Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

591–600 of 786 posts

Re: Firefox 85 cracks down on supercookies

#591

Post by madeofpalk »

abcd_f wrote: post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

IIRC browsers (chrome and/or safari?) haven’t cached assets like that cross origin for years.

Re: Firefox 85 cracks down on supercookies

#592

Post by surround »

jb1991 wrote: post #333

Can anyone explain the fingerprinting issue, unrelated to cookies. Visit any one of these many sites that show you what your browser knows about you, it doesn’t matter if using Firefox with fingerpring blocking enabled, the site reveals a tremendous amount of information in your fingerprint. Firefox doesn’t stop any of that, despite its settings that purport to do so. It's always the same information, not scrambled o…

Firefox’s default anti-fingerprinting is just a blacklist of common fingerprinting scripts.

It is incredibly difficult to make a browser fingerprint non-unique. Only the Tor browser has strict enough settings with a large enough user base to overcome fingerprinting.

If you don’t want to use Tor, try these:

- uBlock Origin (which has a larger blacklist of fingerprinting scripts)

- Enable the privacy.resistFingerprinting setting in about:config to make your browser more similar to other users with that setting enabled (but not entirely non-unique)

- The nuclear option: arkenfox user.js [1]. It’s github repo also contains a lot of further information about fingerprinting.

[1] https://github.com/arkenfox/user.js

Re: Firefox 85 cracks down on supercookies

#593

Post by madeofpalk »

viseztrance wrote: post #282
jefftk wrote: post #100

Earlier quoted context omitted.

Safari, Chrome, and Edge already partitioned the HTTP Cache by site; Firefox was the last major browser not to. It's great that Firefox is doing this, but it's not a differentiator.

The way they phrased it, in the post implies otherwise? > These impacts are similar to those reported by the Chrome team for similar cache protections they are planning to roll out.

It’s listed on Safari’s site https://webkit.org/tracking-prevention/#partitioned-third-pa...

Safari has been doing this since 2013 https://bugs.webkit.org/show_bug.cgi?id=110269

Tweeted about in 2017 https://twitter.com/cramforce/status/849621456111624192

Re: Firefox 85 cracks down on supercookies

#594

Post by bluGill »

austincheney wrote: post #572
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> Note that the root of all evil here is Javascript Not exactly. The root of all evil here is HTTP. You don’t need any JavaScript to plant cookies or other tracking assets. As a proof this technique is used to track users in email, such as embedding a 1 pixel image in an email retrieved via HTTP.

Which is why I turn off HTML email by default, and even when I turn it on for one message images are not loaded except by a second step. I rarely get to the first step and even less often the second.

Re: Firefox 85 cracks down on supercookies

#595

Post by CydeWeys »

> In fact, there are many different caches trackers can abuse to build supercookies. Firefox 85 partitions all of the following caches by the top-level site being visited: HTTP cache, image cache, favicon cache, __HSTS cache__, OCSP cache, style sheet cache, font cache, DNS cache, HTTP Authentication cache, Alt-Svc cache, and TLS certificate cache.

(emphasis mine)

This has negative effects on security, as has been pointed out previously by others: https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...

Imagine a widely used legitimate non-tracking resource, say, a shared JS or CSS library on a CDN. Currently, if that CDN uses HSTS, no matter how many independent websites incorrectly include said resource using an http:// URL, only the first request is MITMable, as every subsequent request will use the HSTS cache.

However, now, every single site will have its own separate HSTS cache, so every single first request from each site will independently be MITMable. Not good. This makes HSTS preloading even more important: https://hstspreload.org/

(Good news, if you have a .app or .dev domain, you're already preloaded.)

Re: Firefox 85 cracks down on supercookies

#596

Post by madeofpalk »

dazbradbury wrote: post #515

Worth pointing out that Chrome has been partitioning cache by domain since chrome 86 (released Oct 6th 2020). https://developers.google.com/web/updates/2020/10/http-cache... Does anyone know if these protections go further or differ significantly?

Also that Safari - so including iPhone - has done it in some form since 2013 https://bugs.webkit.org/show_bug.cgi?id=110269 and all the time since at least 2017 https://twitter.com/cramforce/status/849621456111624192

Re: Firefox 85 cracks down on supercookies

#597

Post by ff4lyfer99 »

mynameisash wrote: post #192
ff4lyfer99 wrote: post #103

Earlier quoted context omitted.

I switched in late 2017 when they released quantum or neutrino or whatever they called it, a huge performance release. As a backend dev and security focused eng I have little reason to test drive changes in all browsers. FF has been smooth and stable for me across desktop OSs. Having no reason to alternate between that and Chrome, I’ve been confused by people saying it’s slow. It’s been, to my memory, a flawless expe…

I've had a similar experience. My only gripe is that the Facebook Container extension / Multi-Account Containers[0] stopped working for some reason, and I haven't been able to get them working again. I love that I was able to sequester all of Google's real estate from all of Amazon from all of my work tabs, and so on. [0] https://support.mozilla.org/en-US/kb/containers

That’s weird; haven’t had an issue out of nowhere.

It was a little wonky when they first released it.

Sync has worked great across Mac, Windows, Linux, and I-devices for me.

Re: Firefox 85 cracks down on supercookies

#598

Post by megous »

kortilla wrote: post #540
floatboth wrote: post #275

Earlier quoted context omitted.

With some forms of caching it's much simpler: the browser sends an ETag or If-Modified-Since and the server is supposed to return 304 Not Modified to optimize the load if the cached resource is still valid.

But from JavaScript I don’t think you can see that. You just get the end result of the image being served to you. You have to infer it from timing.

https://megous.com/dl/tmp/705dc9a2477d1f95.png

For cross-origin, you'd add CORS.

Re: Firefox 85 cracks down on supercookies

#599

Post by CogitoCogito »

kortilla wrote: post #537
CogitoCogito wrote: post #510

Earlier quoted context omitted.

Regulation seems appropriate.

Regulation as a solution for problems on the Internet is pretty stupid because jurisdictions are so diverse.

I’m confused by your response given that regulations are a _standard_ solution for problems on the internet.

Re: Firefox 85 cracks down on supercookies

#600

Post by madeofpalk »

falsaberN1 wrote: post #171

The partitioning thing is terrible for people with slow/unstable connections, despite the security gains. Is there a way to disable it? Or should I better think about installing a caching proxy to avoid the redundant traffic?

Other browsers have been doing this for years. It’s fine.
Post reply on HN