When Mozilla comes out with a feature like this it usually whitelists google, microsoft and similar big sites so people can still log in across their network. Anybody know the current list for this feature?
Firefox rolls out Total Cookie Protection by default to all users
181–190 of 339 posts
Re: Firefox rolls out Total Cookie Protection by default to all users
#182This is a fantastic way to do this. I wish Safari worked the same way instead of just completely blocking third-party cookies.
Can you explain why? Apple did this two years ago and I haven't personally seen any side effects, but Safari's also not my primary browser.
It makes my life harder as a developer. I've got some widgets (hosted by me) that are embedded on my customer's websites, and because of Safari I can't use cookies for things like a shopping cart. I have no need for the cookies to be accessible from another website, even if it's got the same widget embedded, so this implementation by Firefox fits my use case perfectly. Unfortunately that doesn't change what Safari does, so it doesn't help me.
Re: Firefox rolls out Total Cookie Protection by default to all users
#183Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general
the web was directly bolted on top of the classic client-server network model. there was no concept of a website, just a bunch of requests needed to render whatever the markup (and the dynamic scripting stuff) wanted.
the interaction of those is completely left as an exercise to the (standards) readers. initially only remote code execution was a problem (eg. cross-site scripting), then the usual cross-site request forgery problems. and sure, there was all the usual gimmicks with list of sites you probably visited because it was possible to fingerprint by CSS plus exploiting cache timings.
initially framesets were all the jazz. you got free hosting and the provider just put your stuff inside a FRAME and the ad went above in a different frame.
serious sites had money to pay for hosting and SSL certs. and even if someone stole some credit card numbers the solution was easy, just use paypal!
privacy was seen as something to think about only when someone asked you a/s/l (age, sex, location), so basically when interacting with other humans in chat rooms (or on forums).
...
of course slowly but surely software (more exactly the Internet) is eating the world. being online is the default. Alphabet, the 8th on the Fortune 500 list doesn't even have brick and mortar stores (oh well, there's one in NYC and during this year's Google I/O they announced the second, also in NYC).
Re: Firefox rolls out Total Cookie Protection by default to all users
#184Earlier quoted context omitted.
There’s no technical reason why this has to be hard. If jira was at jira.atlassian.com and bitbucket was bitbucket.atlassian.com, they would have the same origin, plus they would make the relationship between them visible to any moderately savvy user. It’s only complicated because they allow their marketing dept to make it complicated.
You do realize acquisitions occur?
you do realize reorganization occur after acquisitions?
Re: Firefox rolls out Total Cookie Protection by default to all users
#185Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general
The web was designed to be highly interconnected. Deep linking is a feature. Cookies are set via headers. If you load an image from another domain, the headers from that domain could set their own cookies, and your browser will give each domain every cookie it has set. That is, cookies aren't shared, they're locked down to the domain that set them. It's just that some domains have content loaded by millions of pages.…
If you need Onion Routing then you need Onion Routing. IPv6 Privacy Addressing gives you roughly the same properties you had with IPv4 NAT except now when you did want a stable address you've got one.
Multi address is much healthier in IPv6, so it's reasonable for your browser to even spin up an address associated with a Porn tab, and then destroy it again when you close that tab, while still using your other IPv6 address for a post you make meanwhile to Hacker News. It's also reasonable (while it was often likely to cause mysterious problems in IPv4) to give your local web server a long-lived IPv6 address while your web browser's address changes every hour.
Re: Firefox rolls out Total Cookie Protection by default to all users
#186Earlier quoted context omitted.
> allow cookies to be shared between secure sites using the same certificate Or maybe encrypting cookies using the site certificate, which would still allow cookies to be shared with domains having a different certificate, but the server needs the correct key for decryption.
Ciphertext leaks information via its size and its presence / absence.
yeah and so? how is this information useful? if the actual useful information is encrypted, then size is meaningless as it is just random text until decrypted. presence/absence? you have a cookie or you don't?
Re: Firefox rolls out Total Cookie Protection by default to all users
#187Earlier quoted context omitted.
Can you explain why? Apple did this two years ago and I haven't personally seen any side effects, but Safari's also not my primary browser.
It makes my life harder as a developer. I've got some widgets (hosted by me) that are embedded on my customer's websites, and because of Safari I can't use cookies for things like a shopping cart. I have no need for the cookies to be accessible from another website, even if it's got the same widget embedded, so this implementation by Firefox fits my use case perfectly. Unfortunately that doesn't change what Safari do…
Ah! I can see how that’d be a PITA, thanks for explaining.
Re: Firefox rolls out Total Cookie Protection by default to all users
#188Earlier quoted context omitted.
There’s no technical reason why this has to be hard. If jira was at jira.atlassian.com and bitbucket was bitbucket.atlassian.com, they would have the same origin, plus they would make the relationship between them visible to any moderately savvy user. It’s only complicated because they allow their marketing dept to make it complicated.
You do realize acquisitions occur?
So use a 301 redirect.
Re: Firefox rolls out Total Cookie Protection by default to all users
#189Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general
The web was designed to be highly interconnected. Deep linking is a feature. Cookies are set via headers. If you load an image from another domain, the headers from that domain could set their own cookies, and your browser will give each domain every cookie it has set. That is, cookies aren't shared, they're locked down to the domain that set them. It's just that some domains have content loaded by millions of pages.…
Hmm... I think IPv6 might be actually better. Apple for example will generate and use a temporary IPv6 which changes every few hours to protect your privacy.
Re: Firefox rolls out Total Cookie Protection by default to all users
#190Earlier quoted context omitted.
> Why weren’t separate cookie jars the default in the first place? Tracking today is an interaction between cookies and pages, not really because cookies were designed to be shared between domains. Because of that, ads on web pages are a reason that information gets shared across sites. Any ad or other iFramed content that’s served on a site can get the domain name of where it’s be served from and then access the iFr…
The solution still seems to be to: 1. Use Firefox, block .js by default, and selectively allow. 2. Set browser to block cross-site cookies, and to purge all cookies when closing browser. 3. Avoid tabbed browsing, and restart browser after using a website. I've been doing this since about 2006. It's inconvenient, but gives some peace of mind.
That’d certainly prevent most tracking, yeah. This new Firefox feature should make #2 and #3 unnecessary.
I think this feature by Firefox is great, and privacy options are getting objectively better, if slowly. But the cynic in me guessing that server side tracking methods are going to start getting secretly better, if they haven’t already.