Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

711–720 of 786 posts

Re: Firefox 85 cracks down on supercookies

#711
post #649

Earlier quoted context omitted.

Browsers can check "subresource integrity" to guard against hacks of third-party services. https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Yeah but you, the developer, need to provide the hash of the script being downloaded, work that’s easy to miss.

In case the hash is provided, caching across websites could be turned on again, to avoid the possibility of it being used as a supercookie. The website would have to know the hash of the supercookie before loading the resource. Except if a candidate set of possible users can reasonably be downloaded to the client, maybe sorted by time of last access and proximity to the geo location of the IP address of the last access...

Re: Firefox 85 cracks down on supercookies

#712

Earlier quoted context omitted.

Applications can exist outside of the web too.

Yes but if it was „incredibly naive“ to download and run JavaScript in the browser sandbox how naive would it have been to download and run native code outside of any sandbox? The browser runtime is what enabled us to use software provided by a huge number of developers of varying aptitude and motivation without putting in place some centralised gatekeeper with its own vested interests.

> Yes but if it was „incredibly naive“ to download and run JavaScript in the browser sandbox how naive would it have been to download and run native code outside of any sandbox?

It would be naive to download and run native code for every website you visiti, yes. A few that you trust and where you think that is warranted is a different matter.

Running javascript in a sandbox provides the illusion of safety so it gets enabled by default while still creating tons of problems.

Re: Firefox 85 cracks down on supercookies

#713

Earlier quoted context omitted.

Regulation seems appropriate.

"Regulation" mandated stupid cookie consent overlays on every damn European website. Thanks, regulation.

There is no regulation mandating cookie consent overlays - websites are free to not abuse cookies to track their users.

Re: Firefox 85 cracks down on supercookies

#714
This is definitely a step in the right direction. Problem isn't the browser's ability to run code such as JS which makes it possible to create things like supercookies. Problem is web pages are effectively applications that are semi-local (they can bind to local resources such as cookies, caches, storage, and connect to local peripherals) and the security model is very different between viewing HTML documents and running untrusted apps.

No good comes from downloading random, untrusted native applications from the net, installing them locally, and trusting these not to infect your system with malware. No good comes from loading random, untrusted applications into your browser either, and trusting these not to infect your browser, either.

Basically everything on the web should not only be sandboxed with regard to local system (this is mostly established) but also be sandboxed per site by default. Hidden data, or anything that's not encoded in the URI, should only move between sites at the user's discretion and approval.

I've had personal plans to ditch my complex adblocking, multi-account/temporary container and privacy setup in favour of a clean-state browser that I launch in a file-system sandbox such as firejail for each logical browsing session (like going shopping for X, going online banking, general browsing). Basically an incognito session but with full capabilities as sites can refuse serving incognito browsers. Normal browser setup with everything wiped off when the browser exists.

I have some dedicated browsers for things like Facebook where I whitelist a handful of necessary cookies and forget the rest on exit. This, however, won't clear data other than cookies. I think that per-site sandboxing would mostly solve this problem. I don't particularly care what data each site wants to store on my browser as long as it won't be shared with any other site.

Re: Firefox 85 cracks down on supercookies

#715

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

I agree with simias. What does JS have to do with my VPN? What was wrong with Skype? Still beats the pants off others for quality. I cannot think of much good agressive whitespace, hamburger menus, infinite scrolling, HID hijacking, copy-paste preventing, trackers etc, etc etc, has brought us, besides into the world of Aggressive Ad Arbitrage. Need https://motherfuckingwebsite.com/ be mentioned? The real powerhouse w…

> WebAssembly, or as I like to call it, reinventing the wheel while simultaneously and conveniently blocking ad-blockers.

This meme needs to die.

WebAssembly doesn't prevent ad blocking at all. Ad blocking relies on blocking network requests for the most part, which can still absolutely be blocked when done by WASM.

Some ad blockers also optionally relies on removing DOM nodes for greater coverage. It's important to note that this technique is used to reduce visual clutter, but doesn't prevent tracking, and doesn't increase browsing performance as the ad still gets downloaded before being removed.

Yes, a purely canvas-based app could work around DOM blocking, but WASM has nothing to do with it: you can do pure canvas-based UIs in javascript too, that's what all the modern web games do.

Re: Firefox 85 cracks down on supercookies

#716

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

>JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. JS didn't lower the barrier to programming at all. On the contrary, programming with VisualBasic and SQL was 10 times more accessible and productive than web development. What enabled millions to write software was the availability of…

>JS didn't lower the barrier to programming at all. >But I disagree about lowering the barrier for developers.

I think OP meant it as browsers that run JS. The built in console is so useful for testing/practice. You can run JS without any setup on most popular OS - Win/Linux/Mac.

You can practice JS in console while viewing YouTube tutorial or following a JS blog/ Mozilla dev page.

Re: Firefox 85 cracks down on supercookies

#717
post #519

Earlier quoted context omitted.

So different website features per country? Or do you mean regulation decides how a browser implements it? Either way I don't see how that would ever work.

You are aware there are country-specific (or even more local) regulations covering companies today right? In fact essentially all regulations are. So why are you acting like my proposition is somehow unprecedented?

Because this is about websites, not companies. I'm not a company. Do my website use a different regulated subset of JavaScript than yours? If it is a company do they follow local rules or local for the hosting company? What about sites that incorporate sources from different locations? Do JavaScript library developers now have to create a version of their script for each countries regulation? Then the US regulation will decide the rules for all of the worlds JavaScript development and deployment. No, which technologies that can be used on a website doesn't belong at regulators but developers. What can and cannot be tracked and collected belongs at regulators.

Re: Firefox 85 cracks down on supercookies

#718
post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Somewhat off topic but have you see all of the recent (2 years) malware using webassembly? It's difficult to disable in chrome, somewhat difficult to disable in firefox, and no extensions seem to help. I'd love make it as easy to disable as JS.

No surprise WebAssembly is disabled in Chrome on OpenBSD.

Re: Firefox 85 cracks down on supercookies

#719

Earlier quoted context omitted.

For more than a decade I've been campaigning (to any of my employers that utilise adverts on their platform) to drop adverts with the primary factor being that of performance for page load. The last time I looked, adverts were adding an additional ~35% load time to the page. Anywhere from 5% to _60%_ (!!) of vistors were navigating away before page load completed (Varied depending on company/product of course) and a…

What was their rationale for not doing as you suggested?

Sunk cost is/was my conclusion. At one firm in ~2013, advertising was bringing in $600k revenue per annum - we estimated a loss of potentially triple that (!) - but the response was apathetic. There was very much a reluctance to accept that the "advert management team" (yep, they had a team dedicated to managing the adverts, who had the duty of "managing" Google Ads) would need terminating, too.

Re: Firefox 85 cracks down on supercookies

#720

Earlier quoted context omitted.

For more than a decade I've been campaigning (to any of my employers that utilise adverts on their platform) to drop adverts with the primary factor being that of performance for page load. The last time I looked, adverts were adding an additional ~35% load time to the page. Anywhere from 5% to _60%_ (!!) of vistors were navigating away before page load completed (Varied depending on company/product of course) and a…

I often wonder incredulously whether developers responsible for particular sites really comprehend how bad performance has gotten. Browsing threads like this on HN makes it clear that they are probably well aware, but have no choice in the matter. In a way that's even more depressing because only a tiny minority of people are happy with the arrangement.

> I often wonder incredulously whether developers responsible for particular sites really comprehend how bad performance has gotten.

For every site I've developed and have been tasked with adding adverts, and every colleague that I have worked with that has done the same:

- Yes, we are aware.

- Yes, we doth protest.

- No, we were not successful.

Post reply on HN