Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

581–590 of 786 posts

Re: Firefox 85 cracks down on supercookies

#581

Post by avodonosov »

asddubs wrote: post #546
avodonosov wrote: post #541

We need to acknowledge also that recognising the user as he moves across pages and domains is sometimes needed to provide valuable services to the user. Therefore, I believe, browsers have to provide a volunteer "tracking" functionality - when a web page reqests 3rd party cookies, a popup is shown to the user with the cookie values, description (as set by the owning domain), the list of domains already permitted to a…

this exists on safari, edge and FF https://developer.mozilla.org/en-US/docs/Web/API/Document/re... https://developer.mozilla.org/en-US/docs/Web/API/Storage_Acc... on safari, it's basically the only way to get access to third party cookies in an iframe since safari 13. I wish other browsers (chrome) would also enable this when third party cookies are disabled. On FF I think the rule is that you have to interact with t…

Wow, interesting.

So, to access 3rd party cookies I need to access a document DOM object that has that 3rd party origin? But such a document is not always available, is it...

Looks like the use cases targeted by that proposal are limited to an embedded iframe that wants to access its own domain cookies. I was thinking also about arbitrary doman.

Like requestStorageAccess(targetOrigin, keys...)

Re: Firefox 85 cracks down on supercookies

#582

Post by bigiain »

jimmydorry wrote: post #565
gamacodre wrote: post #346

Earlier quoted context omitted.

This. If you are loading some scripts that are actually required for your app or page to work right, why would you get them from someone else's infrastructure? Terminal laziness? Or is the assumption that XYZ corp has more incentive than you do to keep your page working? This never made much sense to me except for developer toys & tutorials.

It makes sense from a $$ and resource usage stand point. I have to assume the best here and believe that the people arguing on there being no merit to CDN hosting of shared libraries all forgetting the two most important things a business must consider. Every byte sent will cost the business. If you can save that 2MB per user per cache life, you pay that much less on the internet bill for your hosting. Every byte sen…

> If your site is 10KB and you rely on 2MB of javascript libraries and fonts,

... then you're doin' it wrong.

Re: Firefox 85 cracks down on supercookies

#583

Post by dotancohen »

fimbulvetr wrote: post #521
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Somewhat off topic but have you see all of the recent (2 years) malware using webassembly? It's difficult to disable in chrome, somewhat difficult to disable in firefox, and no extensions seem to help. I'd love make it as easy to disable as JS.

Webassembly is about to become as necessary for browsing the modern web as Javascript is today. For much of the same reasons: you must keep it on to be tracked, so it will be "made necessary" on as much of the commercial web as possible.

Re: Firefox 85 cracks down on supercookies

#584

Post by _1gwx »

tl;dr Your browser is getting slower because some repulsive companies just can't keep it to themselves. The level of sophistication is far from trivial, linked from the article:

https://webkit.org/blog/8146/protecting-against-hsts-abuse/

"An attacker seeking to track site visitors can take advantage of the user’s HSTS cache to store one bit of information on that user’s device. For example, “load this domain with HTTPS” could represent a 1, while no entry in the HSTS cache would represent a 0. By registering some large number of domains (e.g., 32 or more), and forcing resource loads from a controlled subset of those domains, they can create a large enough vector of bits to uniquely represent each site visitor."

Re: Firefox 85 cracks down on supercookies

#585

Post by CRConrad »

sbarre wrote: post #424
TedDoesntTalk wrote: post #403

Earlier quoted context omitted.

> Are you somehow suggesting that they should just sit there and hope that people who have never heard of their product independently decide they happen to want or need that product and seek it out, unprompted? Yeah, it's even got a name: shopping.

And how do you know about the existence of a product to go shop for in the first place, if not through advertising and promotion? Or do you have infinite time to go browse every single store in your city on the odd chance that you'll see something you want?

If only there were some way one could search for specific things on the Web.

Re: Firefox 85 cracks down on supercookies

#586

Post by scrollaway »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight

Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development.

If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specifically, it's the only reason many kids can do remote learning as efficiently as they can.

Dude/dudette, I'm not a big fan of JS but let's recognize the good it has brought on the world, instead of complaining in the likes of what amounts to "if only we still lived in caves, we wouldn't have those pesky problems with online advertising" or something.

Re: Firefox 85 cracks down on supercookies

#587

Post by avodonosov »

surround wrote: post #577
avodonosov wrote: post #541

We need to acknowledge also that recognising the user as he moves across pages and domains is sometimes needed to provide valuable services to the user. Therefore, I believe, browsers have to provide a volunteer "tracking" functionality - when a web page reqests 3rd party cookies, a popup is shown to the user with the cookie values, description (as set by the owning domain), the list of domains already permitted to a…

Which valuable services? I’ve had 3rd party cookies entirely disabled for a while now, and I haven’t noticed any services break, not even cross domain logins.

Maybe your services relied on the "supercookies" thus being immune to 3rd party cookies disabled :) ?

An example that I can imagine is a big onlite shopping company that has several domains, and they want a shopping cart that that works across all their domains.

Re: Firefox 85 cracks down on supercookies

#588

Post by mikem170 »

xg15 wrote: post #508
masa331 wrote: post #429

Earlier quoted context omitted.

No no no. The problem isn't JavaScript or web capabilities here. It's the companies and people who use them in evil ways. I would rather handle that even if it's much much harder.

And how would you address this problem?

I browse in firefox with javascript turned off, in ublock, with a bunch of other restrictions [0], and temporary containers. I make exceptions for a couple dozen sites, like my bank, open street maps, etc. Youtube is my only soft spot here, the rest of google I keep blocked. I can make one-off exceptions to read a tab in front of me, but that's not routine, it's not hard to find sites that support this.

[0] https://github.com/pyllyukko/user.js

Re: Firefox 85 cracks down on supercookies

#589

Post by swznd »

avolpe wrote: post #252
legym wrote: post #142

Earlier quoted context omitted.

In Javascript how are they able to retrieve something from the cache? Local, session, and cookies are domain locked.

I think that they put the user information in the image using something like this[1]. [1]. https://github.com/subc/steganography

Likely, they put identifier with steganography

When image loaded, js read the identifier, if the image loaded from cache, the identifer still same

Edit: typo

Re: Firefox 85 cracks down on supercookies

#590

Post by andrewflnr »

scrollaway wrote: post #586
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

That's an entirely different question to whether it should be on by default for random sites, which is what GP is actually talking about. I would go farther and say that there was never a time that it looked reasonable.
Post reply on HN