Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

701–710 of 786 posts

Re: Firefox 85 cracks down on supercookies

#701

Post by scrollaway »

emptyparadise wrote: post #696
scrollaway wrote: post #684

Earlier quoted context omitted.

That's not my point. You wouldn't have had the development speed we've had the last 30 years. You wouldn't have had the same amount of devs. The same pickup on the web. The same worldwide connectivity. Javascript is one of the, if not the, most influential technologies of the past 100 years. It changed the course of history. Can you say the same of, like, wxWidgets or whatever UI toolkit you'd be using for your nativ…

>Javascript is one of the, if not the, most influential technologies of the past 100 years. That's... one hell of a claim.

I 100% stand behind it. It rivals everything I can think of and then some (the internet itself included).

Re: Firefox 85 cracks down on supercookies

#702

Post by franga2000 »

judge2020 wrote: post #560
franga2000 wrote: post #410

Earlier quoted context omitted.

Wasn't there an article about paying with your face around here just a bit ago? People clearly don't just tolerate this, but embrace it. Only people from places where it's too late to go back (like China) are aware of the dangers of these systems, but they can hardly warn the rest of us and when they do, we generally don't listen as "something like that surely wouldn't happen in my free country". It would seem that p…

> Wasn't there an article about paying with your face around here just a bit ago? There's not much risk to 'pay with your face' for Apple/Google/Samsung pay given it's all on-device biometrics that never leave the phone, but a similar situation is when Google paid $5 to people willing to submit their face to help with facial recognition training in the then-upcoming Pixel 4 phone. https://gadgets.ndtv.com/mobiles/new…

It wasn't about that, it was about cameras and screens mounted on kiosks that you would just look at and make a hand gesture to pay. Not sure who was doing the processing, but it certainly wasn't anything the users owned/controlled.

Re: Firefox 85 cracks down on supercookies

#703

Post by ForHackernews »

viraptor wrote: post #576
whalesalad wrote: post #569

Earlier quoted context omitted.

I’m not familiar with a distinct “sign in cookie” either. Do you mean a server side cookie / HttpOnly?

It's basically a cookie holding your session id, scoped only to the site and used only for auth purposes (or holding the session vars if you're doing client-side sessions)

So, just to reiterate, contrary to the comment I replied to, you are suggesting we "place data in the browser for tracking" a user's authentication state and session.

Re: Firefox 85 cracks down on supercookies

#704

Post by CogitoCogito »

sjwright wrote: post #700
CogitoCogito wrote: post #510

Earlier quoted context omitted.

Regulation seems appropriate.

"Regulation" mandated stupid cookie consent overlays on every damn European website. Thanks, regulation.

Does the fact that some regulations are ineffective imply that all are?

Re: Firefox 85 cracks down on supercookies

#705

Post by alkonaut »

LeifCarrotson wrote: post #509
danbruc wrote: post #452

How much money is a user actually worth per year on average? And why can I not pay that amount of money and be left alone, not seeing any ads, not being tracked, not being sold?

Annual average revenue per (active) user (from North America) is about $180 for Google, $150 for Facebook, and $80 for Twitter. As you might expect, Amazon has far higher revenue per user ($700), and Apple is about $140, but they're both more like $30 when you only count their advertising revenue instead of much lower-margin retail and hardware manufacturing businesses. Searching for "ARPU" news will give articles wi…

It's astonishing that the value is so high. I use the internet on N devices for probably 12h a day and I can't imagine I'm worth even a positive amount anywhere.

I max out free tiers of OneDrive/DropBox etc, use my free minutes of build time at the dev sites, I use some social media features but I browse Twitter and reddit on custom apps that don't show any ads. I never ever click an ad in an article or search no matter how interesting or relevant.

So if since I'm a net loss, that means that for everyone who is like me, there has to be someone who is an even larger gain for these companies. I have all of those services (Google, fb, twitter) and I'm still pretty sure I provide a negative revenue for all of them. So Someone needs to provide the revenue I don't. It's a scary amount. My internet activity is subsidized by someone who must be doing a scary amount of clicking on the sponsored google results, or something.

Re: Firefox 85 cracks down on supercookies

#706

Post by fauigerzigerk »

scrollaway wrote: post #586
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

>JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development.

JS didn't lower the barrier to programming at all. On the contrary, programming with VisualBasic and SQL was 10 times more accessible and productive than web development. What enabled millions to write software was the availability of computers in every household.

What the Web did was revolutionise software distribution. After making a change to my 1990s style VB program I had to pack a stack of floppy disks and travel to my customer to install the new version on their PCs, migrate the data, make sure everything still worked in spite of other programs installing an overlapping set of DLLs, etc.

With the Web, we took a massive hit in terms of developer productivity and complexity, but the distribution model trumped absolutely everything. It also made things possible that would have been completely unthinkable, such as running software made by a large number of developers you don't know and don't necessarily trust with all your data.

To this day, the Web is the only reasonably secure runtime environment that isn't centrally controlled by some gatekeeper with its own agenda.

So I actually agree with most of what you have said elsewhere in this thread. But I disagree about lowering the barrier for developers.

Re: Firefox 85 cracks down on supercookies

#707

Post by exporectomy »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Turing completeness isn't the problem. If Javascript was one of those non-Turing-complete languages that don't have loops, etc. then it could still be used to track people. I think you're using that term to make your opinion sound powerful, but the power comes from what it has access to.

Re: Firefox 85 cracks down on supercookies

#708

Post by egeozcan »

emptyparadise wrote: post #696
scrollaway wrote: post #684

Earlier quoted context omitted.

That's not my point. You wouldn't have had the development speed we've had the last 30 years. You wouldn't have had the same amount of devs. The same pickup on the web. The same worldwide connectivity. Javascript is one of the, if not the, most influential technologies of the past 100 years. It changed the course of history. Can you say the same of, like, wxWidgets or whatever UI toolkit you'd be using for your nativ…

>Javascript is one of the, if not the, most influential technologies of the past 100 years. That's... one hell of a claim.

JS is indeed what brought us all the speed in software development. People could prototype their ideas crazy fast, and they still can. Scripting in browser had an immense positive impact on software industry, and that DID come with many negatives, but you always have the option to completely turn it off if those bother you.

A sandboxed environment was a huge idea and the browser has been the primary example of how great it can be. The app model in mobile with permission isolated access is more or less the proprietary re-implementations of the browser sandbox.

Re: Firefox 85 cracks down on supercookies

#709

Post by throwaway9d0291 »

masa331 wrote: post #429
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

No no no. The problem isn't JavaScript or web capabilities here. It's the companies and people who use them in evil ways. I would rather handle that even if it's much much harder.

Doesn't the same argument apply to basically every security and privacy feature?

"No no no. The problem isn't unencrypted network connections, it's companies and people who use them in evil ways. I would rather handle that even if it's much harder."

Should we not have introduced HTTPS? Permission models on modern operating systems? 2-factor authentication?

What about Javascript makes it different to the problems solved by these other features?

Re: Firefox 85 cracks down on supercookies

#710

Post by viraptor »

ForHackernews wrote: post #703
viraptor wrote: post #576

Earlier quoted context omitted.

It's basically a cookie holding your session id, scoped only to the site and used only for auth purposes (or holding the session vars if you're doing client-side sessions)

So, just to reiterate, contrary to the comment I replied to, you are suggesting we "place data in the browser for tracking" a user's authentication state and session.

Ah, I think we're stepping on an overloaded term. I mean tracking as in "identifier connecting visits from unrelated pages used for data collection" and not "identifier used by the site you're connecting to for purpose of holding browsing session variables".
Post reply on HN