Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox getting smarter about third-party cookies

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 103 posts

Re: Firefox getting smarter about third-party cookies

#81

Post by lowboy »

Nursie wrote: post #78
derefr wrote: post #71

Earlier quoted context omitted.

Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever . Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify…

"almost all cookies are friendly" I would really dispute this. Compare the number of sites visited to the number of ad-tracking cookies stored in the average browser, I think you'll find a very different answer.

How about "almost all first-party cookies are friendly"?

Re: Firefox getting smarter about third-party cookies

#82

Post by mike-cardwell »

derefr wrote: post #61
ferongr wrote: post #16

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509

It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Co…

You could still use the plain old browser web cache to track users. Send a unique image to each user with a long expiry time with an id embedded in it somewhere, then on the page, simply read the image using javascript/canvas to get the id.

Re: Firefox getting smarter about third-party cookies

#83

Post by cpeterso »

ove wrote: post #54
baby wrote: post #42

Earlier quoted context omitted.

Never heard of this one, and it looks really good. I'll try it right now. But will it still be useful with the new Firefox updates?

Hi, I'm the author of this add-on. You might want to read the FAQ entry "Q: How is this different from disabling 3rd party cookies and installing Adblock?". Firefox's new 3rd party cookie policy is actually weaker than disabling them outright, so this will not change anything.

Back in the day, Firefox experimented with making third-party cookies session-only, but I believe this option was disabled because some websites using third-party login cookies required users to login every session.

Have you run into any problem websites with self-destructing cookies?

Re: Firefox getting smarter about third-party cookies

#85

Post by jgalt212 »

cbr wrote: post #24
hiddenfeatures wrote: post #13

Does this affect Google Analytics (or any analytics software for that matter)? if so: How would a webmaster deal with that?

Google Analytics javascript runs on your domain and the cookies it uses are on your domain. So it should count as "first party" here.

True, but two other big players in this space (Mixpanel and Kissmetrics) both use 3rd party cookies. Does anyone know how they plan to deal with this?

Re: Firefox getting smarter about third-party cookies

#86

Post by jvm »

ferongr wrote: post #74
jlebar wrote: post #65

Earlier quoted context omitted.

Merely making an HTTP request to a site -- any HTTP request, as far as I'm aware -- is sufficient for that site to set a cookie on your machine. If on the other hand the site wants to store something in localstorage, the site has to run JS on your machine. That's a much higher bar.

It's a bit disingenuous to make such a claim. The bar is essentially the same since browsers execute all, 1st and 3rd-party JS by default. Loading a document is enough. For a web-browser it's quite rare to make requests without completing the transfer. The bar is essentially the same and the changes that privacy-invading 3rd party scripts have to do to bypass the Firefox's implementation are minimal, so Mozilla may a…

> The bar is essentially the same since browsers execute all, 1st and 3rd-party JS by default.

Not mine :-)

(But point taken)

Re: Firefox getting smarter about third-party cookies

#87

Post by suhail »

jgalt212 wrote: post #85
cbr wrote: post #24

Earlier quoted context omitted.

Google Analytics javascript runs on your domain and the cookies it uses are on your domain. So it should count as "first party" here.

True, but two other big players in this space (Mixpanel and Kissmetrics) both use 3rd party cookies. Does anyone know how they plan to deal with this?

We use first party cookies and do not try to track people across websites which is what most ad networks actually do.

Re: Firefox getting smarter about third-party cookies

#88

Post by fpgeek »

cromwellian wrote: post #69

There are lots of cases where third party cookies are used as auth tokens, not tracking tokens. Seems to me that the browser vendors should get together and come up with a better solution for browsers to store and manage auth tokens. Right now it is done piecemeal by websites, but is confusing to end users. Having a direct, first-class API and UI in the browser that can show the user exactly what third party sites th…

Isn't improved browser-level authentication handling (including not letting information leak via authentication) one of the things BrowserID is about?

Re: Firefox getting smarter about third-party cookies

#89

Post by suhail »

Curious for people that actively write way more JavaScript and deal with cookies more than I do:

Outside of Local Storage, is there still a loop-hole (though it defies user expectation) for ad retargeters (they must rely on third party cookies)? I feel, if not, that this will totally kill those businesses. I am neutral and just wondering if I am missing something.

Google was sued for using iframes to get around this so defying user expectation no matter the loop hole is quite dangerous.

Re: Firefox getting smarter about third-party cookies

#90

Post by tquai »

abcd_f wrote: post #2

Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.

Any ETA for allowing to block Referer header from being included in cross-origin requests?

This feature has been supported in Firefox for a long time, but you have to set it in about:config via the "network.http.sendRefererHeader" integer.

  2 = always send
  1 = send only to same FQDN (what you seem to want)
  0 = never send
IMO this is one of the best bang-for-your-buck privacy configurations. I would love it if Mozilla changed the default from 2 to 1, and at the least, it SHOULD be an option under the Preferences -> Privacy tab.
Post reply on HN