Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

541–550 of 786 posts

Re: Firefox 85 cracks down on supercookies

#541

Post by avodonosov »

We need to acknowledge also that recognising the user as he moves across pages and domains is sometimes needed to provide valuable services to the user.

Therefore, I believe, browsers have to provide a volunteer "tracking" functionality - when a web page reqests 3rd party cookies, a popup is shown to the user with the cookie values, description (as set by the owning domain), the list of domains already permitted to access the cookies and their privacy policy links, and options Allow Once, Allow, Deny Once, Deny.

So instead of fighting each other, service and the user had a chance to cooperate. Service only needs to describe the need clear enough.

Re: Firefox 85 cracks down on supercookies

#542

Post by surround »

floatingatoll wrote: post #322
newscracker wrote: post #91

Use uBlock Origin, Multi Account Containers, Privacy Badger, Decentraleyes and CookieAutoDelete with Firefox. Make sure you aggressively clear cache, cookies, etc., periodically (with CookieAutoDelete). You’ll probably load the web servers more and also add more traffic on your network, but it will help protect your privacy since most websites don’t care about that. When websites are user hostile, you have to take pr…

Doing this will make it trivially easy to fingerprint and track you on the web, as the set of people who use non-defaults like this list is 0.000001% of the total possible user space for their area, and your IP address probably only changes rarely or never A better way to protect yourself is to use a browser with tracking protections on by default, and leave the settings alone. You may see a few more ads but you’ll b…

Every browser already has a unique fingerprint. uBlock origin does a ton to improve privacy, it’s foolish not to use it just to avoid fingerprinting.

Re: Firefox 85 cracks down on supercookies

#543

Post by dcposch »

dathinab wrote: post #522
abcd_f wrote: post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

> Per-site caching negates the principal selling point of centrally-hosted JS and resources It doesn't or more correctly the benefit wasn't really a think in most cases. I will not start the discussion her again but on previous hacker news articles about this topic you will find very extensive discussions about how in practice the caches often didn't work out well for all kinds of reasons and how you still have a per…

Plus, FF can preserve the value by allowing cross domain resource caching as long as the request specifies a hash.

That negates the super cookie use case, but still lets you eg. load Jquery from a shared CDN.

You get a free security upgrade to go with it.

Re: Firefox 85 cracks down on supercookies

#544

Post by nicklaf »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

This is why I whitelist Javscript on a per-subdomain basis. I think NoScript does this but I use a simpler extension[0] and then rely on uBlock origin and multi account containers for privacy once I've whitelisted sites.

[0] https://addons.mozilla.org/en-US/firefox/addon/disable-javas...

Re: Firefox 85 cracks down on supercookies

#546

Post by asddubs »

avodonosov wrote: post #541

We need to acknowledge also that recognising the user as he moves across pages and domains is sometimes needed to provide valuable services to the user. Therefore, I believe, browsers have to provide a volunteer "tracking" functionality - when a web page reqests 3rd party cookies, a popup is shown to the user with the cookie values, description (as set by the owning domain), the list of domains already permitted to a…

this exists on safari, edge and FF

https://developer.mozilla.org/en-US/docs/Web/API/Document/re...

https://developer.mozilla.org/en-US/docs/Web/API/Storage_Acc...

on safari, it's basically the only way to get access to third party cookies in an iframe since safari 13. I wish other browsers (chrome) would also enable this when third party cookies are disabled. On FF I think the rule is that you have to interact with the site beforehands and you get access automatically, failing that you can use this API. No idea how it works in edge

Re: Firefox 85 cracks down on supercookies

#547

Post by notatoad »

avodonosov wrote: post #541

We need to acknowledge also that recognising the user as he moves across pages and domains is sometimes needed to provide valuable services to the user. Therefore, I believe, browsers have to provide a volunteer "tracking" functionality - when a web page reqests 3rd party cookies, a popup is shown to the user with the cookie values, description (as set by the owning domain), the list of domains already permitted to a…

The "problem" with that solution is that users are very willing to click any button necessary to achieve their goal, and in any dialog that prompts to allow tracking in order to achieve something else, most people will click allow.

Personally I don't think this is a problem, and people should be allowed to make that choice. But most of HN seems to disagree with me there, and feels that users need to be protected from making choices that could allow them to be tracked

Re: Firefox 85 cracks down on supercookies

#548

Post by surround »

buzzy_hacker wrote: post #188
newscracker wrote: post #91

Use uBlock Origin, Multi Account Containers, Privacy Badger, Decentraleyes and CookieAutoDelete with Firefox. Make sure you aggressively clear cache, cookies, etc., periodically (with CookieAutoDelete). You’ll probably load the web servers more and also add more traffic on your network, but it will help protect your privacy since most websites don’t care about that. When websites are user hostile, you have to take pr…

Agree, but substituting multi-account containers with temporary containers https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

Cookie auto delete is fairly useless. It can’t delete supercookies. Whereas temporary containers takes care of everything.

Re: Firefox 85 cracks down on supercookies

#549

Post by ballenf »

masa331 wrote: post #429
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

No no no. The problem isn't JavaScript or web capabilities here. It's the companies and people who use them in evil ways. I would rather handle that even if it's much much harder.

I don't think it's either/or. Yeah we need to act against companies abusing it, but we also need to be prudent and put locks on our houses when we know there are thieves and spies who would love to sneak inside and take notes on our every move.

What frustrates me the most is that we can't individually disable web api's that provide no value to us. Yeah, that would give greater entropy to fingerprinting, but I'm willing to take that tradeoff if I could prevent webrtc, motion sensing, screen size detection, or web assembly e.g. except on selected whitelisted websites.

Re: Firefox 85 cracks down on supercookies

#550

Post by musicale »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

This is what tempers my enthusiasm for WebAssembly - it will undoubtedly be used for all sorts of user-hostile and malicious activity.
Post reply on HN