Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

741–750 of 786 posts

Re: Firefox 85 cracks down on supercookies

#741

Post by bromuro »

bluGill wrote: post #594
austincheney wrote: post #572

Earlier quoted context omitted.

> Note that the root of all evil here is Javascript Not exactly. The root of all evil here is HTTP. You don’t need any JavaScript to plant cookies or other tracking assets. As a proof this technique is used to track users in email, such as embedding a 1 pixel image in an email retrieved via HTTP.

Which is why I turn off HTML email by default, and even when I turn it on for one message images are not loaded except by a second step. I rarely get to the first step and even less often the second.

HTML should be an opt-in too! :)

Re: Firefox 85 cracks down on supercookies

#742

Post by StochasticSand »

commotionfever wrote: post #535
buzzy_hacker wrote: post #188

Earlier quoted context omitted.

Agree, but substituting multi-account containers with temporary containers https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

temporary containers is really nice. but how can you replace MAC with it? I tried before couldn't assign some domains to "permanent" containers. eg. I'd like use temp containers all the time, except for some sites like YouTube where I'd like it to always open in a YouTube container

I've combined it with Firefox's Multi-Account Containers. It works exactly as you've described, when used in tandem with temporary containers.

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Re: Firefox 85 cracks down on supercookies

#743

Post by sbarre »

TedDoesntTalk wrote: post #635
sbarre wrote: post #424

Earlier quoted context omitted.

And how do you know about the existence of a product to go shop for in the first place, if not through advertising and promotion? Or do you have infinite time to go browse every single store in your city on the odd chance that you'll see something you want?

There are these wonderful things now called search engines. And they existed before online advertising was tied to search, so before you say search engines would not exist without advertising attached to search queries, think again.

How do you know to search for something if you haven't heard about it before... via some kind of... promotion?

I get the point you're making, but I hope you realize you're just backpedaling from your original "no advertisements ever!" statement.

I believe in giving people better control over how they receive ads (I personally run an ad blocker in my browsers and a Pi Hole on my network), but you position that there should be no advertising at all, and that all ads are unethical is just silly, and you're proving that point yourself here..

Re: Firefox 85 cracks down on supercookies

#744

Post by pflanze »

yc12340 wrote: post #685
goflyapig wrote: post #574

Earlier quoted context omitted.

It sounds like they're talking about ETags [1] here. I don't think JavaScript has anything to do with it. [1] https://en.wikipedia.org/wiki/HTTP_ETag#Typical_usage

ETags and Last-Modified headers can be used for long-term user tagging, but without Javascript they provide a lot less value in terms of tracking. Suppose, that you are visiting a web site with Evil Embedding (an iframe tag or script, that loads Evil Resource on behalf of advertiser). If your browser requests Evil Resource without telling advertiser the name of top-level site, the advertiser gets little. They get to…

> If your browser requests Evil Resource without telling advertiser the name of top-level site, the advertiser gets little.

But the advertiser will get the referrer so will know the domain name?

(And if they didn't, they could require the site operator to include the site name in the resource URL.)

Re: Firefox 85 cracks down on supercookies

#745

Post by sbarre »

AndrewUnmuted wrote: post #619
sbarre wrote: post #375

Earlier quoted context omitted.

I am really confused by this position. How do you propose that companies should promote their products and services, if not through advertising? Are you somehow suggesting that they should just sit there and hope that people who have never heard of their product independently decide they happen to want or need that product and seek it out, unprompted? You say "people part with their money for things they wouldn't thi…

Look at how much of a web you have to spin for yourself, just to conclude that it is indeed fine to have others tell you what you need to buy. The false dichotomy you pose is ridiculous. People seek out information on what to buy all the time. But when I am listening to music, watching television or film, or reading a fucking news article, that is not the time I want to be given that information. It is unsolicited an…

Hey, I'm not sure why you're answering me from 2 separate accounts (I know it's you because you accidentally(?) replied to another post from your other account with this one, speaking in the first person about the other message).

People seek out information on what to buy because at some point they found out about it via (perhaps indirectly) the provider's promotional efforts (i.e. advertising).

We can certainly talk about the appropriateness of when an where to advertise, but that's a very different topic than your ALL ADS ARE UNETHICAL screeds that you've posted in like a dozen threads on this topic from 2 different accounts..

Never mind continuing to believe that somehow those of us who engage with advertising are lying to ourselves or somehow less in control of things than you?

Now who's spinning a web..

Re: Firefox 85 cracks down on supercookies

#746

Post by wirthjason »

scrollaway wrote: post #680
Const-me wrote: post #661

Earlier quoted context omitted.

> It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. I think Basic, Pascal or Python achieved more at that. > it's the only reason many kids can do remote learning as efficiently as they can. The main reason is internets and TCP/IP, that’s essential and irreplaceable. Another important reason is h.264, equivalents do exist, but given the state of…

I've worked with python 17 years. I've taught python, javascript and typescript. There is a universe between how accessible JS is vs Python. And TCPIP may have helped but just because it's essential part of the stack doesn't mean the remote learning could have happened without JS existing (in the time it did). The web would be a glorified FTP server if some people here had their way.

As a Python programmer myself I’m curious, what’s the difference?

Re: Firefox 85 cracks down on supercookies

#747

Post by loughnane »

corobo wrote: post #115
pradn wrote: post #101

Earlier quoted context omitted.

Question about pihole: is it possible to turn off blocking for a website? Do you have to log into the pihole web interface to do that? I often go to websites where some crucial functionality is blocked by my adblocker (ublock origin), where I have to turn it off for that site.

You can whitelist yes, or there's an option to disable the entire thing temporarily for x minutes. Yes you have to log in to the interface unless you engineer a way around it

On iOS there is an app called piHoleRemote that had a nice widget that allows you to disable pihole for x minutes.

Can be nice to use to quickly disable pihole to get through to a particular website.

Re: Firefox 85 cracks down on supercookies

#748

Post by bartread »

ben509 wrote: post #564
Gare wrote: post #174

Earlier quoted context omitted.

They load the image URL and observe the loading time. If it's fetched quickly, they know it was from cache. The server (controlled by the advertisers) can intentionally add delay to those image requests that makes detection reliable.

I don't see how that helps you persist a tracking ID. If you generate a random URL, you'll always get a cache miss. If you use a static URL, you'll know if you have a new session or not, but that doesn't tell you what the tracking ID was. The only thing I can imagine is the server serve several images /byte1.png /byte2.png etc. and make them all X by 1 pixels, encoding a random value in the dimensions, assuming that'…

You don't need to worry about whether the image is in the cache or not.

If you have to hit the server on that static URL, you write a request handler that will always give you back a new image with a new ID encoded in the pixels. Think of it like dynamic page generation on the server side, but for an image instead. Every time you hit the same URL you get a different image.

On the client you can decode that ID and use it throughout your code, in network requests, etc., to track user activity.

If the image is already cached you just decode the ID and use it as described above. All the browser cares about is associating a URL with a resource: it doesn't know or care that the resource in question changes every time it's asked for.

Also, the client code literally doesn't need to care whether the ID is from an image in cache or an image returned from the server.

The server can simply tie all activity for a given ID together on the back end.

This is one way of doing it: there are probably others. I'm certainly no expert.

Re: Firefox 85 cracks down on supercookies

#749

Post by sthnblllII »

Accacin wrote: post #723
nofunsir wrote: post #611

Earlier quoted context omitted.

I agree with simias. What does JS have to do with my VPN? What was wrong with Skype? Still beats the pants off others for quality. I cannot think of much good agressive whitespace, hamburger menus, infinite scrolling, HID hijacking, copy-paste preventing, trackers etc, etc etc, has brought us, besides into the world of Aggressive Ad Arbitrage. Need https://motherfuckingwebsite.com/ be mentioned? The real powerhouse w…

You're blaming the language for how people use it. It's like saying C is bad because people use it to write root kits.

C is for writing trusted native code. JS is for writing untrusted code in a sandbox that is way too leaky.

Re: Firefox 85 cracks down on supercookies

#750

Post by scott_w »

simias wrote: post #422
Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Firefox explicitly talks about abusing IMAGE caches and you’re waffling about JS. The two things are not related here so stop trying to conflate them.
Post reply on HN