Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

251–260 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#251

Post by dahart »

nybble41 wrote: post #243
dahart wrote: post #118

Earlier quoted context omitted.

> Why weren’t separate cookie jars the default in the first place? Tracking today is an interaction between cookies and pages, not really because cookies were designed to be shared between domains. Because of that, ads on web pages are a reason that information gets shared across sites. Any ad or other iFramed content that’s served on a site can get the domain name of where it’s be served from and then access the iFr…

> Total Cookie Protection is going to put cookies that only Facebook can see in a different jar for each separate site you visit, making it so that Facebook can’t read it’s own cookies across different sites. Won't this break some basic features like being logged in to Facebook (or similar services, e.g. Disqus) for the purpose of embedded comment sections on other sites? They don't use cookies only for tracking butt…

Yes, it might break embedded features like comments unless you whitelist the allowed uses. I would assume Firefox handles this thoughtfully, but I haven’t tried the new cookie jars yet, so I don’t know what the UI looks like or allows.

Re: Firefox rolls out Total Cookie Protection by default to all users

#252

Post by datavirtue »

nybble41 wrote: post #243
dahart wrote: post #118

Earlier quoted context omitted.

> Why weren’t separate cookie jars the default in the first place? Tracking today is an interaction between cookies and pages, not really because cookies were designed to be shared between domains. Because of that, ads on web pages are a reason that information gets shared across sites. Any ad or other iFramed content that’s served on a site can get the domain name of where it’s be served from and then access the iFr…

> Total Cookie Protection is going to put cookies that only Facebook can see in a different jar for each separate site you visit, making it so that Facebook can’t read it’s own cookies across different sites. Won't this break some basic features like being logged in to Facebook (or similar services, e.g. Disqus) for the purpose of embedded comment sections on other sites? They don't use cookies only for tracking butt…

Why can't the browser can handle the login?

Re: Firefox rolls out Total Cookie Protection by default to all users

#253

Post by nightpool »

Ayesh wrote: post #84
logifail wrote: post #68

Earlier quoted context omitted.

> so they can use server-side ID syncs Does this only work if you use the same email across multiple sites? If so it's yet another reason to use a different email address with every site you sign up at.

> Does this only work if you use the same email across multiple sites? At a huge risk of EU regulars cracking on, it is quite possible to track a user across multiple accounts by simply using a cookie that lives long enough (say, 30 days) to establish the connections between multiple accounts. For a server-side ID sync, you don't even need user accounts. Just a unique ID set in a cookie will do.

How would this work when the cookie ID is different for every different embedding (first-party) context? That's the whole point of total cookie isolation.

Re: Firefox rolls out Total Cookie Protection by default to all users

#255

Post by bombcar »

Animats wrote: post #254

I've had third party cookies blocked for ten years. Some sites don't work. I don't use those sites.

What has become very annoying is so many sites are using "third party cookies" for whatever asinine "single sign on" product they've been sold. The number of redirects my browser undergoes when I log into my health insurance portal is mind boggling.

Re: Firefox rolls out Total Cookie Protection by default to all users

#256

Post by craigmart »

wisniewskit wrote: post #201
letmeinhere wrote: post #128

Does this obviate the need for [Facebook Container]( https://addons.mozilla.org/en-US/firefox/addon/facebook-cont... )?

Facebook Container is a stricter form of protection for Facebook specifically, so no, you should continue using it if you're interested in isolating Facebook. Total Cookie Protection is about isolating third party cookies/web storage, without breaking as much of the web as simply blocking third party cookies does.

What kind of protection does Facebook Container have other than deleting cookies outside of the container?

For my case Total Cookie Protection is enough, but if you want the same protection of Facebook Container for every website (i.e. session cookies which are deleted each time you restart the browser) you can install Cookie AutoDelete or use the built-in option to delete cookies at restart (whitelisting websites where you need permanent cookies).

Re: Firefox rolls out Total Cookie Protection by default to all users

#257

Post by ars »

hericium wrote: post #66

About 90% of Mozilla's income comes from Google. If this would prevent tracking, Google would not allow Mozilla to release it.

Google's income will not change if they don't track.

If they can't track, then each ad has less value. But then the advertiser has more budget available to spend on advertising.

Net result is no change for advertisers, or Google. But they users will see more, less targeted ad.

So that's my prediction as the result of this: We'll have more ads, but each will be less personalized.

Re: Firefox rolls out Total Cookie Protection by default to all users

#258

Post by mdp2021 »

staticassertion wrote: post #223
hedora wrote: post #148

Earlier quoted context omitted.

It's really weird that they claim there privacy work started in 2015. Netscape Navigator add cross site cookie blocking at some point, and firefox has always (?) had it. The innovation here seems to be that they further partition by the URL in the address bar. It's frustrating that browsers have been fighting and losing this war for 25 years. (Presumably they still don't block browser fingerprinting, so sites will ju…

It's not possible to block browser fingerprinting since it's a range of techniques and heuristics based on numerous features. There's no "turn off fingerprinting" button you can just press.

It is possible to enable obstacles to fingerprinting.

In Firefox, it is configuration entry

  privacy.resistFingerprinting
Some details (the list is not exhaustive):

> * Your timezone is reported to be UTC; * Not all fonts installed on your computer are available to webpages; * The browser window prefers to be set to a specific size; * Your browser reports a specific, common version number and operating system; * Your keyboard layout and language is disguised; * Your webcam and microphone capabilities are disguised; * The Media Statistics Web API reports misleading information; * Any Site-Specific Zoom settings are not applied; * The WebSpeech, Gamepad, Sensors, and Performance Web APIs are disabled, etc.

Re: Firefox rolls out Total Cookie Protection by default to all users

#259

Post by abdullahkhalids »

oefrha wrote: post #158
notriddle wrote: post #154

Earlier quoted context omitted.

There’s no technical reason why this has to be hard. If jira was at jira.atlassian.com and bitbucket was bitbucket.atlassian.com, they would have the same origin, plus they would make the relationship between them visible to any moderately savvy user. It’s only complicated because they allow their marketing dept to make it complicated.

You do realize acquisitions occur?

Business operation complications are not a valid reason for the violation of the rights of humans.

Re: Firefox rolls out Total Cookie Protection by default to all users

#260

Post by three14 »

notriddle wrote: post #239
three14 wrote: post #228

Earlier quoted context omitted.

And can someone explain how I'm supposed to implement SSO? We have a bunch of subdomains that support SSO by communicating with an iframe that has the logon status stored, but it appears that the iframe wouldn't have access to its own data anymore. Is that right?

Subdomains shouldn't be a problem unless your base domain is in the Public Suffix List. According to MDN: > More specifically, Firefox double-keys all client-side state by the origin of the resource being loaded and by the top-level site. [1] They linked the definition of a "site" to the HTML5 spec, which says this: > To obtain a site, given an origin origin, run these steps: [2] > 1. If origin is an opaque origin, t…

Thanks! I actually got as far as your [1], but incorrectly assumed that 'site' meant 'origin', so thank you for explaining.
Post reply on HN