Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox getting smarter about third-party cookies

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 103 posts

Re: Firefox getting smarter about third-party cookies

#71

Post by derefr »

ihsw wrote: post #70
derefr wrote: post #61

Earlier quoted context omitted.

It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Co…

What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"

Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever.

Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify you've given them the persistence they want before they let you through, and so forth.

And even if they didn't, the request would still become one of those things naive users think you just "have to click OK to if you want the computer to keep doing the thing"--like Windows UAC elevation.

On the other hand, giving users an equivalent option to a "hellban" on a website--the ability to make the website think it's persisting, but then it turns out not to be--has far fewer incentives. It only ends up being something you click for a reason, rather than a "mother may I" you have to just click all the time, and since getting off the blacklist wouldn't be exposed directly through the browser chrome, there'd be nowhere for a malicious site to "point an arrow."

Re: Firefox getting smarter about third-party cookies

#72

Post by magic_haze »

derefr wrote: post #61
ferongr wrote: post #16

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509

It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Co…

This is pretty much what Chrome does, grouping everything under "site data". It also shows you flash cookies, though as far as I know, it doesn't show you its contents and doesn't let you block them through the third-party controls. A rather strange system.

Re: Firefox getting smarter about third-party cookies

#73

Post by derefr »

magic_haze wrote: post #72
derefr wrote: post #61

Earlier quoted context omitted.

It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Co…

This is pretty much what Chrome does, grouping everything under "site data". It also shows you flash cookies, though as far as I know, it doesn't show you its contents and doesn't let you block them through the third-party controls. A rather strange system.

Chrome gets about a 6/10 for this. Client certs, for at least one thing, aren't included in "site data" (it needs to be everything or it stops being an abstraction!); and for the mechanisms it does prompt for (only a few--again, making the abstraction leak), Chrome uses a whitelisting rather than blacklisting approach, which has the failure modes I mentioned in my other comment below.

Re: Firefox getting smarter about third-party cookies

#74

Post by ferongr »

jlebar wrote: post #65
ferongr wrote: post #16

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509

Merely making an HTTP request to a site -- any HTTP request, as far as I'm aware -- is sufficient for that site to set a cookie on your machine. If on the other hand the site wants to store something in localstorage, the site has to run JS on your machine. That's a much higher bar.

It's a bit disingenuous to make such a claim. The bar is essentially the same since browsers execute all, 1st and 3rd-party JS by default. Loading a document is enough. For a web-browser it's quite rare to make requests without completing the transfer.

The bar is essentially the same and the changes that privacy-invading 3rd party scripts have to do to bypass the Firefox's implementation are minimal, so Mozilla may as well not make any triumphant claims until this glaring issue is fixed.

Re: Firefox getting smarter about third-party cookies

#76

Post by belorn »

chez17 wrote: post #56
Too wrote: post #35

Finally. Third party cookies provide almost zero value for users . Only use case is for log in on iframe-embedded apps such as Discus comment boards, but the ones you use yourself can be counted on one hand so adding exceptions isn't such a big issue. Adding some UI that shows that you are logged in to Discus on a particular web page would just good imo. I think the "From visited" option is an excellent trade off as…

> Third party cookies provide almost zero value for users. I don't like third party cookies either, but this is false. Your information is worth something to the right people. The websites you visit, mostly free, can make money off that information. The value to the user are free websites that provide you entertainment/content/etc... and are able to stay free because they are utilizing this as a revenue stream. We al…

Let ad companies and ad supported SaS do what they are good at - Targeted ads. Target people who want the ads. Give those people the services of easy access to new products, and leave people who do not click on ads alone.

There is a simple answer to all this. Its called opt-in. If you need to harass and track users who do not want ads, then either the targeted ads are not targeted enough, or its a failed business model. Time to show which one it is.

Re: Firefox getting smarter about third-party cookies

#77

Post by Achshar »

epmatsw wrote: post #30
Retric wrote: post #21

Earlier quoted context omitted.

How about newspapers that show articles when a user comes from Google but not otherwise?

How is that a better experience? This is a legitimate question, I don't think I understand what you're referring to.

Maybe he means cases where newspaper sites let users skip paywall if they are coming from google x times a month.

Re: Firefox getting smarter about third-party cookies

#78

Post by Nursie »

derefr wrote: post #71
ihsw wrote: post #70

Earlier quoted context omitted.

What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"

Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever . Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify…

"almost all cookies are friendly"

I would really dispute this. Compare the number of sites visited to the number of ad-tracking cookies stored in the average browser, I think you'll find a very different answer.

Re: Firefox getting smarter about third-party cookies

#79

Post by Nursie »

mjn wrote: post #57
hiddenfeatures wrote: post #40

Earlier quoted context omitted.

Interesting. Isn't the website just telling to load the script from a Google server (which could count as 3rd party) and execute it?

It's loading from a 3rd party (with a 3rd-party HTTP request), but the script itself is run by the first party: scripts are owned by whichever page executes them, regardless of how that page conjured them up. That's why you can load jquery from a CDN without breaking lots of things, because jquery still "runs from" your domain, same as if it were hosted locally. Also a reason that you really need to trust the third-p…

Thanks, that's a neat little explanation and cleared a couple of things up for me :)

Re: Firefox getting smarter about third-party cookies

#80

Post by derefr »

Nursie wrote: post #78
derefr wrote: post #71

Earlier quoted context omitted.

Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever . Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify…

"almost all cookies are friendly" I would really dispute this. Compare the number of sites visited to the number of ad-tracking cookies stored in the average browser, I think you'll find a very different answer.

If you consider ad-tracking cookies set by sites {A,B,C} to be read by ad-provider X all "one cookie", then the numbers balance out. (Which I would--tracking cookies, semantically, should be considered to be stored in the ad-provider's "bucket", as far as allowing them/purging them goes.
Post reply on HN