8 ms·

Third party cookies, and any way to fingerprint a specific user starting from high entropy user agents to screen resolution, font fingerprinting or canvas data,

Third party cookies, and any way to fingerprint a specific user starting from high entropy user agents to screen resolution, font fingerprinting or canvas data, should be considered a breach of the browser security model. All sites should run in containers and no advertiser should be able to track you across sessions. When I want 3rd party interaction, I should need to opt in and connect the current site with Facebook or some other 3rd party.

indiv0 9y ago
Exactly. Why aren't all websites run in containers by default (personally I'm envisioning per-domain containers)? What benefit do we get from full-coverage containerization not being the default?
- r3bl 9y ago
  In short: site breakage. We're so deep in this that a first party isolation would break almost every single website. In a cooperation with Tor, Mozilla actually ported the first-party isolation feature in mainstream Firefox (available in Nightly, don't know about stable), but since it would break almost every single website, there are no plans to turn it on by default. You can, of course, enable it yourself by turning on "privacy.firstparty.isolate" in about:config. Disclaimer: I'm a Mozilla Foundation affiliate that has nothing to do with Mozilla Corporation nor Firefox.
  - cornholio 9y ago
    It would break some sites (certainly not every site, I'm browsing this site right now with it enabled) because 3rd party cookies are an entrenched, standardized feature of the web, you can't simply turn them off tomorrow. Developers are using them to create benign functionality, for example spread an application across multiple domains owned by the same publisher. What I proposed above is that we introduce an opt-in feature: before the browser is allowed to connect to 3rd parties (in the tracking and cookie sense), the user needs to opt-in, for example by clicking in a notice window displayed at the corner of the browser window. Instead of nagging every user of every site that "This site is using cookies", developers should nag only when connecting to other applications, using a standardized browser API. After sometime from standardization, you can roll out this functionality to all users and nothing legitimate would break. There should be no presumed used consent - because there really is none, the outcry against Facebook and advertiser tracking shows people don't expect the web to work the way it does.
  - 07d046 9y ago
    I've been using first party isolation for the last year or so, and I can't think of anything it's broken.
    - billysielu 9y ago
      Good to know, I'm gonna try this starting now. Using the extention: https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/ https://addons.mozilla.org/en-US/firefox/addon/first-party-i...
      - billysielu 8y ago
        2 week report: I haven't seen anything break.
  - worble 9y ago
    Unless I'm misunderstanding how the 'cookie' tab on uMatrix works, I'm blocking all third party cookies and have yet to have a site break on me.
  - groovecoder 9y ago
    We ran a breakage study near the end of last year. First-Party Isolation (FPI) did have the highest breakage scores: ~18-19% of users reported problems with it, and 9-10% of FPI users disabled the study. Those are low relative numbers, but at entire-market scale, they are big absolute numbers. :/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...
    - billysielu 9y ago
      It would be great if we could have "FPI on by default with whitelist". I think the stats are iffy because a lot of the breakages are things I would want broken.
  - fpoling 9y ago
    In my experience with Brave browser I had to enable third-party cookies only for very few sites. In most cases that was to support some external login mechanism that the site used, not to access the site after a login. So I doubt the claim about breakage on most sites.
  - unethical_ban 9y ago
    I tried it out and yes, it breaks AuthN with third party sites, but besides that I had a mostly good time with it. I did turn it off. Is there any plan to create an exceptions mechanism? "Allow Facebook access to your activities on this webpage?" or something like that?
- cherimoya 9y ago
  Some sites rely on multiple domains to work. E.g. open auth, cdns are usually a separate domain, a lot of big corporates create new domains for “microsites” when they want to do something new but are tied down by slow moving corporate practices (although the world would be a better place without microsites). Basically, you couldn’t do it without breaking a large part of the internet.
  - amelius 9y ago
    They could build a whitelist and distribute it with Firefox (?)
    - billysielu 9y ago
      I agree FPI should be on by default and have a whitelist.
- omk 9y ago
  While micro-sites and CDNs could still be brought under the same SLD. The biggest blocker as is OAuth. I'd want to make a UX call to see if browser could elegantly prompt the user for a 3rd party interaction. While we are at it, I keep wondering (in a strictly SSL world) if it would be a good idea to restrict CORS calls only to sites using the same certificate as the webpage. Would make life easier for folks like facebook.com making CORS to fb-blablabla.fbcdn.com.
  - johnchristopher 9y ago
    Wouldn't Facebook just start promoting their super Facebook compliant certificate to their partners then ?
- stonewareslord 9y ago
  This can be done with Firefox Multi-Account Containers[1] and Temporary Containers[2]. [1]: https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... [2]: https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
Tepix 9y ago
Indeed. Safari blocks 3rd party cookies by default, I see no reason why Firefox can't do the same. The fact that they don't is a direct contradiction to their claims that they care about user privacy. The only explanation I have is that they do not want to anger their long-time money sources Google and other advertisers.
- amelius 9y ago
  Perhaps they could make "better default-settings" an option :)
- yAnonymous 9y ago
  I agree, but blocking third-party cookies does break a whole lot of sites. Apple can do this, because they have a limited yet consistent market share that mostly consists of their own customers. But Firefox? If they block third-party cookies and Chrome does not, they might just end up losing even more users.
  - Tepix 9y ago
    Sure you can argue that way. But it's not as big of a problem as you think it is. The fact that Apple does it is enough proof for that. Websites can be changed to work without third party cookies. I'm blocking cookies since years and I have come across less than 10 sites that require it. When that happens, most of the time I just go elsewhere or I'll send them an email.
    - pellucidar 9y ago
      I’ve been blocking third party cookies for as long as Safari has had that option, and I’ve never noticed an issue. I only get Google’s annoying recaptchas when my search string is too specific for their tastes.
  - joosters 9y ago
    What sites are broken by Safari because of its default cookie options? I haven't encountered any.
eof 9y ago
There are lots of "shoulds" in the world. People should be nice, not steal, etc. It seems to me, if users act differently, there "should" be a way to fingerprint them.
- musage 9y ago
  I rather think if people fingerprint other people just because they can, using yet other misdeeds as an excuse for their own misdeed, there should be a way to steal from them and be not nice to them. Like, take their auger, poop on their sand castle, whatever makes them cry is fair game and should be done until the desired effect is achieved.
mih 9y ago
Ever encountered Google ReCaptcha when you've turned off third party cookies or while in incognito/private mode? It's a nightmare, even if you're logged into a Google account. You can be shown upto 7-8 challenges, painfully slow loading images and Google's insistence that they encountered malicious traffic from your IP when attempting to use the audio version. What's even worse is they track your mouse movements and fast solvers like me are penalized since they think I'm not human anymore. As much as I hate third party cookies, turning them on drastically simplifies the captcha solving process. So much so, I now use a separate browser profile with third party cookies allowed, just for the sake of captcha heavy sites. Given that Google benefits by tracking my activities and free labor from my captcha solving, they will always punish privacy conscious users via such dark patterns.
- deleted 9y ago
  [deleted]
- amelius 9y ago
  Perhaps Firefox could fake thirdparty cookies instead of disallowing them.
  - seqizz 9y ago
    Then you'd probably never pass captcha.
    - bluGill 9y ago
      firefox is big enough that captcha would be forced to change, so long as firefox stuck to it. I make no claim that the above is a good idea. It is possible, but it strikes me there are unintended consequences that I won't think of.
- ldjb 9y ago
  The optimist in me thinks that if browsers started to disallow third party cookies, ReCaptcha might have to adapt to the change and make it easier to solve if third party cookies are blocked. After all, if they didn't, they'd risk website owners moving away from ReCaptcha because visitors could no longer interact with the site. The pessimist in me thinks that if a browser were to disallow third party cookies, users might simply switch to a different browser that does allow them.
simias 9y ago
The security model of the internet is whack. Javascript should be opt-in, especially from 3rd party sources. "This website wants/requires javascript for an enhanced viewing experience [allow/deny]". Instead not only will any stock browser gladly run anything thrown at it, it will also accept any cookies and now run WebGL code, trigger DRM engines and various other things. All that because the engineers who wrote the standards had enough hubris to think that a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed. The web is a lost cause as far I'm concerned, it was under-engineered at the start and as a result people kept pilling mounds of crap on top to make up for it. What started as a way to display basic markup and images has been arm wrestled into handling complex web applications and videogames. The thing is so complex that it would probably take me less time to write a basic operating system and run Firefox on it than implementing my own browser from scratch on Linux. And despite all of this you end up having to use a billion of 3rd party javascript libraries to do anything remotely complex in the browser, things that have been standard in Qt or GTK since forever with a fraction of the code base and memory footprint. And now people seem to enjoy reimplementing all the internet protocols on top of HTTP. The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain. I'm glad that there appears to be a lot of discussion surrounding internet privacy lately, including in the mainstream. However I think that focusing all the discussion of Facebook is becoming counter-productive. Facebook exploited the weaknesses of the web very successfully but it only exploited tools that existed long before it was created. I have absolutely no illusion that Google & friends are doing pretty much the same thing, and if you have an Android phone the amount of info Google can harvest is nothing short of terrifying when you think about it from an Orwellian perspective. Don't miss the forest for the Facetree. Assuming that internet giants will adhere to some "code of conduct" is naive at best. "Do no evil", yeah right. We let them have to tools to do these things, we need to pry some of them away from their hands through technology and regulation (probably in that order).
- eeZah7Ux 9y ago
  Spot on. And most of website should not even need javascript but some simple extension to xhtml to allow interactive websites in a declarative fashion rather than having a Turing-complete language.
xtrapolate 9y ago
Anybody aware of any browsers making this a trivial workflow? Any comprehensive list of recommended plugins? Anything targeting mobile platforms?
- andrewaylett 9y ago
  Firefox's first-party isolation (brought across from Tor Browser) will foil cross-site tracking. Combined with Privacy Badger and Cookie Autodelete, your browser won't make the requests and even if they did, they wouldn't have any cookies attached. https://github.com/mozfreddyb/webext-firstpartyisolation https://github.com/mozfreddyb/webext-firstpartyisolation https://www.eff.org/privacybadger https://www.eff.org/privacybadger https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete
DonaldFoss 9y ago
There are valid uses for some of these. Imagine where online User eXperience and User Interfaces would be without services that help tell someone what is working and what is not. Fortunately, many US companies are starting to consider a GUID and your IP address to be PII, and no longer allow that information to be stored.
__blockcipher__ 9y ago
Wow. Obviously this idea gets thrown around HN a lot, but you deserve props for phrasing it so perfectly.

indiv0 9y ago

Exactly. Why aren't all websites run in containers by default (personally I'm envisioning per-domain containers)? What benefit do we get from full-coverage containerization not being the default?

r3bl 9y ago
In short: site breakage. We're so deep in this that a first party isolation would break almost every single website. In a cooperation with Tor, Mozilla actually ported the first-party isolation feature in mainstream Firefox (available in Nightly, don't know about stable), but since it would break almost every single website, there are no plans to turn it on by default. You can, of course, enable it yourself by turning on "privacy.firstparty.isolate" in about:config. Disclaimer: I'm a Mozilla Foundation affiliate that has nothing to do with Mozilla Corporation nor Firefox.
- cornholio 9y ago
  It would break some sites (certainly not every site, I'm browsing this site right now with it enabled) because 3rd party cookies are an entrenched, standardized feature of the web, you can't simply turn them off tomorrow. Developers are using them to create benign functionality, for example spread an application across multiple domains owned by the same publisher. What I proposed above is that we introduce an opt-in feature: before the browser is allowed to connect to 3rd parties (in the tracking and cookie sense), the user needs to opt-in, for example by clicking in a notice window displayed at the corner of the browser window. Instead of nagging every user of every site that "This site is using cookies", developers should nag only when connecting to other applications, using a standardized browser API. After sometime from standardization, you can roll out this functionality to all users and nothing legitimate would break. There should be no presumed used consent - because there really is none, the outcry against Facebook and advertiser tracking shows people don't expect the web to work the way it does.
- 07d046 9y ago
  I've been using first party isolation for the last year or so, and I can't think of anything it's broken.
  - billysielu 9y ago
    Good to know, I'm gonna try this starting now. Using the extention: https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/ https://addons.mozilla.org/en-US/firefox/addon/first-party-i...
    - billysielu 8y ago
      2 week report: I haven't seen anything break.
- worble 9y ago
  Unless I'm misunderstanding how the 'cookie' tab on uMatrix works, I'm blocking all third party cookies and have yet to have a site break on me.
- groovecoder 9y ago
  We ran a breakage study near the end of last year. First-Party Isolation (FPI) did have the highest breakage scores: ~18-19% of users reported problems with it, and 9-10% of FPI users disabled the study. Those are low relative numbers, but at entire-market scale, they are big absolute numbers. :/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...
  - billysielu 9y ago
    It would be great if we could have "FPI on by default with whitelist". I think the stats are iffy because a lot of the breakages are things I would want broken.
- fpoling 9y ago
  In my experience with Brave browser I had to enable third-party cookies only for very few sites. In most cases that was to support some external login mechanism that the site used, not to access the site after a login. So I doubt the claim about breakage on most sites.
- unethical_ban 9y ago
  I tried it out and yes, it breaks AuthN with third party sites, but besides that I had a mostly good time with it. I did turn it off. Is there any plan to create an exceptions mechanism? "Allow Facebook access to your activities on this webpage?" or something like that?
cherimoya 9y ago
Some sites rely on multiple domains to work. E.g. open auth, cdns are usually a separate domain, a lot of big corporates create new domains for “microsites” when they want to do something new but are tied down by slow moving corporate practices (although the world would be a better place without microsites). Basically, you couldn’t do it without breaking a large part of the internet.
- amelius 9y ago
  They could build a whitelist and distribute it with Firefox (?)
  - billysielu 9y ago
    I agree FPI should be on by default and have a whitelist.
omk 9y ago
While micro-sites and CDNs could still be brought under the same SLD. The biggest blocker as is OAuth. I'd want to make a UX call to see if browser could elegantly prompt the user for a 3rd party interaction. While we are at it, I keep wondering (in a strictly SSL world) if it would be a good idea to restrict CORS calls only to sites using the same certificate as the webpage. Would make life easier for folks like facebook.com making CORS to fb-blablabla.fbcdn.com.
- johnchristopher 9y ago
  Wouldn't Facebook just start promoting their super Facebook compliant certificate to their partners then ?
stonewareslord 9y ago
This can be done with Firefox Multi-Account Containers[1] and Temporary Containers[2]. [1]: https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... [2]: https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

Tepix 9y ago

Indeed. Safari blocks 3rd party cookies by default, I see no reason why Firefox can't do the same. The fact that they don't is a direct contradiction to their claims that they care about user privacy. The only explanation I have is that they do not want to anger their long-time money sources Google and other advertisers.

amelius 9y ago
Perhaps they could make "better default-settings" an option :)
yAnonymous 9y ago
I agree, but blocking third-party cookies does break a whole lot of sites. Apple can do this, because they have a limited yet consistent market share that mostly consists of their own customers. But Firefox? If they block third-party cookies and Chrome does not, they might just end up losing even more users.
- Tepix 9y ago
  Sure you can argue that way. But it's not as big of a problem as you think it is. The fact that Apple does it is enough proof for that. Websites can be changed to work without third party cookies. I'm blocking cookies since years and I have come across less than 10 sites that require it. When that happens, most of the time I just go elsewhere or I'll send them an email.
  - pellucidar 9y ago
    I’ve been blocking third party cookies for as long as Safari has had that option, and I’ve never noticed an issue. I only get Google’s annoying recaptchas when my search string is too specific for their tastes.
- joosters 9y ago
  What sites are broken by Safari because of its default cookie options? I haven't encountered any.

eof 9y ago

There are lots of "shoulds" in the world. People should be nice, not steal, etc. It seems to me, if users act differently, there "should" be a way to fingerprint them.

musage 9y ago
I rather think if people fingerprint other people just because they can, using yet other misdeeds as an excuse for their own misdeed, there should be a way to steal from them and be not nice to them. Like, take their auger, poop on their sand castle, whatever makes them cry is fair game and should be done until the desired effect is achieved.

mih 9y ago

Ever encountered Google ReCaptcha when you've turned off third party cookies or while in incognito/private mode? It's a nightmare, even if you're logged into a Google account. You can be shown upto 7-8 challenges, painfully slow loading images and Google's insistence that they encountered malicious traffic from your IP when attempting to use the audio version. What's even worse is they track your mouse movements and fast solvers like me are penalized since they think I'm not human anymore. As much as I hate third party cookies, turning them on drastically simplifies the captcha solving process. So much so, I now use a separate browser profile with third party cookies allowed, just for the sake of captcha heavy sites. Given that Google benefits by tracking my activities and free labor from my captcha solving, they will always punish privacy conscious users via such dark patterns.

deleted 9y ago
[deleted]
amelius 9y ago
Perhaps Firefox could fake thirdparty cookies instead of disallowing them.
- seqizz 9y ago
  Then you'd probably never pass captcha.
  - bluGill 9y ago
    firefox is big enough that captcha would be forced to change, so long as firefox stuck to it. I make no claim that the above is a good idea. It is possible, but it strikes me there are unintended consequences that I won't think of.
ldjb 9y ago
The optimist in me thinks that if browsers started to disallow third party cookies, ReCaptcha might have to adapt to the change and make it easier to solve if third party cookies are blocked. After all, if they didn't, they'd risk website owners moving away from ReCaptcha because visitors could no longer interact with the site. The pessimist in me thinks that if a browser were to disallow third party cookies, users might simply switch to a different browser that does allow them.

simias 9y ago

The security model of the internet is whack. Javascript should be opt-in, especially from 3rd party sources. "This website wants/requires javascript for an enhanced viewing experience [allow/deny]". Instead not only will any stock browser gladly run anything thrown at it, it will also accept any cookies and now run WebGL code, trigger DRM engines and various other things. All that because the engineers who wrote the standards had enough hubris to think that a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed. The web is a lost cause as far I'm concerned, it was under-engineered at the start and as a result people kept pilling mounds of crap on top to make up for it. What started as a way to display basic markup and images has been arm wrestled into handling complex web applications and videogames. The thing is so complex that it would probably take me less time to write a basic operating system and run Firefox on it than implementing my own browser from scratch on Linux. And despite all of this you end up having to use a billion of 3rd party javascript libraries to do anything remotely complex in the browser, things that have been standard in Qt or GTK since forever with a fraction of the code base and memory footprint. And now people seem to enjoy reimplementing all the internet protocols on top of HTTP. The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain. I'm glad that there appears to be a lot of discussion surrounding internet privacy lately, including in the mainstream. However I think that focusing all the discussion of Facebook is becoming counter-productive. Facebook exploited the weaknesses of the web very successfully but it only exploited tools that existed long before it was created. I have absolutely no illusion that Google & friends are doing pretty much the same thing, and if you have an Android phone the amount of info Google can harvest is nothing short of terrifying when you think about it from an Orwellian perspective. Don't miss the forest for the Facetree. Assuming that internet giants will adhere to some "code of conduct" is naive at best. "Do no evil", yeah right. We let them have to tools to do these things, we need to pry some of them away from their hands through technology and regulation (probably in that order).

eeZah7Ux 9y ago
Spot on. And most of website should not even need javascript but some simple extension to xhtml to allow interactive websites in a declarative fashion rather than having a Turing-complete language.

xtrapolate 9y ago

Anybody aware of any browsers making this a trivial workflow? Any comprehensive list of recommended plugins? Anything targeting mobile platforms?

andrewaylett 9y ago
Firefox's first-party isolation (brought across from Tor Browser) will foil cross-site tracking. Combined with Privacy Badger and Cookie Autodelete, your browser won't make the requests and even if they did, they wouldn't have any cookies attached. https://github.com/mozfreddyb/webext-firstpartyisolation https://github.com/mozfreddyb/webext-firstpartyisolation https://www.eff.org/privacybadger https://www.eff.org/privacybadger https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete

DonaldFoss 9y ago

There are valid uses for some of these. Imagine where online User eXperience and User Interfaces would be without services that help tell someone what is working and what is not. Fortunately, many US companies are starting to consider a GUID and your IP address to be PII, and no longer allow that information to be stored.

__blockcipher__ 9y ago

Wow. Obviously this idea gets thrown around HN a lot, but you deserve props for phrasing it so perfectly.