24 ms·

Changing Our Approach to Anti-Tracking

• SimeVidas 8y ago
  The new options that are available in Firefox Nightly: https://i.imgur.com/GMHGDvy.png https://i.imgur.com/GMHGDvy.png
• alphabettsy 8y ago
  I’m sure the ad industry will find new ways, but the speed increase was pretty big for me after adding a Pi-Hole.
  • dddddaviddddd 8y ago
    Main difference is that browser makers (Mozilla, Apple, Google for non-Google ads) are becoming hostile to ads and tracking rather than trying to be neutral.
    • bilbo0s 8y ago
      >Google ? If Google is not hostile to all ads, then they are not "becoming hostile to ads".
    • M2Ys4U 8y ago
      Why is that a _bad_ thing?
      • dddddaviddddd 8y ago
        It's a good thing! Browser makers being more adversarial will limit the ability of tracking and advertising to 'find new ways'
• alien1993 8y ago
  That's great news, will this be on par with Ghostery features wise or will it be less granular?
• javery 8y ago
  This post has third party JS in it from Google Analytics that looks to be accepting a bunch of fairly unique looking parameters.
  • tunap 8y ago
    Yep. Moz hits all the right talking points... then implements/participates in said behaviors. In a good way, supposedly.
  • firloop 8y ago
    However, Mozilla has a special agreement with Google Analytics that ensures all data is anonymized. Some discussion which mentions that here: https://github.com/mozilla/addons-frontend/issues/2785 https://github.com/mozilla/addons-frontend/issues/2785
    • spacehome 8y ago
      Surely we can trust Google.
      • EGreg 8y ago
        Why does Mozilla NEED Google’s analytics?
        • mrep 8y ago
          I don't work for Mozilla but presumably they will be at a disadvantage in identifying and thus prioritizing features that their customers want compared to competing browsers. Less features -> less users -> less revenue from google for paying to be the default search engine which then completes the reinforcement cycle as they will have less money to spend on features. Now they probably don't NEED it, but with every user they lose to chrome, they get less and less money until the only market for them would potentially be the privacy focused ones (although I here chromes got really good privacy features nowadays) which are such a small population that they wouldn't even have enough customers to justify the revenue to even match competing browser features. Thus, you would end up with a lackluster browser that cannot match competing browsers and its only niche are privacy people.
• amelius 8y ago
  Good news. They should also refine their approach of "containers", and I've listed some ideas here: https://news.ycombinator.com/item?id=16866086 https://news.ycombinator.com/item?id=16866086 (perhaps their new approach comes close to these ideas)
  • ronjouch 8y ago
    I think they are, slowly. See the Firefox Weekly 44 ( https://blog.nightly.mozilla.org/2018/08/29/these-weeks-in-firefox-issue-44/ https://blog.nightly.mozilla.org/2018/08/29/these-weeks-in-f... ) and search for "Contextual Feature Recommender": they're starting by experimenting pushing their Facebook Container addon. Screenshot: https://blog.nightly.mozilla.org/files/2018/08/f712ffde-1c33-441f-927b-3868b915923e.png https://blog.nightly.mozilla.org/files/2018/08/f712ffde-1c33...
    • tialaramex 8y ago
      I really like Facebook Container. I completely forget it's there most of the time. Last time I remembered was because I saw an advert before an embedded Youtube video - I pay for Youtube so it doesn't have adverts, but of course the Container doesn't know that. The partitioning that results makes lots of sense for me.
    • daveFNbuck 8y ago
      The Facebook Container plugin has features that aren't available in the Multi-Account Containers plugin, such as limiting the container to a domain so it doesn't follow you when you click a link. Facebook containers should just be a default/recommended setting for the core containers plugin rather than something that requires its own special plugin.
• beat 8y ago
  I'm posting this from Firefox. I think this article, on top of other recent efforts by Mozilla, is the final push to switch me from Chrome to Firefox. I trust Mozilla a lot more than I trust Google these days.
  • 0xmohit 8y ago
    But Mozilla trusts Google more than any search engine provider. That would be the only explanation for Google being the default search engine.
    • ct0 8y ago
      Google just pays the most, I think that's where most of Firefox's income comes from.
    • beat 8y ago
      I'm less concerned about the search engine than I am about tracking from within the browser. Feel free to mock me for that if you disagree.
      • 0xmohit 8y ago
        The browser may not be tracking you, but it does default to a search engine that tracks and profiles you. It can't get any worse.
        • jessaustin 8y ago
          Please don't challenge Google in that way.
        • cweagans 8y ago
          Sure it can! Google could be the only option in Firefox. But that's not the case. In any case, the vast majority of users simply do not care and will happily use whatever is given to them. The people that do care have the ability to change the defaults. I'm not really sure why you're viewing this as the end of the world, especially since all the money that Google pays to Mozilla enables the development of Firefox in the first place. What else are you gonna use? lynx?
• te_chris 8y ago
  I recently started a new job and took a fresh laptop as as good an excuse as any to switch to Firefox. It's great! It's fast, dev tools are good. I don't miss anything from chrome apart from the automatic google translate - joys of being in the EU.
• deleted 8y ago
  [deleted]
• mmebane 8y ago
  How will this interact with other privacy tools such as Privacy Badger? Are they safe to use together? Will they negatively interact?
  • daveFNbuck 8y ago
    The most annoying thing from the current version is that when a site doesn't work, even completely turning off your privacy plugins won't necessarily fix it. You have to remember that this is another thing that you may have to disable to use a site. Other than that, it should be fine.
    • iaskwhy 8y ago
      I use another browser for those sites. So Firefox with all the fancy add-ons for 99% of my browsing and then Edge for those times I really can't have it failing on me (any sort of payment, that's pretty much it).
      • daveFNbuck 8y ago
        I do that sometimes too, but there are plenty of sites in the middle-ground between absolutely must use and don't care if it fails.
      • johnpowell 8y ago
        I do the same. The Open With extension is nice. https://addons.mozilla.org/en-US/firefox/addon/open-with/ https://addons.mozilla.org/en-US/firefox/addon/open-with/ https://i.imgur.com/7roeIBf.png https://i.imgur.com/7roeIBf.png
• bsdubernerd 8y ago
  I've been blocking 3rd-party cookies since a decade now. I have never witnessed any website breaking. And I do regularly buy from online shops (ebay, amazon, lots of others) while blocking 3rd-party cookies. I'd really want to know which websites do break, and if they do, in which fashion.
  • jmspring 8y ago
    I’ve had online bill pay sites - typically banks - fail with some tracker blocking enabled.
    • jiveturkey 8y ago
      same. those all work for me now, though, since maybe 1 year ago.
  • sammacbeth_ 8y ago
    Here are some examples: https://whotracks.me/blog/block-third-party-cookies.html https://whotracks.me/blog/block-third-party-cookies.html
  • Mithriil 8y ago
    Do you use an add-on to block cookies? If not, how?
    • crtasm 8y ago
      Firefox has an option for allowing third party cookies: always/from visited/never.
    • coolspot 8y ago
      I also recommend Cookie AutoDelete for firefox[1] and Chrome[2]. 1 - https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... 2 - https://chrome.google.com/webstore/detail/cookie-autodelete/fhcgjolkccmbidfldomjliifgaodjagh https://chrome.google.com/webstore/detail/cookie-autodelete/...
  • 8y ago
• xfitm3 8y ago
  I’m a big fan of Mozilla, and I’m really glad to see them focusing on Firefox instead of troubled projects like FirefoxOS. While they are not immune from poor decisions I really believe they try to do the right thing in the end. That’s more than I can say for many other companies.
  • glogla 8y ago
    FirefoxOS was out last hope for good and accessible mobile operating system - it was supposed to give people who can't afford iPhone something open, instead of evil data-slurp that is Android. Without it, billions of people in developing world are going to have every every second of their lives snooped by Google. It failed, but it was still a good idea.
    • rglullis 8y ago
      There is still hope. It didn't failed, just has morphed into KaiOS, which is primarily focused on the developing world.
      • Fnoord 8y ago
        KaiOS includes Google proprietary services. There's a few alternatives to the Android/iOS ecosystem, notably Librem 5, KDE Mobile, Ubuntu Touch, microG (e.g. with LineageOS), and last but not least Sailfish.
        • shandor 8y ago
          What about Tizen? Haven't been following it too closely, but isn't it a kind of descendant of the Meego platform in some sense?
          • Fnoord 8y ago
            There's WebOS and Tizen. I haven't used either, but heard Tizen's codebase is abysmal. WebOS is by LG, Tizen is by Samsung. MeeGo was a combination of Intel's Moblin and Nokia's Maemo. I'm not sure what became of Intel's efforts after MeeGo. Sailfish is the successor of Maemo/MeeGo whereas Mer is an open source mobile Linux OS which Sailfish uses as base. Both utilise libhybris [1] for Android compatibility layer. Backwards compatibility = important; no apps / ecosystem = no users, and that curve is very steep. Another interesting effort I saw the other day is actually from Google. An effort to easily build an app which is easily ported to Android and iOS. That might directly benefit Android and Google most, but indirectly it could benefit libhybris users. I'm unsure how good Sailfish 3's Android compatibility is these days. It used to be Android 4.4 compatibility for a long time. [1] https://en.wikipedia.org/wiki/Hybris_(software) https://en.wikipedia.org/wiki/Hybris_(software)
• TekMol 8y ago
  This seems to be a blacklisting solution. Some third party code gets filtered. I prefer a whitelisting solution. umatrix is a very elegant tool for this. You can say On domain thisandthat.com allow scripts from domain soandso.com' Or On domain funkycars.com allow images from domain carimageserver.com That is exactly the level of whitelisting that feels logical to me. https://addons.mozilla.org/en-US/firefox/addon/umatrix/ https://addons.mozilla.org/en-US/firefox/addon/umatrix/ I wonder how closely Mozilla analyzes the addons they offer for download? Are they as trustworthy as Firefox itself?
  • kemitche 8y ago
    Whitelisting while keeping every website moderately functional seems impractical for the Mozilla team, which means the burden of choosing what to allow falls on the end user. While that's a great approach for privacy, the usability loss would probably drive the average person away from Firefox. I think the listed approach is likely best for the average user, but I think it would be nice to have an option for a power user to turn on a whitelist-only mode. (One could argue that "install an extension" is an appropriate "option" for the power user, but as you mention, it's nicer to not need to rely on third party extensions)
    • 394549 8y ago
      > Whitelisting while keeping every website moderately functional seems impractical for the Mozilla team, which means the burden of choosing what to allow falls on the end user. I've used NoScript for a long time, and the hardest thing is knowing what the domain is doing so I can decide what to allow. It's hard to tell the difference between opaquely named ad-networks and opaquely named media player providers. It would be nice if someone could start compiling a database that 1. groups together the domains used by different sites and services (e.g. website.com and website-images.com) and 2. includes a brief description of their purpose or business. So, doubleclick.com and doubleclick.net could be grouped and easily identified as an ad network, google tag manager is a tracker, etc. I doubt such a list would take any more effort to maintain than the current ad-blocker lists.
  • barrkel 8y ago
• pmfgpmfg 8y ago
  performance is the wrong motivation behind blocking trackers. they should be blocked because they're wrong, not because they slow website load pages.
  • CaptSpify 8y ago
    Why not both? I agree with you that they should be blocked because they are wrong, but I'd also agree that they should be blocked because they are slow.
• TekMol 8y ago
  Uh oh, I just learned that Mozilla injects Google Analytics tracking code into Firefox itself. When you go to about:addons, it sends tracking data to Googles servers. Is there a way to get rid of that? It seems to be not blocked by a default umatrix for example. I think we really need a browser by a more trustworthy party. Maybe Debian could make a Firefox fork that is more user friendly in terms of privacy? Is there a way for vote for this or sponsor such a development?
  • JohnTHaller 8y ago
    Mozilla has a special agreement with Google for this that anonimizes the data.
    • TekMol 8y ago
      I'm sure every tracking company out there says they do only good with the data they track. If that is what it takes to make tracking ok, then why bother at all?
      • jonathanyc 8y ago
        What? Did you even read the parent comment? It’s a legal contract.
        • natch 8y ago
          Contracts that purport to protect user privacy are often rife with weasel words. So I wouldn’t assume anything.
          • jonathanyc 8y ago
            Ah yes, it’s so easy to prove a conspiracy to yourself if you just assume one to begin with.
            • natch 8y ago
• have_faith 8y ago
  What are the requirements for what gets blocked and what doesn't get blocked? Is there a heuristics based approach to tracking blocking or is it all still cat and mouse with block lists? I'm not up to speed on any breakthroughs in that regard.
• skywhopper 8y ago
  Unclear from this article is how they determine what is a "tracker"? I assume there'll be a curated block list, maybe based on anonymously collected data. But that detail is key to whether this is a success or not.
  • kevsim 8y ago
    Yeah, I'm left wondering the same thing. Apple's Intelligent Tracking Prevention (version 2 of which will ship in Safari/iOS 12 in September[0]) uses some sort of ML-based solution to decide what is and what is not a tracker, blocks cookies from being sent to domains that haven't been visited in a first party context, and has an explicit way for the user to opt-in to cookies being sent upon interaction in an iframe (e.g. the FB "like" button). Unclear how this Mozilla version stacks up. 0: https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/ https://webkit.org/blog/8311/intelligent-tracking-prevention...
    • nickvanhoog 8y ago
      Funny thought: Does ITP use ML to determine that googleadservices.com is a "prevalent" domain?
  • Vinnl 8y ago
    Presumably they're using the same mechanism as today, but just enabling it by default. That means it's based on the Disconnect.me blacklist: https://support.mozilla.org/en-US/kb/tracking-protection#w_block-lists-in-firefox https://support.mozilla.org/en-US/kb/tracking-protection#w_b...
• kibwen 8y ago
  > Blocking pop-up ads in the original Firefox release was the right move in 2004, because it didn’t just make Firefox users happier, it gave the advertising platforms of the time a reason to care about their users’ experience. Wow, I had completely forgotten about what a scourge pop-ups used to be, and what a relief it was to finally be free of them. The fact that what used to be such a prevalent scummy tactic could be completely abandoned due to pushback from browser manufacturers gives me a tiny bit of hope that maybe pervasive tracking isn't an irreparably permanent feature of the web after all.
  • ihuman 8y ago
    Too bad they've now been replaced popups that occur in the same window as the website you're viewing. Is there a name for this new type of popup?
    • deleted 8y ago
      [deleted]
    • stormbrew 8y ago
      The real scourge at the time was actually pop-unders, which you would never figure out where they came from and saw them potentially hours after visiting the site that produced them. It's honestly an improvement that sites have to obscure their own content (and thus spite their nose to save their face) and nothing else in order to give you intrusive ads. You'll always know what websites don't put value on their own content that way.
      • rasz 8y ago
        What do you mean was? popunders are all the rage recently and work great under Chrome. [Reverse Engineering new PopUnder for Chrome 63 on Windows] https://www.youtube.com/watch?v=VcFQeimLH1c https://www.youtube.com/watch?v=VcFQeimLH1c https://www.reddit.com/r/LiveOverflow/comments/84ertx/new_popunder_in_chrome_67_even_works_on_canary_as/ https://www.reddit.com/r/LiveOverflow/comments/84ertx/new_po...
• ilovecaching 8y ago
  What's worse, knowing you have no privacy, or having the illusion that you have privacy? Companies with deep pockets and skin in the advertising game can still track you. Anytime a defense is put up, they just pivot to another method of tracking. When you have an army of the world's best engineers and unlimited resources a way will be found. We need to start living with the reality that privacy is already dead. Weep if you will, but at least accept the truth that Mozilla can't protect you, and that your data IS out there somewhere.
  • alex_duf 8y ago
    We (users) can make it easy and cheap to extract data out of us, or make it harder and more expensive. I know which option I want
  • unethical_ban 8y ago
    No. This is a fatalist attitude that ignores things like ethics still remaining in developers, the fact that the cat-and-mouse means the defenses ARE working, and the fact that the engineers you are so awed by aren't really magicians. Yes, there are data breaches and tracking, and it will continue. But the fight has moral and practical value, and I appreciate Mozilla for continuing it.
  • msla 8y ago
    The quickest way to defeat someone is to convince them to stop fighting. This works especially well if the person you're convincing to give up is, at that moment, winning, or beginning to win.
  • mLuby 8y ago
    I agree that this privacy/ads arms race currently favors ads, but all it takes is one law (think GDPR) to dramatically reshape the conflict. Luckily that power still resides with the users.
• EGreg 8y ago
  “Firefox will strip cookies and block storage access from third-party tracking content.” This sounds ambiguous to me. Does it mean they won’t block third party cookies for NON tracking content? We rely on third party cookies for Single Sign On auth. The question is, how will this continue to work? Ideally, these browsers should finally allow access to client side certificates functionality so you can authenticate with websites without being tracked by the certificate’s issuer! XAuth was a step in this direction. We need a place to store these certs or private keys. But are all major browsers even close to supporting it? Update: Firefox supports them but it’s so clunky. Focus on letting any site install a certificate with the user’s permission, firefox!! Apple already allows web based download of configuration profiles, which is far more insecure: https://developer.apple.com/enterprise/documentation/Configuration-Profile-Reference.pdf https://developer.apple.com/enterprise/documentation/Configu... https://medium.com/@sevcsik/authentication-using-https-client-certificates-3c9d270e8326 https://medium.com/@sevcsik/authentication-using-https-clien...
  • testplzignore 8y ago
    I think this explains which cookies would be blocked: https://support.mozilla.org/en-US/kb/tracking-protection#w_block-lists-in-firefox https://support.mozilla.org/en-US/kb/tracking-protection#w_b...
• 0xmohit 8y ago
  In the near future, Firefox will — by default — protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites. Sounds promising. However, having Google as the default search engine is a good enough reason to discourage one from using Firefox. Wonder if it would ever change.
  • Kaveren 8y ago
    I don't think so. The vast majority of people outside of China use Google as their search engine, and would want to continue to do so. It'd be bad UX to force them away from this. Within a few seconds I can easily adjust my search engine preferences in the options menu, and DuckDuckGo is listed as one of the default options.
  • kibwen 8y ago
    > having Google as the default search engine is a good enough reason to discourage one from using Mozilla Hm? The only browser that doesn't ship Google as the default search engine is Edge (with apologies to Lynx users). Is the alternative to suggest that people not on Windows simply shouldn't browse the web? Changing the default takes only four clicks: search box -> change search settings -> default search engine -> select from dropdown menu.
  • bopbop 8y ago
    Honest question - What is it you are considering as the alternative browser in this situation? The other big 3rd party (non-os supplied) browser is literally made by google.
  • TheRealPomax 8y ago
    And what would you suggest as alternative, given that normal users (e.g. people who've never even heard of HN and make up the majority of browser users) expect to search with Google? As far as I recall, the Google search is part of the funding agreement (because Mozilla is still a non-profit, the money has to come from _somewhere_ and we, the users of the browser, sure aren't paying them?) with the explicit agreement that it is trivial to change the default search engine for people who don't want to search with Google. Click on the drop-down on the left of the search field in the browser, you click "change search settings", you pick your preferred search (options for which include "duck duck go" these days) and you're done forever. That... feels like a perfectly fine way to go about offering people what they want: make what the majority wants the default, and make it trivial to change for people with different wants or needs.
• misterbowfinger 8y ago
  Firefox will [...] block storage access from third-party tracking content. Is that an impact on LocalStorage?
• stormbrew 8y ago
  I'm not entirely sure why the solution to the tracking problem isn't seen as simply scoping cookies to the domain of the top level page. I'm dubious that there's any value to cross site cookies that isn't in service of tracking, since oauth-style flows provide a better and more open mechanism for providing cross- or multi-site login mechanisms anyways. Is there some value I'm missing? Why blacklist this? I'd rather whitelist it.
• jaisfj 8y ago
  From reading the title, I thought Mozilla were going to set telemetry, Cliqz spyware, Pocket ads, etc. as opt-in. Sad that I was wrong :(
• jstanley 8y ago
  > Firefox will strip cookies and block storage access from third-party tracking content. I'm curious how this will work with things like Google Hosted Libraries[1] (for just one of countless examples)? The site will stop working if you block the request, but the tracking will keep working if you don't block the request. [1] https://developers.google.com/speed/libraries/ https://developers.google.com/speed/libraries/
• gnicholas 8y ago
  I'm curious to see how the blocking of slow-loading trackers will affect browsing ability. I put a pi-hole on my network and have found that some sites become extraordinarily slow to load (like more than 20x as slow as without the pi-hole), presumably because there's something being blocked that prevents the rest of the site from being loaded. Needless to say, this makes the pi-hole a win-some-lose-some proposition. Hopefully Firefox's implementation will avoid this pitfall!
  • rasz 8y ago
    sounds like your setup simply blackholes instead of returning blank resources, this might lead to retries and waiting for timeouts
    • gnicholas 8y ago
      That sounds about right. Anyone have tips for how to improve performance on a pi-hole? I’ve googled but not found anything that looked spot-on.
  • hegz 8y ago
    I use umatrix and it makes things way faster. The local news website can run with 30kb of JS but without umatrix it loads 9MB
• billysielu 8y ago
  So is this "First Party Isolation on by default", or something else?
• jasonkostempski 8y ago
  This is the wrong angle to take. Plugins are the correct solutions to these problems. A browser should implement the standards. Period. If this breaks a site users want or need, they will go to another browser. If Mozilla wants to fix things, they should be fighting for new standards. Start with a standard that says all third-party content requires a user prompt to enable, always, no whitelist, no blacklist, no way to disable the prompt. Same with all JS hardware API calls. That's how it should have been from the start. Any browser vendor that goes against the standard would be forced to admit they're enabling gapping vulnerabilities.
  • unethical_ban 8y ago
    There is no web standard for ethical tracking. Web standards are rendering video, images and text, processing JavaScript, interpreting CSS, and so on.
    • jasonkostempski 8y ago
      Maybe your right. I looked quickly but didn't find anything. Is there no standard out there stating, for example, that JavaScript MUST NOT be allowed unrestricted access to local storage or that the location API MUST request permission? These are just accepted as obvious best practices?
• EastSmith 8y ago
  What about evercookies? Why a website needs to know what fonts I have installed? Why a website needs to know my plugins? Why a website need to know the gazzilion of data points tools like evercookie are uaing to fingerprint users. I asked for a website. Just give it to me. I will render it if I can. If I can not - too bad for the website.
  • SquareWheel 8y ago
    >Why a website needs to know what fonts I have installed? So it can render the website in an appropriate font, while avoiding unnecessary network downloads. >Why a website needs to know my plugins? Plugins used to be used for rendering applets. It made sense to see if you had Flash/Java installed before trying to insert one. Thankfully, plugins are now going away.
    • hegz 8y ago
      You can set a list of fonts to use and the browser will keep trying until it finds one that is installed. Usually the last one in your list is serif or sans-serif that always works.
      • SquareWheel 8y ago
        That's true, but my comment goes further than that. Webfonts require network requests if they aren't available locally. It might make sense to scan the available font list for similar fonts before initiating a download.
        • ddebernardy 8y ago
          Couldn't a browser do that without necessarily revealing the list of fonts? if (!isFontAvailable(font)) { downloadFont(font); } It's not like a tracking script is going to try to iterate over every single existing font out in the wild for finger printing purposes. Doing so would be too easy to detect and block at the browser level. In the meanwhile, a script can get the list of fonts directly.
• natch 8y ago
  They should expose the switch to turn off Javascript... this should be table stakes for any browser. Yes I realize it can be accessed by a series of steps that include leaving the page you’re on, but there is too much friction in that interaction flow.
• internet_user 8y ago
  ..How can anyone protect you against html5 canvas hashes? Seems like an impossible task.
  • falcolas 8y ago
    The TOR browser simply blocks access to the canvas itself. Seems like a good addition to the "would you like to grant access to" list.
    • jerheinze 8y ago
      The patch for that has been already uplifted to Firefox and is behind the pref "privacy.resistFingerprinting": https://bugzilla.mozilla.org/show_bug.cgi?id=967895 https://bugzilla.mozilla.org/show_bug.cgi?id=967895 By the way it's spelled "Tor" ;)
      • falcolas 8y ago
        Tangentially, that's bothered me since it's "The Onion Router", and such abbreviations are typically capitalized.
  • jerheinze 8y ago
    Flipping "privacy.resistFingerprinting" in about:config to true should be sufficient in recent versions (also realize that this will change your default UTC prefs, some timing prefs, default window size, and a bunch of other stuff ...etc).
• BadassFractal 8y ago
  How does Brave's approach compare to Mozilla's in this area? Are they about comparable?
• zn44 8y ago
  It’s a great initiative but I am afraid it will only change business mode of tracking providers to offer self hosted software that will no longer be 3rd party ...
  • dangrossman 8y ago
    That would achieve the stated goal of removing cross-site tracking.
    • zn44 8y ago
      I imagine self hosted solution would still forward the information to the third party in the backend
      • dangrossman 8y ago
        That alone doesn't allow cross-site tracking. You need a way to identify that the person on one site is the same person on another site, which is the role the third-party cookie plays. Firefox is eliminating the third-party cookie, and working to eliminate cookie-less fingerprinting techniques as well. Who hosts the information is not the concern.
        • snaky 8y ago
          > to eliminate cookie-less fingerprinting techniques as well. That's not feasible without turning off JavaScript completely.
        • zn44 8y ago
          Good point, that’s a great improvement. I just believe you would still be able to identify and fingerprint individuals across sites if you simply pass data through self hosted solution to 3rd part aggregate
  • belorn 8y ago
    As someone who is continuously trying to get people to use self hosting over web services I somehow expect that will be a tough sell.
• HIPisTheAnswer 8y ago
  Turn off JS - Done!
• singularity2001 8y ago
  > select “Trackers (recommended)” to block cross-site tracking cookies. What exactly is it they are blocking? Do they have a black list of sorts, or a heuristic?
• besieged 8y ago
  While I applaud this, Firefox is consistently the slowest browser or both Android and MacOS.
• singularity2001 8y ago
  Keep in mind that mozilla is financed by google. Which means they might always find loopholes like these to track you: https://github.com/mozilla/addons-frontend/issues/2785 https://github.com/mozilla/addons-frontend/issues/2785 Search 'telemetry' and 'tracking' under about:config . Set all true to false where appropriate. search for google and mozilla, remove all url entries. or just wildcard-block them via dnsmask.
  • codazoda 8y ago
    I was going to say that they aren't financed by Google, there's just a search contract, but I found this tidbit online... "Historically, search engine royalties have been the main revenue driver for Mozilla. Back in 2014, the last year of the Google deal, that agreement brought in $323 million of the foundation’s $330 million in total revenue." The default search contract went to Yahoo between 2014 and 2017 then back to Google after that. Looks like they do get most of their money from Google.
    • singularity2001 8y ago
      thanks for confirming (and data)
• herodotus 8y ago
  This is the control I would like (and maybe someone has tried it...): for a given URL, I control which additional URLs I permit for that page. So, for example, if I type "nytimes.com" as the top level URL, I might allow "nyt.com" as well. The GET or POST for any other URLs on that page will not be sent by my browser.
  • nathcd 8y ago
    Try uMatrix! That's almost exactly what it does. Further, it lets you control requests by type, like stylesheets, images, scripts, XHRs, iframes, etc. Its original name was HTTP Switchboard, which I thought was a great descriptor for what it does (and for its interface).
    • herodotus 8y ago
      Fabulous! And informative! Just wish there was one for Safari... Thanks for the lead.
  • propogandist 8y ago
    This is exactly what uMatrix does
• alwaysnotrust 8y ago
  "except from Google"
• alwaysnotrust 8y ago
  "Except from Google"
• unwabuisi 8y ago
  As a Web Dev I am split on a movement like this. I understand the need for users to control what data they allow companies to have on them, but if other browsers do not follow suit, what will that mean for deployment and making sites consistent across browsers? If Firefox is blocking popular libraries or scripts that end up breaking some webpages the user experience still suffers
  • wfleming 8y ago
    I think that's effectively already the world we live in. As a uBlock user I occasionally run into sites that are broken because they wrote code assuming that some function provided by an analytics library would exist, and it doesn't because that library got blocked. I file bug reports when I can, and I'm concientous about handling these cases in my own code. Writing code to handle the failure to load of third party scripts like this should really be a best practice anyway. Even if you use subresource integrity checks on all the external scripts you load, what if some analytics provider's site is down for a while? Do you want your site to still work? I do. (Obviously this does not apply to scripts that are actually necessary for the core functionality of your site, but that doesn't really apply to analytics/tracking tools for the most part.) Making this the default behavior of FF will make this sort of breakage more visible to more people, it's true. If anything maybe this will encourage sites to write their code to handle failure more elegantly and I'll spend less time annoyed. One can dream.
  • hegz 8y ago
    Site owners were given freedom for a long time and they consistently chose to do the wrong things with no sign of ever stopping. Now browsers have to step in and moderate them.
• interatx 8y ago
  Maybe I missed in the article but how does a browser block cryptomining scripts? Same goes for fingerprints.
  • groovecoder 8y ago
    There are known trackers involved with non-consensual crypto-jacking, and fingerprinting. Those domains can be blocked completely.
• ssothrowaway 8y ago
  So if our SaaS service uses third-party cookies to do single sign-on, what does this mean for us? Can we apply for some kind of whitelist somewhere, or do we need to rethink how our entire product works? We aren't using third-party cookies for advertising purposes.
• throwawaysso 8y ago
  So if our SaaS service relies heavily on third-party cookies for single sign-on, how does this impact us? Is there some kind of whitelist we need to apply for, or do we need to completely rethink our product?
• euske 8y ago
  Dear Mozilla: I hope your browser have all the internal data flows accounted, i.e. how much of your cookie, location, keystrokes, files goes to each site should be presented to a user. This can be complicated due to cross-site login credentials and whatnot, but it can be visualized nicely in a graph format. This would probably require engine-related changes and affect the performance, but definitely a direction I'd like to see in future.
• QuadrupleA 8y ago
  Shameless plug - for browsers that don't yet block trackers, I have a little social sharing buttons project that cuts out all the usual cookie and http-request garbage you usually get from social icons: https://github.com/QuadrupleA/private-secure-sharing-buttons https://github.com/QuadrupleA/private-secure-sharing-buttons
• auslander 8y ago
  Right thing, but why it took that long? Safari made ITP enabled by default year ago, and upgraded it to ITP 2. https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/ https://webkit.org/blog/8311/intelligent-tracking-prevention...
• iamleppert 8y ago
  What's going to happen is they will just change their code to use postMessage or similar to facilitate the tracking. It's really not hard to persist a UUID across many different TLD's using techniques other than tracking cookies. I'm sorry but this isn't going to help motivated companies who have businesses and teams of engineers. It's just going to be some JIRA ticket that says "fix tracking for firefox users".
• KajMagnus 8y ago
  I'm developing an embedded commenting system that runs in an iframe. Each blog has cookies at `blog-name.example.com` and one gets different cookies at different blogs — there's no tracking. Still Privacy Badger and apparently iPhone believes the cookies are tracking cookies. Privacy Badger doesn't see the difference between unique cannot-track cookies on `per-blog-sub-domain.example.com` and tracking cookies on `example.com`. If you have time: How will the new Firefox browser deal with such cookies? (unique per blog cookies, different on each subdomain) Maybe I'll have to make the commenting system work completely without cookies in any case, because of iPhone and Privacy Badger.