Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

321–330 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#321

Post by viccuad »

nieve wrote: post #282
CodesInChaos wrote: post #270

Earlier quoted context omitted.

Internet explorer used to ask the user before saving cookies. And the server had to declare what cookies would be used for in machine readable form (P3P) which the browser used to decide if it want to allow the cookie (google blatantly lied) And more recently DNT. A graveyard of failed attempts at improving privacy

FIrefox used to ask, then it would ask if you set the right preference, and then it stopped asking entirely. I was very disappointed in them.

Why was it disappointing in them? Don't they need to compete with Chrome and Safari's UX, that just allow those cookies?

Re: Firefox rolls out Total Cookie Protection by default to all users

#322

Post by pbzm »

flipbrad wrote: post #15

Cool. Just a heads' up that I had to disable it on Zendesk and Asana so they could talk to each other - you might experience similar issues.

That's not ideal! Could you please file a bug and provide steps to reproduce the issue? I'm happy to take a look. You can file it here: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...

Re: Firefox rolls out Total Cookie Protection by default to all users

#323

Post by michaelcampbell »

Sohcahtoa82 wrote: post #131
mastermedo wrote: post #73

I remember losing a bet a while back, because I was naive enough to think that was how cookies worked in the first place. Why did other sites ever have access to cookies they didn’t create was beyond me.

> Why did other sites ever have access to cookies they didn’t create was beyond me. They don't. If you go to example.com, and it loads an ad on tracker.com, then tracker.com will create a cookie. example.com WILL NOT be able to see that cookie. Likewise, if you were to log into example.com, tracker.com WILL NOT see the example.com cookie. What happens (Without third party cookie blocking or FF's TCP) is if you then g…

Thanks; this is a more clear explanation than I've seen elsewhere.

Re: Firefox rolls out Total Cookie Protection by default to all users

#324

Post by madacol »

Agamus wrote: post #289
madacol wrote: post #276

Earlier quoted context omitted.

I'm not sure about #3. there's still sessions, localstorage, indexDB, etc

I didn't mention #4 of also purging all that other stuff when the browser closes. Honestly, try it with me - it's not so bad. 1, 2, 3, everybody now!

I don't really need to. With the extensions I use, every new tab I open is like a private windows, it has its own isolated environment.

And I can still keep sessions opened where I really need to

Re: Firefox rolls out Total Cookie Protection by default to all users

#325

Post by Rastonbury »

zagrebian wrote: post #205
89vision wrote: post #202

Earlier quoted context omitted.

for non-dark pattern use cases where it is beneficial from a usability standpoint to share cookies across domains

Well, what are those use-cases? That is what I asked.

SSO across multi-domain, Github logins, using Youtube.com and Gmail.com with the same G account. Assuming this is done the same way as existing Multi-containers feature

Re: Firefox rolls out Total Cookie Protection by default to all users

#326

Post by matt-attack »

Agamus wrote: post #178
dahart wrote: post #118

Earlier quoted context omitted.

> Why weren’t separate cookie jars the default in the first place? Tracking today is an interaction between cookies and pages, not really because cookies were designed to be shared between domains. Because of that, ads on web pages are a reason that information gets shared across sites. Any ad or other iFramed content that’s served on a site can get the domain name of where it’s be served from and then access the iFr…

The solution still seems to be to: 1. Use Firefox, block .js by default, and selectively allow. 2. Set browser to block cross-site cookies, and to purge all cookies when closing browser. 3. Avoid tabbed browsing, and restart browser after using a website. I've been doing this since about 2006. It's inconvenient, but gives some peace of mind.

I just by default use private mode. Pretty sure in Safari that helps.

Re: Firefox rolls out Total Cookie Protection by default to all users

#327

Post by pbzm »

flipbrad wrote: post #15

Cool. Just a heads' up that I had to disable it on Zendesk and Asana so they could talk to each other - you might experience similar issues.

Could you please file a bug and provide steps to reproduce the issue? I'm happy to take a look. You can file it here: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...

Re: Firefox rolls out Total Cookie Protection by default to all users

#328

Post by leaflets2 »

diea wrote: post #189
dec0dedab0de wrote: post #44

Earlier quoted context omitted.

The web was designed to be highly interconnected. Deep linking is a feature. Cookies are set via headers. If you load an image from another domain, the headers from that domain could set their own cookies, and your browser will give each domain every cookie it has set. That is, cookies aren't shared, they're locked down to the domain that set them. It's just that some domains have content loaded by millions of pages.…

Hmm... I think IPv6 might be actually better. Apple for example will generate and use a temporary IPv6 which changes every few hours to protect your privacy.

Can't one look at the first parts of an IPv6 and roughly know anyway who it is? I've read that one can only control the last parts of ones IPv6 space -- the first, one gets from ones ISP?, can they be enough to know who one is?

Re: Firefox rolls out Total Cookie Protection by default to all users

#329

Post by leaflets2 »

jeltz wrote: post #301
marshray wrote: post #261

Earlier quoted context omitted.

Didn't that break bookmarks?

Sometimes, but usually not. What it did enable was people accidentally leaking their sessions when sharing links.

What did the company do then? (When their users started accidentally leaking session IDs)

(Hmm but you're a different person :-))

Re: Firefox rolls out Total Cookie Protection by default to all users

#330

Post by savingsPossible »

celestialcheese wrote: post #250
grishka wrote: post #242

Why not abolish third-party cookies altogether? There are very few good uses for them.

Chrome has on the roadmap to do exactly this. [1] Turns out, Getting rid of 3rd party cookies concentrates power in the ad world in the hands of those with the most 1st party data (and active session cookies). Google, Facebook, Amazon and Apple. [2] The tracking debate is contentious and has a lot of folks on here who are privacy maximalists, and I'm not trying to debate the ethics of ads. But in terms of utility, 3r…

How does the tri-opoli keep traking users when there are no 3rd party cookies? Do they mean to implement an explicit exception/a different tracking protocolol?
Post reply on HN