4 ms·

Why doesn't Firefox ship with third-party cookies disabled? What would it break that isn't user-hostile? (edit Chrome, IE, Safari, I understand, but privacy i

by gavinpc 10y ago

Why doesn't Firefox ship with third-party cookies disabled? What would it break that isn't user-hostile? (edit Chrome, IE, Safari, I understand, but privacy is one of Firefox's main differentiators.)

jgaosgxy 10y ago
I always disable third-party cookies and very rarely does it break something. The most recent one I remember is logging in at the Origin website (online game store). The login form at checkout doesn't load at all without third-party cookies. While I would love to browse the web with all security and privacy features enabled and things like JavaScript disabled, it breaks too much. The middle ground between security/privacy and user experience/convenience is different for everyone.
- lordcorusa 10y ago
  I agree. I used to use NoScript, RequestPolicy, and BetterPrivacy, but I finally realized I was spending far more time tuning policies than I was actually using the web. And they were TOTALLY unusable by non technically inclined people. My compromise now is to use uBlock Origin (virtually never breaks anything), HTTPS Everywhere (on rare occasion breaks a site), Self-Destructing Cookies (by design cannot break sites), and 3rd-party cookies disabled. The only thing that banning 3rd-party cookies broke was CapitalOne360's gateway into regular CapitalOne, but they even managed to fix this in recent months.
  - hackuser 10y ago
    Try uMatrix, which combines many of those functions into one extension. It's by the same person as uBlock Origin.
shostack 10y ago
Don't they make the bulk of their revenue from search engine partnerships? Doubt that would go over well.
craigsmansion 10y ago
According to Gervase Markham of Mozilla: "If you believe you have a right to access all the free content on the Internet while blocking the ads which fund it, you continue to believe that [..]" Mozilla seems to not want to interfere with online advertising practices.
- gavinpc 10y ago
  This is not the same thing. I block all cookies and I still see plenty of ads. What's different is that the ad networks don't get to aggregate a profile on (effectively) all of my browsing. And yes, I believe I have a right to that.
- Silhouette 10y ago
  "If you believe you have a right to access all the free content on the Internet while blocking the ads which fund it, you continue to believe that [..]" Thanks, I will. I've been using the Internet since before online advertising became a big deal. I've run web sites of varying scales, often with original content, sometimes with original content that cost a lot of time and/or money to produce. I've also contributed widely to many more web sites and other online forums. I've paid for things online. I've charged for things online. And I've never once, in all that time, relied on ads to fund any of my or my various businesses' contributions. Online advertising has served a useful purpose in some cases, and I sympathise with those who have chosen to rely on it as a funding model and are now losing out because of ad blockers and the like. But online advertising has also led to huge amounts of ad-ridden junk clogging up any forum it can invade. It has led to serious degradation in both the performance and the security of the greatest information-sharing medium in the history of the world. Perhaps worst of all, it has led to a culture where other ways of compensating those whose work we truly value and of discovering new material of interest are a lot harder than they might have been. None of those are positive influences, and I'm not at all sure that online advertising hasn't done far more harm than good overall, even taking into account the great value that some ad-funded content and services have offered to some people.
  - CaptSpify 10y ago
    https://utcc.utoronto.ca/~cks/space/blog/web/AdSupportedWebDeathView https://utcc.utoronto.ca/~cks/space/blog/web/AdSupportedWebD... > essentially all of the ad supported sites I visit are diversions The web existed fine before ads, and could exist just fine (if not better) after ads.
wdr1 10y ago
> What would it break that isn't user-hostile? The Facebook "Like" button for starters. Is that user-hostile? Is that important? It's in the eye of the beholder, but if Firefox "doesn't work" for a large tranche of non-technical users, that's a big problem. It's also not clear how much it would achieve. It's not that difficult to turn a 3rd party cookie into a 1st party one.
Joof 10y ago
There was an attack in black hat recently called HEIST I believe that could target users via issuing a special cookie (say, through an advertisement). The only known way to combat it is to turn off third party cookies.

by gavinpc 10y ago

Why doesn't Firefox ship with third-party cookies disabled? What would it break that isn't user-hostile? (edit Chrome, IE, Safari, I understand, but privacy is one of Firefox's main differentiators.)

jgaosgxy 10y ago

I always disable third-party cookies and very rarely does it break something. The most recent one I remember is logging in at the Origin website (online game store). The login form at checkout doesn't load at all without third-party cookies. While I would love to browse the web with all security and privacy features enabled and things like JavaScript disabled, it breaks too much. The middle ground between security/privacy and user experience/convenience is different for everyone.

lordcorusa 10y ago
I agree. I used to use NoScript, RequestPolicy, and BetterPrivacy, but I finally realized I was spending far more time tuning policies than I was actually using the web. And they were TOTALLY unusable by non technically inclined people. My compromise now is to use uBlock Origin (virtually never breaks anything), HTTPS Everywhere (on rare occasion breaks a site), Self-Destructing Cookies (by design cannot break sites), and 3rd-party cookies disabled. The only thing that banning 3rd-party cookies broke was CapitalOne360's gateway into regular CapitalOne, but they even managed to fix this in recent months.
- hackuser 10y ago
  Try uMatrix, which combines many of those functions into one extension. It's by the same person as uBlock Origin.

shostack 10y ago

Don't they make the bulk of their revenue from search engine partnerships? Doubt that would go over well.

craigsmansion 10y ago

According to Gervase Markham of Mozilla: "If you believe you have a right to access all the free content on the Internet while blocking the ads which fund it, you continue to believe that [..]" Mozilla seems to not want to interfere with online advertising practices.

gavinpc 10y ago
This is not the same thing. I block all cookies and I still see plenty of ads. What's different is that the ad networks don't get to aggregate a profile on (effectively) all of my browsing. And yes, I believe I have a right to that.
Silhouette 10y ago
"If you believe you have a right to access all the free content on the Internet while blocking the ads which fund it, you continue to believe that [..]" Thanks, I will. I've been using the Internet since before online advertising became a big deal. I've run web sites of varying scales, often with original content, sometimes with original content that cost a lot of time and/or money to produce. I've also contributed widely to many more web sites and other online forums. I've paid for things online. I've charged for things online. And I've never once, in all that time, relied on ads to fund any of my or my various businesses' contributions. Online advertising has served a useful purpose in some cases, and I sympathise with those who have chosen to rely on it as a funding model and are now losing out because of ad blockers and the like. But online advertising has also led to huge amounts of ad-ridden junk clogging up any forum it can invade. It has led to serious degradation in both the performance and the security of the greatest information-sharing medium in the history of the world. Perhaps worst of all, it has led to a culture where other ways of compensating those whose work we truly value and of discovering new material of interest are a lot harder than they might have been. None of those are positive influences, and I'm not at all sure that online advertising hasn't done far more harm than good overall, even taking into account the great value that some ad-funded content and services have offered to some people.
- CaptSpify 10y ago
  https://utcc.utoronto.ca/~cks/space/blog/web/AdSupportedWebDeathView https://utcc.utoronto.ca/~cks/space/blog/web/AdSupportedWebD... > essentially all of the ad supported sites I visit are diversions The web existed fine before ads, and could exist just fine (if not better) after ads.

wdr1 10y ago

> What would it break that isn't user-hostile? The Facebook "Like" button for starters. Is that user-hostile? Is that important? It's in the eye of the beholder, but if Firefox "doesn't work" for a large tranche of non-technical users, that's a big problem. It's also not clear how much it would achieve. It's not that difficult to turn a 3rd party cookie into a 1st party one.

Joof 10y ago

There was an attack in black hat recently called HEIST I believe that could target users via issuing a special cookie (say, through an advertisement). The only known way to combat it is to turn off third party cookies.