, however, request resources from other sites. Those requests, in turn, would send third-party cookies, if any, to the third-party server _and_ save new third-party cookies in response. "Tracking beacons" abuse this behavior to correlate user behavior across many web sites.
Re: Firefox rolls out Total Cookie Protection by default to all users
#169> making Firefox the most private and secure major browser available across Windows and Mac. Which one do they think is the most private and secure browser for Linux?
Maybe they figure most linux users can tweak the settings, install & configure plugins on whatever browser they're using to harden things up with the hassle overhead they can live with..?
Shoutout for firefox's cross OS, cross device syncing. "I found that and I have that it open in a tab on my desktop" and now it's open on my phone. Send another tab from phone to laptop where it's easier to work on. Really good stuff.
Re: Firefox rolls out Total Cookie Protection by default to all users
#170> making Firefox the most private and secure major browser available across Windows and Mac. Which one do they think is the most private and secure browser for Linux?
Lynx probably