Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

731–740 of 786 posts

Re: Firefox 85 cracks down on supercookies

#731

Post by gorhill »

nicklaf wrote: post #544
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

This is why I whitelist Javscript on a per-subdomain basis. I think NoScript does this but I use a simpler extension[0] and then rely on uBlock origin and multi account containers for privacy once I've whitelisted sites. [0] https://addons.mozilla.org/en-US/firefox/addon/disable-javas...

In case you are not aware, uBO also allows to wholly disable/enable JS on a per-site basis.[1]

---

[1] https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-...

Re: Firefox 85 cracks down on supercookies

#732

Post by kuschku »

cjfd wrote: post #724
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

It seems to me that the only actual solution is just to make tracking people illegal.

That's what the GDPR did: any and all tracking is illegal, unless explicitly allowed by the user, for a specific purpose, with a specific list of third parties receiving the data, with the default always being off, and every single purpose and third party has to be explicitly clicked to be allowed. And the user has to have no repercussions from saying no. And no has to be the default. And the dialog has to be able to be ignored (in which case everything has to be denied).

Of course publishers don’t follow it and do the exact opposite: default allow everything, click every single one to say no.

Re: Firefox 85 cracks down on supercookies

#734

Post by huhnmonster »

kuschku wrote: post #732
cjfd wrote: post #724

Earlier quoted context omitted.

It seems to me that the only actual solution is just to make tracking people illegal.

That's what the GDPR did: any and all tracking is illegal, unless explicitly allowed by the user, for a specific purpose, with a specific list of third parties receiving the data, with the default always being off, and every single purpose and third party has to be explicitly clicked to be allowed. And the user has to have no repercussions from saying no. And no has to be the default. And the dialog has to be able to…

There are also seemingly companies, who just blatantly ignore such regulations.. https://brave.com/google-gdpr-workaround/

Re: Firefox 85 cracks down on supercookies

#735

Post by cjfd »

kuschku wrote: post #732
cjfd wrote: post #724

Earlier quoted context omitted.

It seems to me that the only actual solution is just to make tracking people illegal.

That's what the GDPR did: any and all tracking is illegal, unless explicitly allowed by the user, for a specific purpose, with a specific list of third parties receiving the data, with the default always being off, and every single purpose and third party has to be explicitly clicked to be allowed. And the user has to have no repercussions from saying no. And no has to be the default. And the dialog has to be able to…

I was talking about tracking being illegal. I said nothing about the user being able to allow it....

Re: Firefox 85 cracks down on supercookies

#736

Post by tremon »

ForHackernews wrote: post #703
viraptor wrote: post #576

Earlier quoted context omitted.

It's basically a cookie holding your session id, scoped only to the site and used only for auth purposes (or holding the session vars if you're doing client-side sessions)

So, just to reiterate, contrary to the comment I replied to, you are suggesting we "place data in the browser for tracking" a user's authentication state and session.

Please stop your gaslighting. You were the only one equating "place data in the browser for tracking" with all use of cookies, nobody else made that "mistake".

Re: Firefox 85 cracks down on supercookies

#737

Post by Normal_gaussian »

nofunsir wrote: post #611
scrollaway wrote: post #586

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

I agree with simias. What does JS have to do with my VPN? What was wrong with Skype? Still beats the pants off others for quality. I cannot think of much good agressive whitespace, hamburger menus, infinite scrolling, HID hijacking, copy-paste preventing, trackers etc, etc etc, has brought us, besides into the world of Aggressive Ad Arbitrage. Need https://motherfuckingwebsite.com/ be mentioned? The real powerhouse w…

It turns out: securing on network services is a PITA that school network admins don't need more of; developing good ones is expensive and is best outsourced to a SaaS; on network/on device resources need more extensive vetting than web resources; on network/device resources take days to try out and roll out with cooperation of the understaffed IT team, web resources take one class and a link.

Skype is superceeded by a half dozen more targetted classroom video chats - none of which need installing or require the kids to have accounts.

From the perspective of more easily deployable apps that are more useful to end users, WebAsm > HTML5 > Flash. The fact the ad monopolies run our major web developments is convenient for them to piggyback these changes, but isn't the drive for them.

Re: Firefox 85 cracks down on supercookies

#738

Post by namibj »

throwaway525142 wrote: post #632
eeZah7Ux wrote: post #624

Earlier quoted context omitted.

...and with zero accountability. Any website can push 10MB of obfuscated, debugger-resistant, code on your computer. Obfuscated to resist ad-blockers and anti-tracking features.

asm.js was a thing before WebAssembly, with the same downsides, except maybe a little less browser support for debugging, inspecting, etc. asm.js was able to exist without browser support in Chrome, so WebAssembly support doesn't really bring anything new to the table. At least that's how I understand it, care to give ideas why it's not a positive change? :)

WASM is fast enough that you can internally sell it as "speed improvement" to keep your developers happy and who else might question your intentions. asm.JS tends to be slower than direct JS.

Re: Firefox 85 cracks down on supercookies

#739

Post by nicklaf »

gorhill wrote: post #731
nicklaf wrote: post #544

Earlier quoted context omitted.

This is why I whitelist Javscript on a per-subdomain basis. I think NoScript does this but I use a simpler extension[0] and then rely on uBlock origin and multi account containers for privacy once I've whitelisted sites. [0] https://addons.mozilla.org/en-US/firefox/addon/disable-javas...

In case you are not aware, uBO also allows to wholly disable/enable JS on a per-site basis.[1] --- [1] https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-...

Ah, brilliant! Thanks for pointing that out to me (and for uBO).

Re: Firefox 85 cracks down on supercookies

#740

Post by namibj »

samus wrote: post #711
nunez wrote: post #649

Earlier quoted context omitted.

Yeah but you, the developer, need to provide the hash of the script being downloaded, work that’s easy to miss.

In case the hash is provided, caching across websites could be turned on again, to avoid the possibility of it being used as a supercookie. The website would have to know the hash of the supercookie before loading the resource. Except if a candidate set of possible users can reasonably be downloaded to the client, maybe sorted by time of last access and proximity to the geo location of the IP address of the last acce…

Yes. Pretty much.
Post reply on HN