Live data from Hacker News

First-party isolation in Firefox: what breaks if you enable it?

ctrl.blog

21–30 of 120 posts

Re: First-party isolation in Firefox: what breaks if you enable it?

#21

> I’m not sure whether that is because Mozilla consider it unsafe, unpractical, or don’t want to commit to maintain the feature in future releases. I imagine it was implemented for the container tabs.

If you enable FPI, is there any benefit to also using container tabs? That is, assuming that you aren't using containers to allow you to log in to the same website with different accounts, but rather to keep data from different websites separate?

FPI is intended to stop tracking between domains. Containers are designed for the other use case you just described. You can use them both at the same time if you want to achieve both.

Re: First-party isolation in Firefox: what breaks if you enable it?

#22

> I’m not sure whether that is because Mozilla consider it unsafe, unpractical, or don’t want to commit to maintain the feature in future releases. I imagine it was implemented for the container tabs.

Not quite, it's a different axis. Security tokens in firefox contain the domain of the actual request/resource they are related to (e.g. the domain of an iframe) and a bag of data called originAttributes. Containers are one value in that bag. The top level window domain (1st-party) is added as another value if you enable FPI.

Re: First-party isolation in Firefox: what breaks if you enable it?

#23
post #9

Earlier quoted context omitted.

This is a possible work-around, but it adds a lot of complexity to get HTTPS and stuff worked-around. Either the third-party must handle HTTPS for their partners who setup CNAMEs, or the first-party must handle HTTPS and proxy the requests back to the third-party. It’s doable but it will significantly slow things down to the point where even shitty websites would consider it unacceptable.

The third-party can handle HTTPS just for that particular subdomain, using a separate certificate.

Yes, but this would significantly increase complexity.

Re: First-party isolation in Firefox: what breaks if you enable it?

#24
I like most of what you said and agree with the cause.

But why does your own blog load up with an apparently-unironic call to be whitelisted in Adblock?

If you don't want to be tracked by other people's ads, why are you helping track people with ads on your own site?

The page also loads Google Analytics.

Re: First-party isolation in Firefox: what breaks if you enable it?

#25

I like most of what you said and agree with the cause. But why does your own blog load up with an apparently-unironic call to be whitelisted in Adblock? If you don't want to be tracked by other people's ads, why are you helping track people with ads on your own site? The page also loads Google Analytics.

Effort have been made at keeping the impact of ads and tracking low: https://www.ctrl.blog/about/privacy-policy#privacy-policy-ad...

The ads help fund writing and research into technologies that restrict ads without blocking them outright. You choosing to block ads is your choice, but it takes away incentives for researching and writing about the topics you care to read about. You can sign-up for Flattr if you prefer not to see ads and still support writers. https://flattr.com/contributors

Re: First-party isolation in Firefox: what breaks if you enable it?

#27

Another plan is to use self-destructing cookies. You can whitelist some domains then, and break much less

You can still be tracked through cache tokens, DNS cache-probing, and methods other than cookies. FPI is so much more than just keeping cookies under control.

Re: First-party isolation in Firefox: what breaks if you enable it?

#28
Hello everyone, I’m the most happiest person on the face of the earth, after 6 months of sadness and sorrow without being with the one i love, i tried all my possible best to make sure i make my lover happy but it never seems to work out well it was like am doing everything in vain but all thanks goes to Dr Asaka for coming to change all my worries and sadness to happiness. i knew the great man when i read some wonderful testimony about how he has helped lots of people on their relationship problems. i was reading a magazine when i saw great testimonies, as well my predicament then i decided not to waste time because i have missed my lover so much i decided to contact him and share all my problem with him which he told me not to worry that he is assuring me that within 48 hours everything would be sorted out i believed Dr Asaka so much because of how he has been helping many people, my boyfriend who left me for good suddenly replied my text and returned my calls and asked me to please forgive him i was so happy am so grateful to Dr Asaka for what he has done for me and I promise to testify his goodness all through my life. If you are there passing through the same problem or any kinds of problem contact this great man on his email address: drasakaspelltemple@gmail.com

Re: First-party isolation in Firefox: what breaks if you enable it?

#29
post #25

I like most of what you said and agree with the cause. But why does your own blog load up with an apparently-unironic call to be whitelisted in Adblock? If you don't want to be tracked by other people's ads, why are you helping track people with ads on your own site? The page also loads Google Analytics.

Effort have been made at keeping the impact of ads and tracking low: https://www.ctrl.blog/about/privacy-policy#privacy-policy-ad... The ads help fund writing and research into technologies that restrict ads without blocking them outright. You choosing to block ads is your choice, but it takes away incentives for researching and writing about the topics you care to read about. You can sign-up for Flattr if you prefer…

That’s genius! Using trackers to research not using trackers.. so why don’t you use more privacy oriented analytics instead of google analytics? Matomo (formerly known as Piwik) seems like a better choice, unless that option is exactly what you’re researching.

I don’t mean to be so snarky. Your comment seems so hypocritical to me, though.

Re: First-party isolation in Firefox: what breaks if you enable it?

#30
post #25

I like most of what you said and agree with the cause. But why does your own blog load up with an apparently-unironic call to be whitelisted in Adblock? If you don't want to be tracked by other people's ads, why are you helping track people with ads on your own site? The page also loads Google Analytics.

Effort have been made at keeping the impact of ads and tracking low: https://www.ctrl.blog/about/privacy-policy#privacy-policy-ad... The ads help fund writing and research into technologies that restrict ads without blocking them outright. You choosing to block ads is your choice, but it takes away incentives for researching and writing about the topics you care to read about. You can sign-up for Flattr if you prefer…

I don't use an adblocker -- I just use Firefox with tracking protection on. I'm okay with ads, just not track-y heavy ads, and Tracking Protection does the trick.

You may want to look into why Tracking Protection doesn't like your ads.

Post reply on HN