Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#41

Post by pwg »

agluszak wrote: post #20

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

Cookies first appeared in Netscape on Oct 13, 1994 [1]. In 1994 the 'web' was a very different place and the current environment of web tracking and invasive advertising companies simply did not exist. And no one saw the privacy invading potential at the time.

[1] https://en.wikipedia.org/wiki/Browser_cookie#History

Re: Firefox rolls out Total Cookie Protection by default to all users

#42

Post by ajvs »

corentin88 wrote: post #2

Reminds me of what Google Chrome (and others browsers) did for cache. That's clever, not 100% sure this will prevent tracking, but at least it makes tracker's life a bit harder.

Yes these are each subsets of State Partitioning[1], of which cache has also been partioned in Firefox for some time now.

[1] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...

Re: Firefox rolls out Total Cookie Protection by default to all users

#44

Post by dec0dedab0de »

agluszak wrote: post #20

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

The web was designed to be highly interconnected. Deep linking is a feature. Cookies are set via headers. If you load an image from another domain, the headers from that domain could set their own cookies, and your browser will give each domain every cookie it has set.

That is, cookies aren't shared, they're locked down to the domain that set them. It's just that some domains have content loaded by millions of pages. This change won't protect you much if you have a relatively stable IP address without many users on it, because your IP is still in the third party domains logs. This welcome change makes it harder to differentiate people on the same IP, or to track a browser as it changes IPs.

As I'm typing this, I'm remembering how helpful IPv6 is for people who want to track everyone.

Re: Firefox rolls out Total Cookie Protection by default to all users

#45

Post by xnorswap »

ajvs wrote: post #28
xnorswap wrote: post #7

Does this affect single-sign-on implementations?

It shouldn't. "Exceptions are made for cross-site cookies when they're needed for non-tracking purposes, such as those used by popular third-party login providers."[1] [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-pr...

So only the popular third-party login providers are excused?

That feels worrying for competition, does it not entrench the current login providers?

Re: Firefox rolls out Total Cookie Protection by default to all users

#46

Post by CharlesW »

jaywalk wrote: post #17

This is a fantastic way to do this. I wish Safari worked the same way instead of just completely blocking third-party cookies.

Can you explain why? Apple did this two years ago and I haven't personally seen any side effects, but Safari's also not my primary browser.

Re: Firefox rolls out Total Cookie Protection by default to all users

#47

Post by Taywee »

eps wrote: post #5
corentin88 wrote: post #2

Reminds me of what Google Chrome (and others browsers) did for cache. That's clever, not 100% sure this will prevent tracking, but at least it makes tracker's life a bit harder.

Quoted post unavailable.

Tone policing is irrelevant and annoying. Technical relevance and accuracy trumps any of your personal feelings on Google, and I say that as a person who generally detests Google.

Re: Firefox rolls out Total Cookie Protection by default to all users

#49

Post by legalcorrection »

ravenstine wrote: post #22
legalcorrection wrote: post #4

I wonder why Microsoft doesn't make Edge a privacy-oriented browser. I'm surprised they think they can make more from the data economy than they would gain by seriously hurting Google et al.

Because Microsoft has had a history of caring about privacy? I'd expect something like this from Apple with Safari, but not Microsoft. M$ can't even give its own developer base privacy by allowing all telemetry to be disabled.

Companies don't care about jack shit. Tim Cook doesn't "believe in" privacy, he thinks it helps sell devices (and that lack of privacy could lead to scandal that would hurt sales).

Re: Firefox rolls out Total Cookie Protection by default to all users

#50

Post by throwaway0x7E6 »

svieira wrote: post #30
xnorswap wrote: post #7

Does this affect single-sign-on implementations?

SSO, probably not - embedding, possibly. If you're just worried about logging in through sso.coolcorp.com to third-party.corp using any of the normal methods (OAuth, SAML, Kerberos, etc.) then you're probably fine. If you're worried about composing a page made up of lots of custom embedded components and those components _don't_ use SSO (or if they do, but they authenticate invisibly using an iframe instead of authen…

with mozilla's 2% browser market share, as a developer you don't need to worry at all
Post reply on HN