Does anyone know if this covers network-layer state like keep-alive or TLS session reuse?
Firefox rolls out Total Cookie Protection by default to all users
91–100 of 339 posts
Re: Firefox rolls out Total Cookie Protection by default to all users
#92I've never understood the thinking that went behind allowing one site to see the existence of another site's cookie in the first place. I don't think I'm even coming at this with the security hindsight of decades, it's just common sense, isn't it?
It's not that one site is seeing another site.
It's that multiple sites will serve content (ads, Javascript libraries, like buttons) from a common site (eg an ad network) that uses its own domain. That domain is allowed to get the cookie for itself because it is referenced by multiple site, that's how this type of tracking works.
If you go to bbc.com, it still won't be able to see cookies from cnn.com, but say if advert.com is included by both sites, then it will see that you visited them both. That's the power and great danger that things like facebook and google sense represent.
The owner of the sites get some stats for free by using these services, but the biggest benefit is for google and facebook to be able to track what users are looking at accross the web. And you just need to be identifiable on one site that you visit (say, FB or gmail) for them to know exactly who you are.
From what I understand, Firefox will only allow advert.com to get the cookie it created when being loaded as part of bbc.com, but it won't be able to read its own cookie from cnn.com, it will have to create a new, separate one, thus breaking the link tracking you between sites, or at least making it harder to connect the dots.
Everyone should use FF.
Re: Firefox rolls out Total Cookie Protection by default to all users
#93Earlier quoted context omitted.
they can still track you based on your account (e.g. Gmail, Hotmail, iCloud) Really? I don't think so. How would that work? If you visit www.somesite.com - how would javascript on that site identify you via Gmail?
Because Google's, Apple's and Microsoft's accounts specifically are tied to their particular browser and/or OS, not just the websites you're on. So are Firefox accounts but they probably don't have the numbers to engage in any particularly egregious behavior.
What kind of mechanic are you describing? Are you saying the browser is phoning home, telling Google which sites you visit?
Re: Firefox rolls out Total Cookie Protection by default to all users
#94given that Electron is really just a featureless browser shouldn't it be straightforward to make your own browser now? An address bar, navigation, and bookmarks ought to be enough to get you there. Seems like you should be able to make a browser for your specific needs/wants pretty easily these days. I'm not suggesting some sort of money making venture where you're beholden to investors to try and turn revenue with it but more just like a utility. Like a script or something... maybe that's the way to think about it, something cobbled together quickly to read websites.
Re: Firefox rolls out Total Cookie Protection by default to all users
#95I've never understood the thinking that went behind allowing one site to see the existence of another site's cookie in the first place. I don't think I'm even coming at this with the security hindsight of decades, it's just common sense, isn't it?
It's a legit usecase for Single-Sign On providers. However this functionality has been mainly abused by ad trackers, and has thus been curtailed.
Re: Firefox rolls out Total Cookie Protection by default to all users
#96Earlier quoted context omitted.
with mozilla's 2% browser market share, as a developer you don't need to worry at all
Given the number of Firefox users that block Google Analytics, I wouldn’t be convinced about a 2% figure.
It also depends who the users are... given that Firefox tends to be used by many technically-inclined users, sysadmins, etc. (at least according to what I observe around me), it might be users you might want to consider, depending on what you're offering...
Re: Firefox rolls out Total Cookie Protection by default to all users
#97I wonder if there's anyone from any advertising/ad-targeting companies on HN who can shed some light on if/how much this change may affect their "product". Asking this since I know friends working at companies that were DRASTICALLY affected by the Apple advertising changes in terms of user targetability (and hence revenue) and I'm wondering if this change will be similar.
Firefox has a sub 8% market share, so I doubt this will make a drastic change to how they operate.
Re: Firefox rolls out Total Cookie Protection by default to all users
#98Before anyone jumps to why Chrome doesn't block third-party cookies, some context: Regulators did warn Google NOT TO block third-party cookies before they provide a replacement, UK CMA accepted the latest proposal from Google: https://www.gov.uk/government/news/cma-to-keep-close-eye-on-... Apple's tracking rules also raised a lot of anti-trust concerns, giving advertisement in App Store unfair advantages among other…
Yet another reason that we need to ensure that third party browsers are being used and in active development.
Re: Firefox rolls out Total Cookie Protection by default to all users
#99Earlier quoted context omitted.
Because Google's, Apple's and Microsoft's accounts specifically are tied to their particular browser and/or OS, not just the websites you're on. So are Firefox accounts but they probably don't have the numbers to engage in any particularly egregious behavior.
What kind of mechanic are you describing? Are you saying the browser is phoning home, telling Google which sites you visit?
Yes. You can turn it off, though, if you take Google at its word.
https://support.google.com/websearch/answer/54068?hl=en&co=G...
Re: Firefox rolls out Total Cookie Protection by default to all users
#100This will only further entrench the big players (google, facebook, etc) while making it impossible for new & small players to compete. All of the services the big players offer effectively make working without universal cookies trivial.
For the small players though, without massive ad-supported service offerings like Gmail, Facebook (as a platform), etc, this will screw them completely.
Mind you, I'm a HUGE privacy advocate, so I like the new Firefox functionality... but the unintended side effects cannot be ignored.