3 ms·

In short: site breakage. We're so deep in this that a first party isolation would break almost every single website. In a cooperation with Tor, Mozilla actuall

by r3bl 9y ago

In short: site breakage. We're so deep in this that a first party isolation would break almost every single website. In a cooperation with Tor, Mozilla actually ported the first-party isolation feature in mainstream Firefox (available in Nightly, don't know about stable), but since it would break almost every single website, there are no plans to turn it on by default. You can, of course, enable it yourself by turning on "privacy.firstparty.isolate" in about:config. Disclaimer: I'm a Mozilla Foundation affiliate that has nothing to do with Mozilla Corporation nor Firefox.

cornholio 9y ago
It would break some sites (certainly not every site, I'm browsing this site right now with it enabled) because 3rd party cookies are an entrenched, standardized feature of the web, you can't simply turn them off tomorrow. Developers are using them to create benign functionality, for example spread an application across multiple domains owned by the same publisher. What I proposed above is that we introduce an opt-in feature: before the browser is allowed to connect to 3rd parties (in the tracking and cookie sense), the user needs to opt-in, for example by clicking in a notice window displayed at the corner of the browser window. Instead of nagging every user of every site that "This site is using cookies", developers should nag only when connecting to other applications, using a standardized browser API. After sometime from standardization, you can roll out this functionality to all users and nothing legitimate would break. There should be no presumed used consent - because there really is none, the outcry against Facebook and advertiser tracking shows people don't expect the web to work the way it does.
07d046 9y ago
I've been using first party isolation for the last year or so, and I can't think of anything it's broken.
- billysielu 9y ago
  Good to know, I'm gonna try this starting now. Using the extention: https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/ https://addons.mozilla.org/en-US/firefox/addon/first-party-i...
  - billysielu 8y ago
    2 week report: I haven't seen anything break.
worble 9y ago
Unless I'm misunderstanding how the 'cookie' tab on uMatrix works, I'm blocking all third party cookies and have yet to have a site break on me.
groovecoder 9y ago
We ran a breakage study near the end of last year. First-Party Isolation (FPI) did have the highest breakage scores: ~18-19% of users reported problems with it, and 9-10% of FPI users disabled the study. Those are low relative numbers, but at entire-market scale, they are big absolute numbers. :/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...
- billysielu 9y ago
  It would be great if we could have "FPI on by default with whitelist". I think the stats are iffy because a lot of the breakages are things I would want broken.
fpoling 9y ago
In my experience with Brave browser I had to enable third-party cookies only for very few sites. In most cases that was to support some external login mechanism that the site used, not to access the site after a login. So I doubt the claim about breakage on most sites.
unethical_ban 9y ago
I tried it out and yes, it breaks AuthN with third party sites, but besides that I had a mostly good time with it. I did turn it off. Is there any plan to create an exceptions mechanism? "Allow Facebook access to your activities on this webpage?" or something like that?

by r3bl 9y ago

cornholio 9y ago

It would break some sites (certainly not every site, I'm browsing this site right now with it enabled) because 3rd party cookies are an entrenched, standardized feature of the web, you can't simply turn them off tomorrow. Developers are using them to create benign functionality, for example spread an application across multiple domains owned by the same publisher. What I proposed above is that we introduce an opt-in feature: before the browser is allowed to connect to 3rd parties (in the tracking and cookie sense), the user needs to opt-in, for example by clicking in a notice window displayed at the corner of the browser window. Instead of nagging every user of every site that "This site is using cookies", developers should nag only when connecting to other applications, using a standardized browser API. After sometime from standardization, you can roll out this functionality to all users and nothing legitimate would break. There should be no presumed used consent - because there really is none, the outcry against Facebook and advertiser tracking shows people don't expect the web to work the way it does.

07d046 9y ago

I've been using first party isolation for the last year or so, and I can't think of anything it's broken.

billysielu 9y ago
Good to know, I'm gonna try this starting now. Using the extention: https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/ https://addons.mozilla.org/en-US/firefox/addon/first-party-i...
- billysielu 8y ago
  2 week report: I haven't seen anything break.

worble 9y ago

Unless I'm misunderstanding how the 'cookie' tab on uMatrix works, I'm blocking all third party cookies and have yet to have a site break on me.

groovecoder 9y ago

We ran a breakage study near the end of last year. First-Party Isolation (FPI) did have the highest breakage scores: ~18-19% of users reported problems with it, and 9-10% of FPI users disabled the study. Those are low relative numbers, but at entire-market scale, they are big absolute numbers. :/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/ https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...

billysielu 9y ago
It would be great if we could have "FPI on by default with whitelist". I think the stats are iffy because a lot of the breakages are things I would want broken.

fpoling 9y ago

In my experience with Brave browser I had to enable third-party cookies only for very few sites. In most cases that was to support some external login mechanism that the site used, not to access the site after a login. So I doubt the claim about breakage on most sites.

unethical_ban 9y ago

I tried it out and yes, it breaks AuthN with third party sites, but besides that I had a mostly good time with it. I did turn it off. Is there any plan to create an exceptions mechanism? "Allow Facebook access to your activities on this webpage?" or something like that?