Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox getting smarter about third-party cookies

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 103 posts

Re: Firefox getting smarter about third-party cookies

#61

Post by derefr »

ferongr wrote: post #16

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509

It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on.

Combining this with a "forgiveness is better than permission" principle (which seems to be sorely lacking in web browsers, other than a few just-plain-strange places like alert() dialogs), the best UX might just be a warning bar stating "Example.com has reserved 1KB/5MB of your disk so it can remember its place. [Disallow]"

Disallowing would make the site think it still has a permanent store, but internally replace it with an ephemeral one (FS::TEMPORARY, session cookie, etc.) This also might make browser makers get off their lazy butts and make ephemeral versions of the rest of these mechanisms, to make this work ;)

Re: Firefox getting smarter about third-party cookies

#62

Post by jbooth »

brandnewlow wrote: post #59
jbooth wrote: post #36

Earlier quoted context omitted.

You're right that these retargeting shops have a stupid thesis and can only exist because marketers' metrics haven't evolved enough yet (and that's changing). Highest purchase % doesn't mean you changed intent or created business, you just won the bidding war to show an ad to someone who was already going to buy, or maybe already bought. But users will never manually enable 3rd party cookies, even if they agreed with…

Is your criticism of retargeting based in experience? I'd love to hear more about it. I work at a "retargeting shop" and our customers test the crap out of our tools to make sure we're actually driving results. Others may use more smoke and mirrors, but when done right, retargeting does in fact change user behavior and generate ROI.

Well, there are situations where retargeting makes a bit of sense, like selling business services on a low-traffic website.

But most e-commerce retargeting, IMHO, is trading on the fact that a naive marketing manager will put too much stock in a high conversion percentage. All of those people were, by definition, aware of the product and actively shopping. Did you create a customer? Probably not, maybe by virtue of them clicking the ad instead of going somewhere else, but that's still pretty zero-sum.

Prospecting for people who haven't previously clicked the item on your site, but would be interested, is a lot harder and potentially more valuable.

All IMHO of course.

Re: Firefox getting smarter about third-party cookies

#63

Post by troymc »

chez17 wrote: post #56
Too wrote: post #35

Finally. Third party cookies provide almost zero value for users . Only use case is for log in on iframe-embedded apps such as Discus comment boards, but the ones you use yourself can be counted on one hand so adding exceptions isn't such a big issue. Adding some UI that shows that you are logged in to Discus on a particular web page would just good imo. I think the "From visited" option is an excellent trade off as…

> Third party cookies provide almost zero value for users. I don't like third party cookies either, but this is false. Your information is worth something to the right people. The websites you visit, mostly free, can make money off that information. The value to the user are free websites that provide you entertainment/content/etc... and are able to stay free because they are utilizing this as a revenue stream. We al…

While that's often true, many (most?) users have no idea that they're making this deal (i.e. "I let you store your cookies on my computer and in return I get free stuff.").

The European "cookie law" has caused many websites to give better notice that they're planting cookies, but it's rarely clear how those cookies are being used.

There is a better way. What if I purposefully signaled my intent to potential sellers, rather than having them guess what I want (based on their data about me)? Amazon wish lists are an example (although they'd be better if I stored the list in a place of my choice, where I control who sees what, and I'm told who looks). For more on this idea, see:

http://en.wikipedia.org/wiki/Vendor_relationship_management

Re: Firefox getting smarter about third-party cookies

#65

Post by jlebar »

ferongr wrote: post #16

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509

Merely making an HTTP request to a site -- any HTTP request, as far as I'm aware -- is sufficient for that site to set a cookie on your machine.

If on the other hand the site wants to store something in localstorage, the site has to run JS on your machine. That's a much higher bar.

Re: Firefox getting smarter about third-party cookies

#66

Post by cjensen »

taf2 wrote: post #58
Too wrote: post #35

Finally. Third party cookies provide almost zero value for users . Only use case is for log in on iframe-embedded apps such as Discus comment boards, but the ones you use yourself can be counted on one hand so adding exceptions isn't such a big issue. Adding some UI that shows that you are logged in to Discus on a particular web page would just good imo. I think the "From visited" option is an excellent trade off as…

what about in the context of a widget. I built a reservation widget and we used third party cookies to help keep your order available as you might load the widget on other sites. It was not an Ad, but for casino websites, they would have multiple domains one for each casino but shared the same reservation system... blocking third party cookies pretty much breaks the widget...

Safari has blocked third-party cookies for many years. I've never noticed any problems in real world use.

Re: Firefox getting smarter about third-party cookies

#67

Post by ubercow13 »

Silhouette wrote: post #34
ubercow13 wrote: post #26

Earlier quoted context omitted.

Is this not what you want? Third search result: https://addons.mozilla.org/en-US/firefox/addon/smart-referer...

Sorry, you're right. I think I forgot to misspell "referrer" the first time I searched.

Ah I didn't even know that was a thing. I think I am so used to the misspelling that I didn't even realise - the only place I regularly come across the word is in reference to HTTP.

Here for anyone who didn't know: http://en.wikipedia.org/wiki/HTTP_referer#Origin_of_the_term...

Re: Firefox getting smarter about third-party cookies

#68

Post by copypasteweb »

abcd_f wrote: post #2

Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.

RefControl is a nice addon for that, with ability to set default behaviour and override it for specific domains.

https://addons.mozilla.org/en-US/firefox/addon/refcontrol/

Re: Firefox getting smarter about third-party cookies

#69

Post by cromwellian »

There are lots of cases where third party cookies are used as auth tokens, not tracking tokens. Seems to me that the browser vendors should get together and come up with a better solution for browsers to store and manage auth tokens.

Right now it is done piecemeal by websites, but is confusing to end users. Having a direct, first-class API and UI in the browser that can show the user exactly what third party sites they are "logged into" and have a "Logout/Deauthorize" button next to them would be worthwhile, and have less of a chance of "breaking the web", or imposing workarounds that might hurt user experience.

BTW, how does Firefox treat a CORS XHR response? Does it allow a cookie to be set? Seems to be ad trackers could then just run a server that permits CORS, have a bit of JS that makes the request to opt it back in.

Re: Firefox getting smarter about third-party cookies

#70

Post by ihsw »

derefr wrote: post #61
ferongr wrote: post #16

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509

It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Co…

What's wrong with a whitelist?

"Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"

Post reply on HN