Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox rolls out Total Cookie Protection by default to all users

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 339 posts

Re: Firefox rolls out Total Cookie Protection by default to all users

#81

Post by _jal »

Xylakant wrote: post #23
agluszak wrote: post #20

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

Cookies were invented at Netscape like 25 years ago, nobody considered the current situation.

Yes they did. It was foreseen, look at the sibling comment where the issue was discussed in the spec. They just punted, just like they did with https and CAs. (And Javascript, for that matter, although that's less directly security-related.)

The concern was being first to market, not with solid engineering.

Re: Firefox rolls out Total Cookie Protection by default to all users

#83

Post by robin_reala »

throwaway0x7E6 wrote: post #50
svieira wrote: post #30

Earlier quoted context omitted.

SSO, probably not - embedding, possibly. If you're just worried about logging in through sso.coolcorp.com to third-party.corp using any of the normal methods (OAuth, SAML, Kerberos, etc.) then you're probably fine. If you're worried about composing a page made up of lots of custom embedded components and those components _don't_ use SSO (or if they do, but they authenticate invisibly using an iframe instead of authen…

with mozilla's 2% browser market share, as a developer you don't need to worry at all

Given the number of Firefox users that block Google Analytics, I wouldn’t be convinced about a 2% figure.

Re: Firefox rolls out Total Cookie Protection by default to all users

#84

Post by Ayesh »

logifail wrote: post #68
bpodgursky wrote: post #60

Earlier quoted context omitted.

Yeah, which is why sites are all requiring logins nowdays, so they can use server-side ID syncs.

> so they can use server-side ID syncs Does this only work if you use the same email across multiple sites? If so it's yet another reason to use a different email address with every site you sign up at.

> Does this only work if you use the same email across multiple sites? At a huge risk of EU regulars cracking on, it is quite possible to track a user across multiple accounts by simply using a cookie that lives long enough (say, 30 days) to establish the connections between multiple accounts.

For a server-side ID sync, you don't even need user accounts. Just a unique ID set in a cookie will do.

Re: Firefox rolls out Total Cookie Protection by default to all users

#85

Post by ghusto »

ComodoHacker wrote: post #67
ghusto wrote: post #52

I've never understood the thinking that went behind allowing one site to see the existence of another site's cookie in the first place. I don't think I'm even coming at this with the security hindsight of decades, it's just common sense, isn't it?

A site isn't allowed to see another site's cookies, common sense doesn't fail you.

No, but I said see the _existence_ of. Or am I wrong there? Ha, I should really know this :P

Re: Firefox rolls out Total Cookie Protection by default to all users

#86

Post by calvinmorrison »

svieira wrote: post #30
xnorswap wrote: post #7

Does this affect single-sign-on implementations?

SSO, probably not - embedding, possibly. If you're just worried about logging in through sso.coolcorp.com to third-party.corp using any of the normal methods (OAuth, SAML, Kerberos, etc.) then you're probably fine. If you're worried about composing a page made up of lots of custom embedded components and those components _don't_ use SSO (or if they do, but they authenticate invisibly using an iframe instead of authen…

> You may have some things to switch up.

Or rather a large logo that says "Please use a supported browser."

Re: Firefox rolls out Total Cookie Protection by default to all users

#87

Post by seanhunter »

sampa wrote: post #59

It's nice, but is that so hard for Mozilla to tell in which version it will appear? Is it the current version or is it the next 102 version (which releases in 2 weeks, but then why they say it "rolls out"?)

If you want to enable it early, I believe you can go to about:config and set network.cookie.cookieBehavior to 5

Likewise you can keep enhanced tracking protection in general but disable partitioning (total cookie protection) by setting it to 4

https://support.mozilla.org/en-US/kb/total-cookie-protection...

Re: Firefox rolls out Total Cookie Protection by default to all users

#88

Post by dangrossman »

mastermedo wrote: post #73

I remember losing a bet a while back, because I was naive enough to think that was how cookies worked in the first place. Why did other sites ever have access to cookies they didn’t create was beyond me.

You don't need access to cookies you didn't create to do cross-site tracking.

Think: Disqus or Facebook comments at the end of articles, which used to be pretty ubiquitous. You'd be logged in and able to comment on any website using a cookie set by Disqus or Facebook, so you wouldn't have to log in or register on each individual website.

This Total Cookie Protection will break that. Your Disqus-set login cookie set on site A won't be visible when you're on site B, so you won't be logged in to Disqus there.

Re: Firefox rolls out Total Cookie Protection by default to all users

#89

Post by robin_reala »

corentin88 wrote: post #2

Reminds me of what Google Chrome (and others browsers) did for cache. That's clever, not 100% sure this will prevent tracking, but at least it makes tracker's life a bit harder.

Probably best to say “Safari (and other browsers)” given that they were seven years ahead of the competition on this one.

Re: Firefox rolls out Total Cookie Protection by default to all users

#90

Post by ajvs »

hericium wrote: post #66

About 90% of Mozilla's income comes from Google. If this would prevent tracking, Google would not allow Mozilla to release it.

Google would still have to fund Mozilla to prevent more anticompetition charges being levied their way regardless. uBlock Origin is a far greater threat since it blocks the more powerful JavaScript-based tracking, and you can see exactly how that's being managed with the move to Manifest v3.
Post reply on HN