please someone fix the internet... I don't want to see any cookie popups on each site and accept / decline each cooke first only so I can see the content I want.
I don't care about all these cookies and this should be managed by a browser. I hope what Firefox did is the beginning of such a fix.
Firefox rolls out Total Cookie Protection by default to all users
231–240 of 339 posts
Re: Firefox rolls out Total Cookie Protection by default to all users
#232Earlier quoted context omitted.
A site isn't allowed to see another site's cookies, common sense doesn't fail you.
No, but I said see the _existence_ of. Or am I wrong there? Ha, I should really know this :P
I'm not a front end guy, but AFAIK no, even the existence of. Apart from various hacks, of course.
Re: Firefox rolls out Total Cookie Protection by default to all users
#233Earlier quoted context omitted.
Yes, you can follow the meta-bug here to see the current issues we're working on resolving in a better way: https://bugzilla.mozilla.org/show_bug.cgi?id=1537702 Perhaps unsurprisingly, Microsoft logins are the most glaring exceptions right now (Teams, Logins, Office, Live), and we're working with MS to see if we can find an acceptable fix (or work-around while it's fixed). There are also exceptions for github.dev and…
What is the "better way" here? There is a legitimate use case for having login/identity stuff on a different domain - many of the largest companies in the world are doing this. How can this issue be solved without either confusing users through the requestStorageAccess API, or forcing everyone to use a single domain for everything?
Right, Total Cookie Protection has been baking for a while to try to minimize that kind of breakage, and we're already in discussions with other browser vendors and companies to get everyone onboard on the Privacy CG.
In a nutshell, adding new case-specific web APIs seems to be the likely way forward here. There are proposals floating around like an "is logged in" API, the Federated Credential Management API, and so on.
I'm not sure there's ever going to be a perfect solution for everything, but I would certainly rather have users more informed and empowered about their privacy than they currently are (even if some folks prefer to just "allow all").
I guess we'll just have to wait and see which proposals win out, and in the meantime rely on heuristic-based solutions like Total Cookie Protection to iteratively get us to a better place.
Re: Firefox rolls out Total Cookie Protection by default to all users
#234Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general
Cookies first appeared in Netscape on Oct 13, 1994 [1]. In 1994 the 'web' was a very different place and the current environment of web tracking and invasive advertising companies simply did not exist. And no one saw the privacy invading potential at the time. [1] https://en.wikipedia.org/wiki/Browser_cookie#History
> And no one saw the privacy invading potential at the time.
Maybe not the privacy invasion potential but ... As we got started building amzn in the fall of 94, it was a no-brainer decision to not use cookies even though they were just arriving. The controversy around the idea was intense and it was far from clear that they would be a success as a technology. It is likely true that there was more attention being paid to the "what? it lets a remote server create a file on my driver?" angle than the privacy one.
Re: Firefox rolls out Total Cookie Protection by default to all users
#235Earlier quoted context omitted.
yeah and so? how is this information useful? if the actual useful information is encrypted, then size is meaningless as it is just random text until decrypted. presence/absence? you have a cookie or you don't?
You say the size is meaningless. But sometimes it may actually be meaningful. And presence/absence is information also. Not much, but it definitely exists.
In what way? If I'm storing 255 bytes of username/email/credentials/settings/etc, but pad in some fun way to 512 bytes prior to encryption, what in the world does knowing that the cookie is 512 bytes do you? You have no idea what data is stored. You don't know if there are 512 bytes of actual data, 128 bytes with lots of fluff, or anything at all other than 512 bytes. Hell, it could be 0 bytes of data and 512 bytes of random data that I submit to every single person that visits the site just to fuck with people like you! You seem like you need something to do ;-)
Re: Firefox rolls out Total Cookie Protection by default to all users
#236Earlier quoted context omitted.
Firefox has a sub 8% market share, so I doubt this will make a drastic change to how they operate.
Surprised it's even that high, I tried to switch to Firefox the other month for privacy but gave up because it crashed on me it-least once a day. Edit: thanks for the downvotes, I would have preferred if it worked but it didn't. I tried basic troubleshooting, disabling extensions etc. but didn't find it usable on macOs Monterey, think it doesn't play well with youtube.
Probably you were downvoted because your comment took the thread on a generic tangent - indeed into one of the most-trodden areas on HN. Generic tangents are easy to fall into (of course) but make threads less interesting, which is why the site guidelines ask people to avoid them. https://news.ycombinator.com/newsguidelines.html
Unpredictable/whimsical/curious tangents are still ok. Just not the predictable ones.
More explanations here if anyone wants them:
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
Re: Firefox rolls out Total Cookie Protection by default to all users
#237Earlier quoted context omitted.
> Why weren’t separate cookie jars the default in the first place? Tracking today is an interaction between cookies and pages, not really because cookies were designed to be shared between domains. Because of that, ads on web pages are a reason that information gets shared across sites. Any ad or other iFramed content that’s served on a site can get the domain name of where it’s be served from and then access the iFr…
The solution still seems to be to: 1. Use Firefox, block .js by default, and selectively allow. 2. Set browser to block cross-site cookies, and to purge all cookies when closing browser. 3. Avoid tabbed browsing, and restart browser after using a website. I've been doing this since about 2006. It's inconvenient, but gives some peace of mind.
I'd replace 3 with self-destructing cookies.
Re: Firefox rolls out Total Cookie Protection by default to all users
#238Earlier quoted context omitted.
It shouldn't. "Exceptions are made for cross-site cookies when they're needed for non-tracking purposes, such as those used by popular third-party login providers."[1] [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-pr...
So only the popular third-party login providers are excused? That feels worrying for competition, does it not entrench the current login providers?
Total** Cookie Protection
**: Not total
It sounds like the "Full Self Driving"** from Tesla... got to love the new-speak.
**: Not fully self-driving....
Re: Firefox rolls out Total Cookie Protection by default to all users
#239Privacy wins aside, can anyone please help educate if third party single sign ons will still continue to work?
And can someone explain how I'm supposed to implement SSO? We have a bunch of subdomains that support SSO by communicating with an iframe that has the logon status stored, but it appears that the iframe wouldn't have access to its own data anymore. Is that right?
Subdomains shouldn't be a problem unless your base domain is in the Public Suffix List.
According to MDN:
> More specifically, Firefox double-keys all client-side state by the origin of the resource being loaded and by the top-level site. [1]
They linked the definition of a "site" to the HTML5 spec, which says this:
> To obtain a site, given an origin origin, run these steps: [2]
> 1. If origin is an opaque origin, then return origin.
> 2. If origin's host's registrable domain is null, then return (origin's scheme, origin's host).
> 3. Return (origin's scheme, origin's host's registrable domain).
The HTML5 spec refers to the site's registrable domain according to the URL spec:
> A host’s registrable domain is a domain formed by the most specific public suffix, along with the domain label immediately preceding it, if any. [3]
Public Suffixes are defined according to a database that you have to explicitly register in [4]. If you aren't sure whether your base domain is registered as a public suffix, then it probably isn't.
[1]: https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...
[2]: https://html.spec.whatwg.org/multipage/origin.html#site
Re: Firefox rolls out Total Cookie Protection by default to all users
#240Earlier quoted context omitted.
Cookies first appeared in Netscape on Oct 13, 1994 [1]. In 1994 the 'web' was a very different place and the current environment of web tracking and invasive advertising companies simply did not exist. And no one saw the privacy invading potential at the time. [1] https://en.wikipedia.org/wiki/Browser_cookie#History
> And no one saw the privacy invading potential at the time. Maybe not the privacy invasion potential but ... As we got started building amzn in the fall of 94, it was a no-brainer decision to not use cookies even though they were just arriving. The controversy around the idea was intense and it was far from clear that they would be a success as a technology. It is likely true that there was more attention being paid…
How did you manage session information without using cookies?