7 ms·

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party s

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site, so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work without cookie "crosstalk". You can test first-party isolation now by flipping the about:config pref "privacy.firstparty.isolate" to true. Beware that there are still bugs that break some sites, which is why the feature is not enabled by default yet. If you find bugs, please report them in Bugzilla! Here is the Firefox bug tracking the integration and known bugs: https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 https://bugzilla.mozilla.org/show_bug.cgi?id=1299996

gcb0 10y ago
best thing that happened to mozilla was losing the money from google. yahoo pays them almost the same and does not meddle on anti tracking features. note how every single privacy feature came after google-money. during google-money what did we got? third party cookies accepted as default. good riddance, google.
- shostack 10y ago
  I'd love to know how those corporate conversations go exactly. Is it so blatant as saying "no you won't work on these anti tracking features?" Or is it more "this will be so you focus on" which conveniently excludes undesirable stuff?
  - tomaskafka 10y ago
    This. And, what is really Google paying them for? Ensuring that there is no mainstream browser left that would complicate things for ad/tracking sponsored web (and so never creating an incentive + ecosystem for any alternative)?
- hackuser 10y ago
  Could you provide some examples? That's a serious allegation. I remember, as a volunteer, debating some privacy issue with a Google dev in Bugzilla. They made some crack about looking a gift horse in the mouth, but the discussion was out in the open. I don't recall evidence that Google was influencing Firefox improperly, but OTOH absence of evidence is not evidence of absence ...
  - gcb0 10y ago
    I doubt people on the trenches were blatantly in on it. But I gave my views on the outcome. Investigate that and see the pattern.
    - slau 10y ago
      Well, that's a cute line of defense, but pretty obvious if hand-waving if you ask me. "You're too low on the ladder to know what I'm talking about." You're the one who accuses Mozilla and Google, of different things, sure, but fairly important things anyway. The burden of proof lies with you. Not us. It is not up to us to "find the pattern." Not that I disagree with you on the fact that Mozilla seems much better off, post-Google.
- Vinnl 10y ago
  I think the more likely explanation is that Google withdrew* once it became clear that Chrome was far more popular. This same event led Mozilla to do some soul-searching (aka user surveys, etc.) as to why they were losing users, and what their USP was compared to Google - privacy is one of them. * Note that "withdrew" might also mean "offered less money than before because Firefox had less users than before, and Yahoo! offering more.
the8472 10y ago
He said unless I say otherwise. First-party isolation lacks customization hooks.
rlpb 10y ago
Ah, neat. That sounds like exactly what I want (except to be able to set a whitelist). Thanks! For anyone else interested: now that I know what to search for, I also found some status at https://wiki.mozilla.org/Security/FirstPartyIsolation https://wiki.mozilla.org/Security/FirstPartyIsolation
rhizome 10y ago
so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org I'm not sure this description is as clear as you intended.
- cpeterso 10y ago
  oops! You are right. I meant: ... so evilcorp.org cookies for evilcorp.org images on A.org will not be set for evilcorp.org images on B.org.
  - jhasse 10y ago
    Can you edit your post?
    - eriknstr 10y ago
      Probably not. HN only allows editing comments for a limited amount of time. In one post I found from a couple of years back, someone said that the edit window is two hours. I think perhaps also that as soon as someone has replied to a comment it will not be possible to edit that comment any longer but I'm not sure about that.
andrewflnr 10y ago
I knew I stayed with Firefox for a reason. Privacy isn't even the real issue for me: this should take a big bite out of CSRF attacks.
hackuser 10y ago
I'm glad Firefox is doing this, but ... > Blocking third-party cookies can break some site that rely on third-party resources Can anyone name sites that require them? As someone who defaults to deny all cookies and manually enables every one my browser accepts, I don't think I've found a site that requires 3rd-party cookies. Few sites require cookies unless you login or have shopping cart. Of course, that's anecdotal. Maybe I just don't visit certain categories of sites and don't encounter them.
- baraah 10y ago
  I think I remember allowing them to watch Thursday Night Football on Twitter. I can't find anything about third-party cookies and tnf.twitter.com on Google though.
- driverdan 10y ago
  I've been blocking 3rd party cookies for years. I think I've seen less than five sites break.
- biggerfisch 10y ago
  My university uses Piazza often as a forum, linked in through our course management site, Canvas. If you don't have 3rd party cookies, it used to just not work, but not it redirects you into opening a new tab/window for Piazza. It's still annoying and would be nice to have it right there in Canvas
- ukyrgf 10y ago
  hbogo.com relies on third party cookies from my cable company.
- g4k 10y ago
  The Shopify plugins from Bold use them.
- sleavey 10y ago
  StackOverflow, sadly. Their Javascript requires some off site cookies to allow for their cross domain user account stuff. Not enabling third party cookies on the StackExchange sites leads to broken pages.

gcb0 10y ago

best thing that happened to mozilla was losing the money from google. yahoo pays them almost the same and does not meddle on anti tracking features. note how every single privacy feature came after google-money. during google-money what did we got? third party cookies accepted as default. good riddance, google.

shostack 10y ago
I'd love to know how those corporate conversations go exactly. Is it so blatant as saying "no you won't work on these anti tracking features?" Or is it more "this will be so you focus on" which conveniently excludes undesirable stuff?
- tomaskafka 10y ago
  This. And, what is really Google paying them for? Ensuring that there is no mainstream browser left that would complicate things for ad/tracking sponsored web (and so never creating an incentive + ecosystem for any alternative)?
hackuser 10y ago
Could you provide some examples? That's a serious allegation. I remember, as a volunteer, debating some privacy issue with a Google dev in Bugzilla. They made some crack about looking a gift horse in the mouth, but the discussion was out in the open. I don't recall evidence that Google was influencing Firefox improperly, but OTOH absence of evidence is not evidence of absence ...
- gcb0 10y ago
  I doubt people on the trenches were blatantly in on it. But I gave my views on the outcome. Investigate that and see the pattern.
  - slau 10y ago
    Well, that's a cute line of defense, but pretty obvious if hand-waving if you ask me. "You're too low on the ladder to know what I'm talking about." You're the one who accuses Mozilla and Google, of different things, sure, but fairly important things anyway. The burden of proof lies with you. Not us. It is not up to us to "find the pattern." Not that I disagree with you on the fact that Mozilla seems much better off, post-Google.
Vinnl 10y ago
I think the more likely explanation is that Google withdrew* once it became clear that Chrome was far more popular. This same event led Mozilla to do some soul-searching (aka user surveys, etc.) as to why they were losing users, and what their USP was compared to Google - privacy is one of them. * Note that "withdrew" might also mean "offered less money than before because Firefox had less users than before, and Yahoo! offering more.

the8472 10y ago

He said unless I say otherwise. First-party isolation lacks customization hooks.

rlpb 10y ago

Ah, neat. That sounds like exactly what I want (except to be able to set a whitelist). Thanks! For anyone else interested: now that I know what to search for, I also found some status at https://wiki.mozilla.org/Security/FirstPartyIsolation https://wiki.mozilla.org/Security/FirstPartyIsolation

rhizome 10y ago

so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org I'm not sure this description is as clear as you intended.

cpeterso 10y ago
oops! You are right. I meant: ... so evilcorp.org cookies for evilcorp.org images on A.org will not be set for evilcorp.org images on B.org.
- jhasse 10y ago
  Can you edit your post?
  - eriknstr 10y ago
    Probably not. HN only allows editing comments for a limited amount of time. In one post I found from a couple of years back, someone said that the edit window is two hours. I think perhaps also that as soon as someone has replied to a comment it will not be possible to edit that comment any longer but I'm not sure about that.

andrewflnr 10y ago

I knew I stayed with Firefox for a reason. Privacy isn't even the real issue for me: this should take a big bite out of CSRF attacks.

hackuser 10y ago

I'm glad Firefox is doing this, but ... > Blocking third-party cookies can break some site that rely on third-party resources Can anyone name sites that require them? As someone who defaults to deny all cookies and manually enables every one my browser accepts, I don't think I've found a site that requires 3rd-party cookies. Few sites require cookies unless you login or have shopping cart. Of course, that's anecdotal. Maybe I just don't visit certain categories of sites and don't encounter them.

baraah 10y ago
I think I remember allowing them to watch Thursday Night Football on Twitter. I can't find anything about third-party cookies and tnf.twitter.com on Google though.
driverdan 10y ago
I've been blocking 3rd party cookies for years. I think I've seen less than five sites break.
biggerfisch 10y ago
My university uses Piazza often as a forum, linked in through our course management site, Canvas. If you don't have 3rd party cookies, it used to just not work, but not it redirects you into opening a new tab/window for Piazza. It's still annoying and would be nice to have it right there in Canvas
ukyrgf 10y ago
hbogo.com relies on third party cookies from my cable company.
g4k 10y ago
The Shopify plugins from Bold use them.
sleavey 10y ago
StackOverflow, sadly. Their Javascript requires some off site cookies to allow for their cross domain user account stuff. Not enabling third party cookies on the StackExchange sites leads to broken pages.