3 ms·

Blocking Third-Party Cookies is a nice option, but it would be better if those settings were for full-blown First Party Isolation instead.

Xylakant 8y ago
First party isolation was added in FF55 https://www.bleepingcomputer.com/news/software/another-tor-browser-feature-makes-it-into-firefox-first-party-isolation/ https://www.bleepingcomputer.com/news/software/another-tor-b...
- billysielu 8y ago
  It's off by default. To enable it you have to go into about:config. I'm saying it should be on by default, or at least exposed in the Settings for people to find. The concern about doing that was that some sites would break, but their definition of break included things which should break because they were previously abusing the lack of FPI. I have been browsing with FPI on for a while and nothing has broken. Protecting our privacy should be the default state of affairs. Mozilla did say Firefox would be opinionated...
  - Xylakant 8y ago
    I have it enabled and I can attest that it breaks a fair amount of sites. I think it’s fair to expose that as an expert level setting. It could benefit from a bit of advertising though.
    - unethical_ban 8y ago
      I wonder if it can be implemented on a per-site basis, like a security policy. Exception: gitea uses Github oauth Exception: unbury.me uses Google login etc Default: Full FPI
      - bscphil 8y ago
        This is extremely easy to do in uMatrix. If you don't want to use the other features, just set a default policy of allow all, then block third party cookies. You can then selectively allow access to cookies on a site by site basis.
        unethical_ban 8y ago
        Good point. So the technology is there, and an "expert" UI. It would be neat to see Mozilla create an intuitive UI for this to enable first party isolation by default, like a permissions model for other things. A modal popup "Unbury.me wants to grant access to google.com", for example.
  - bugmen0t 8y ago
    Mozilla did a study with user testing. Breaks lots of federated logins / Single-sign on solutions. Too much breakage to enable it by default. If you confuse users with this, they switch to GChrome and all you did for them is a privacy disservice. There's a First Party Isolation add-on though if you want a reachable toggle button.

Xylakant 8y ago

First party isolation was added in FF55 https://www.bleepingcomputer.com/news/software/another-tor-browser-feature-makes-it-into-firefox-first-party-isolation/ https://www.bleepingcomputer.com/news/software/another-tor-b...

billysielu 8y ago
It's off by default. To enable it you have to go into about:config. I'm saying it should be on by default, or at least exposed in the Settings for people to find. The concern about doing that was that some sites would break, but their definition of break included things which should break because they were previously abusing the lack of FPI. I have been browsing with FPI on for a while and nothing has broken. Protecting our privacy should be the default state of affairs. Mozilla did say Firefox would be opinionated...
- Xylakant 8y ago
  I have it enabled and I can attest that it breaks a fair amount of sites. I think it’s fair to expose that as an expert level setting. It could benefit from a bit of advertising though.
  - unethical_ban 8y ago
    I wonder if it can be implemented on a per-site basis, like a security policy. Exception: gitea uses Github oauth Exception: unbury.me uses Google login etc Default: Full FPI
    - bscphil 8y ago
      This is extremely easy to do in uMatrix. If you don't want to use the other features, just set a default policy of allow all, then block third party cookies. You can then selectively allow access to cookies on a site by site basis.
      - unethical_ban 8y ago
        Good point. So the technology is there, and an "expert" UI. It would be neat to see Mozilla create an intuitive UI for this to enable first party isolation by default, like a permissions model for other things. A modal popup "Unbury.me wants to grant access to google.com", for example.
- bugmen0t 8y ago
  Mozilla did a study with user testing. Breaks lots of federated logins / Single-sign on solutions. Too much breakage to enable it by default. If you confuse users with this, they switch to GChrome and all you did for them is a privacy disservice. There's a First Party Isolation add-on though if you want a reachable toggle button.