Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

621–630 of 786 posts

Re: Firefox 85 cracks down on supercookies

#621

Post by tempestn »

floxy wrote: post #618
newscracker wrote: post #91

Use uBlock Origin, Multi Account Containers, Privacy Badger, Decentraleyes and CookieAutoDelete with Firefox. Make sure you aggressively clear cache, cookies, etc., periodically (with CookieAutoDelete). You’ll probably load the web servers more and also add more traffic on your network, but it will help protect your privacy since most websites don’t care about that. When websites are user hostile, you have to take pr…

Any reason to not go all-in and just use Tor? That's what I've been doing lately, although I'm not a web engineer, so I may not be doing the optimal thing.

I've found Tor to be too slow for everyday use. Plus you'll regularly get hit with (sometimes near-impossible) recaptchas.

Re: Firefox 85 cracks down on supercookies

#622

Post by eeZah7Ux »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created

No, it was already very unreasonable, especially as the browsers of the time had even worse sandboxing than now.

Re: Firefox 85 cracks down on supercookies

#623

Post by RL_Quine »

CydeWeys wrote: post #595

> In fact, there are many different caches trackers can abuse to build supercookies. Firefox 85 partitions all of the following caches by the top-level site being visited: HTTP cache, image cache, favicon cache, __HSTS cache__, OCSP cache, style sheet cache, font cache, DNS cache, HTTP Authentication cache, Alt-Svc cache, and TLS certificate cache. (emphasis mine) This has negative effects on security, as has been po…

A good portion of things are preloaded anyway, I don't see an issue with it.

Re: Firefox 85 cracks down on supercookies

#624

Post by eeZah7Ux »

musicale wrote: post #550
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

This is what tempers my enthusiasm for WebAssembly - it will undoubtedly be used for all sorts of user-hostile and malicious activity.

...and with zero accountability. Any website can push 10MB of obfuscated, debugger-resistant, code on your computer.

Obfuscated to resist ad-blockers and anti-tracking features.

Re: Firefox 85 cracks down on supercookies

#625

Post by triceratops »

nofunsir wrote: post #611
scrollaway wrote: post #586

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

I agree with simias. What does JS have to do with my VPN? What was wrong with Skype? Still beats the pants off others for quality. I cannot think of much good agressive whitespace, hamburger menus, infinite scrolling, HID hijacking, copy-paste preventing, trackers etc, etc etc, has brought us, besides into the world of Aggressive Ad Arbitrage. Need https://motherfuckingwebsite.com/ be mentioned? The real powerhouse w…

> I cannot think of much good...[JS] has brought us...

This has shades of "What have the Romans ever done for us".

https://www.youtube.com/watch?v=djZkTnJnLR0

Re: Firefox 85 cracks down on supercookies

#626

Post by Forbo »

takeda wrote: post #538
kristofferR wrote: post #308

Earlier quoted context omitted.

LocalCDN is an updated fork of Decentraleyes. Decentraleyes hasn't been updated in ages, has few assets and its assets are massively out of date. https://git.synz.io/Synzvato/decentraleyes/-/tree/master/res... vs https://codeberg.org/nobody/LocalCDN/src/branch/main/resourc...

My Decentraleyes was updated in November 5th, that's not that long ago. LocalCDN extension has also a comment that Mozilla doesn't regularly monitor it for security.

LocalCDN is much, much more actively developed than Decentraleyes.

https://codeberg.org/nobody/LocalCDN/commits/branch/main vs https://git.synz.io/Synzvato/decentraleyes/-/commits/v2.0.15

I'd imagine if LocalCDN got more popular than Decentraleyes, it would probably get Mozilla's seal of approval as a "recommended" extension. Then again I'm not entirely sure what their approval process for that looks like. Currently Decentraleyes has about 100x the userbase.

Re: Firefox 85 cracks down on supercookies

#627

Post by drzaiusapelord »

scrollaway wrote: post #586
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

So did using computers in single user mode, but we wouldn't dare do that today. JS is, arguably, over-reaching and way too powerful for the web to be turned on by default.

The sad part is we're probably just one decent privacy bill away from making almost all of this go away. JS + an anti-regulatory political climate is the larger problem. The EU has tackled this heads on recently with its privacy laws. At a certain point, technical work-arounds just don't work and the bad commercial actors will always win unless there's regulation stop them.

Re: Firefox 85 cracks down on supercookies

#628

Post by CogitoCogito »

TaylorAlexander wrote: post #617
CogitoCogito wrote: post #604

Earlier quoted context omitted.

You are aware there are country-specific (or even more local) regulations covering companies today right? In fact essentially all regulations are. So why are you acting like my proposition is somehow unprecedented?

Isn’t it obvious? Most companies subject to regulations are physically located somewhere. It’s much harder to enforce regulations against companies that operate in every global jurisdiction at once.

There are like 3 companies that do the vast majority of advertising. They have operations in countries they do business with. Do you think they’re hard to track down? Web tracking has consolidated over time hence enforcement is _easier_.

Re: Firefox 85 cracks down on supercookies

#629

Post by crazygringo »

PaulHoule wrote: post #122
abcd_f wrote: post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

That idea of having JS files hosted elsewhere always struck me as a Girardian scam (e.g. "everybody else does it") and always getting voted down when I showed people the reality factor. Nobody seemed to think it was hard to host a file before this came along, just as nobody thought it was hard to have a blog before Medium. Of course this creates the apocalyptic possibility that one of these servers could get hacked (…

> Nobody seemed to think it was hard to host a file before this came along, just as nobody thought it was hard to have a blog before Medium.

Huh? Who ever said the main point of a CDN is to make things easier? It's always been in order to provide a faster end-user experience.

> ...but it's also not easy to say you're really improving the performance of something if there is any possibility you'll need to do an additional DNS lookup -- one of the greatest "long tails" in performance.

But common CDN's will virtually already have their IP address cached while you're browsing anyways.

Caching certainly has nuance to it as you say, but I think you're being particularly ungenerous in claiming that CDN's are a scam and that you're representing "reality".

Businesses measure these things in reality with analytics, and they also almost always analyze the worst 5% or 1% of requests as well, not just the "median".

CDN's are a big boost to performance in many cases. Or at least, until now (for shared files). You shouldn't be so dismissive.

Re: Firefox 85 cracks down on supercookies

#630

Post by pmoleri »

legym wrote: post #142
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

In Javascript how are they able to retrieve something from the cache? Local, session, and cookies are domain locked.

Fetch/XHR as long as the tracker server have CORS * enabled, right? Then they can just inspect the blob data.
Post reply on HN