Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

751–760 of 786 posts

Re: Firefox 85 cracks down on supercookies

#751

Post by scott_w »

wirthjason wrote: post #746
scrollaway wrote: post #680

Earlier quoted context omitted.

I've worked with python 17 years. I've taught python, javascript and typescript. There is a universe between how accessible JS is vs Python. And TCPIP may have helped but just because it's essential part of the stack doesn't mean the remote learning could have happened without JS existing (in the time it did). The web would be a glorified FTP server if some people here had their way.

As a Python programmer myself I’m curious, what’s the difference?

Your language interpreter comes built-in with your computer

Re: Firefox 85 cracks down on supercookies

#752

Post by specialist »

scrollaway wrote: post #586
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

There were a variety of scripting languages.

You don't acknowledge the need to sandbox code, regardless of language.

Re: Firefox 85 cracks down on supercookies

#753

Post by ForHackernews »

tremon wrote: post #736
ForHackernews wrote: post #703

Earlier quoted context omitted.

So, just to reiterate, contrary to the comment I replied to, you are suggesting we "place data in the browser for tracking" a user's authentication state and session.

Please stop your gaslighting. You were the only one equating "place data in the browser for tracking" with all use of cookies, nobody else made that "mistake".

How else would you describe a login token? It's literally data in the browser for tracking who that user is and identifying them to the server!

All I'm doing is highlighting is that it's not as simple as some of these jUsT bAN cOoKIes folks would have you believe.

Blocking technologies that are used for invidious ad-tech will make it more difficult to support legitimate use-cases. Sleazy ad-merchants like Google will move on to something else built into the browser https://blog.google/products/ads-commerce/2021-01-privacy-sa... and normal site developers will be left in the lurch.

IMHO there isn't a technological solution to this problem, the only effective answer is regulation & hefty fines that make unethical tracking also unprofitable.

Re: Firefox 85 cracks down on supercookies

#754

Post by ForHackernews »

viraptor wrote: post #559
ForHackernews wrote: post #553

Earlier quoted context omitted.

How do you suggest implementing "sign in" without setting a cookie?

Sign-in cookies are always first party. That's completely out of context here where we're taking about tracking cookies.

There's absolutely nothing except convenience preventing ad-tech companies from routing their 3rd party cookies through a proxy hosted on the first-party domain. If 3rd party cookies stop working, they'll just start having their customers set up CNAMEs on their own domains.

Re: Firefox 85 cracks down on supercookies

#755

Post by sib »

shakna wrote: post #643
sib wrote: post #496

Earlier quoted context omitted.

For a while, people were getting in trouble for using the word, "niggardly," even though it had nothing to do with the offensive term that it sounds like. https://en.wikipedia.org/wiki/Controversies_about_the_word_n...

The difference being that the controversy around white/blacklist only appeared after someone said it was a controversy in 2018, which is extremely recent, and the wording doesn't contain any phonetic similarity to a term from slavery. Being able to be misheard is more of a problem when phonetics clash. Should all terms for the colour-that-is-somewhat-the-absence-of-colour now be banned? Is Vanta Black now racist? Man…

Oh, I agree. I think whitelist / blacklist is a manufactured controversy.

But my point is that, if people took the time to learn the background, perhaps (in both of these examples, and others), we could avoid the kerfuffles.

Re: Firefox 85 cracks down on supercookies

#756

Post by etripe »

egeozcan wrote: post #708
emptyparadise wrote: post #696

Earlier quoted context omitted.

>Javascript is one of the, if not the, most influential technologies of the past 100 years. That's... one hell of a claim.

JS is indeed what brought us all the speed in software development. People could prototype their ideas crazy fast, and they still can. Scripting in browser had an immense positive impact on software industry, and that DID come with many negatives, but you always have the option to completely turn it off if those bother you. A sandboxed environment was a huge idea and the browser has been the primary example of how gr…

Prototyping fast does not guarantee shipping robust software fast, which is in part why the JS ecosystem has been having problems.

To apply the common construction analogy to JavaScript: no one would call a quick sketch on a napkin a valid blueprint for a building.

Re: Firefox 85 cracks down on supercookies

#757

Post by legends2k »

skeletonjelly wrote: post #536
SamuelAdams wrote: post #369

Earlier quoted context omitted.

Or enable private browsing all the time. You'll have to log into your accounts every time you open your browser, but that's not really a big deal with a decent password manager. [1]: https://support.mozilla.org/en-US/kb/how-clear-firefox-cache...

Can you be tracked within the private browsing mode though? For instance in Chrome private tabs I know if you log in to something then open a new tab, that tab retains the cookies from the private session until you close all private tabs. Is this the same with Firefox? I'm hesitant to install yet another extension but I'm wondering if this one mentioned elsewhere in this thread will fix it, if it is the case with fir…

No, in Firefox I've seen each private window is a separate unrelated container.

Re: Firefox 85 cracks down on supercookies

#758

Post by legends2k »

zwkrt wrote: post #697
newscracker wrote: post #91

Use uBlock Origin, Multi Account Containers, Privacy Badger, Decentraleyes and CookieAutoDelete with Firefox. Make sure you aggressively clear cache, cookies, etc., periodically (with CookieAutoDelete). You’ll probably load the web servers more and also add more traffic on your network, but it will help protect your privacy since most websites don’t care about that. When websites are user hostile, you have to take pr…

If you’re doing all that it seems like a lot of cognitive dissonance to keep using the internet. It is optional, you know!

Internet in a modern world isn't option, really, you know!

Re: Firefox 85 cracks down on supercookies

#759

Post by dahfizz »

scott_w wrote: post #751
wirthjason wrote: post #746

Earlier quoted context omitted.

As a Python programmer myself I’m curious, what’s the difference?

Your language interpreter comes built-in with your computer

So "Download pycharm" is enough of a barrier that it creates a "universe of difference"? I find that hard to believe.

Re: Firefox 85 cracks down on supercookies

#760

Post by GoblinSlayer »

Jonnax wrote: post #18

"In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image." Clever. And so frustrating that optimisations need to be turned off due to bad actors.

Only on the first visit. The first visit is impossible to optimize anyway due to bloated javascript, so webdev focuses on optimizing only repeated visits. What images do you want to cache between sites? Advertisements?
Post reply on HN