Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

651–660 of 786 posts

Re: Firefox 85 cracks down on supercookies

#651

Post by nunez »

kristofferR wrote: post #78
abcd_f wrote: post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

LocalCDN is an extension I would recommend, both for privacy and performance reasons. https://www.localcdn.org/

Wow. This is really neat. I’m going to give this a shot!

Re: Firefox 85 cracks down on supercookies

#652

Post by ComputerGuru »

hsuduebc2 wrote: post #648
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Ads are frustrating but this can lead to even more irrelevant and therefore more frustrating ads.

Some of us think being tricked into purchasing things we would easily like but don’t need is worse.

Re: Firefox 85 cracks down on supercookies

#653

Post by silentbugs »

kortilla wrote: post #537
CogitoCogito wrote: post #510

Earlier quoted context omitted.

Regulation seems appropriate.

Regulation as a solution for problems on the Internet is pretty stupid because jurisdictions are so diverse.

But the reason you're not brute forcing passwords on your bank's e-banking system isn't because you can't or because they are super secure, it's because if you do you'll probably go to jail.

Also, good regulation is important to keep the big dogs on a leash and to have something to go after them when they don't behave.

Technological solutions will of course come, but you also need regulation, especially until the technological solutions come.

Re: Firefox 85 cracks down on supercookies

#654

Post by boring_twenties »

hsuduebc2 wrote: post #650

I hope I'm wrong but if this type of tracking is not going to be possible, then more irrelevant ads start showing up and ends up as even more unpleasant experience?

I would prefer to have "irrelevant" ads. They're equally useless, no more and no less. But, they're less distracting.

Re: Firefox 85 cracks down on supercookies

#655

Post by Groxx »

avodonosov wrote: post #587
surround wrote: post #577

Earlier quoted context omitted.

Which valuable services? I’ve had 3rd party cookies entirely disabled for a while now, and I haven’t noticed any services break, not even cross domain logins.

Maybe your services relied on the "supercookies" thus being immune to 3rd party cookies disabled :) ? An example that I can imagine is a big onlite shopping company that has several domains, and they want a shopping cart that that works across all their domains.

A big online shopping company that moves you between several domains as part of normal use? tbh I've never seen a single site do this, so I don't feel bad saying "no, I don't think that's a legitimate reason to allow 3rd party cookies".

Besides, since they control all the domains, they can do redirects to associate your session across them easily enough. It's basically oauth at that point, which works just fine without 3rd party cookies.

Re: Firefox 85 cracks down on supercookies

#656

Post by eins1234 »

Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

> Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Definitely this. Reminds me of the whole Spectre/Meltdown debacle.

Re: Firefox 85 cracks down on supercookies

#657

Post by WD-42 »

1vuio0pswjnm7 wrote: post #642

"Trackers and adtech companies have long abused browser features to follow people around the web." Is this a confesion. Browsers, including Mozilla, have continually designed and kept those features enabled by default, even when they are aware of the abuse.[1] Mozilla is nearly 100% funded by a deal with Google. I try to forget these facts every time I read some public communication coming from Mozilla, but they just…

I think that's a little harsh. The same article describes using image caches as a means of tracking users across domains. Would you consider image caching one of the technologies developed solely for the purpose of selling ads that your theoretical perfect browser should rip out?

Browsers are essentially entire operating systems at this point. Ad companies hire engineers. It's inevitable that this engineers will find exploits. Your stance seems to completely ignore this fact. If it would be so easy to create your perfect, user centric, privacy first browser, why haven't you made it yourself?

Re: Firefox 85 cracks down on supercookies

#659

Post by shakna »

ben509 wrote: post #564
Gare wrote: post #174

Earlier quoted context omitted.

They load the image URL and observe the loading time. If it's fetched quickly, they know it was from cache. The server (controlled by the advertisers) can intentionally add delay to those image requests that makes detection reliable.

I don't see how that helps you persist a tracking ID. If you generate a random URL, you'll always get a cache miss. If you use a static URL, you'll know if you have a new session or not, but that doesn't tell you what the tracking ID was. The only thing I can imagine is the server serve several images /byte1.png /byte2.png etc. and make them all X by 1 pixels, encoding a random value in the dimensions, assuming that'…

> If you use a static URL, you'll know if you have a new session or not, but that doesn't tell you what the tracking ID was.

As Mozilla have said:

> "In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image."

The identifier is encoded into the image itself on a fresh fetch of the static URL, which can then be extracted by JS (which can access pixel data, and their RGBA channel values).

When a cache-hit is detected, you know you have an identifier that correlates to user history.

Re: Firefox 85 cracks down on supercookies

#660

Post by rrdharan »

scrollaway wrote: post #638
waste_monk wrote: post #636

Earlier quoted context omitted.

Good things are happening in spite of JS, not because of it. It's a silly language, the type system is atrocious, and the entire ecosystem is a joke (look at the left-pad incident).

Typescript has an excellent type system and one of the best development environments the entire dev world can use. You know what ecosystem it's a part of? The JS one. That "entire" one you're talking about has produced superb work such as React, V8, is pretty much responsible for Rust existing, and so on. JS has dumb flaws. It doesn't mean anything is happening "in spite" of it. If anything, innovation is happening t…

> Typescript has an excellent type system

It has a type system. "Excellent" feels a bit strong.

https://blog.asana.com/2020/01/typescript-quirks/

https://www.executeprogram.com/courses/typescript/lessons/ty...

Post reply on HN