15 ms·

Firefox to Block All 3rd Party Trackers by Default

401 points by geekybiz 8y ago

claudiojulio 8y ago
Does this mean that analytics will also be blocked? If it is true it will be a shot in the foot, because Google pays a lot of money to Mozilla. Translated automatically.
- dvh 8y ago
  All trackers are equal, but some trackers are more equal than others.
- onli 8y ago
  Firefox/Mozilla is not as reliant on Google anymore as it once was, having diversified which search engine gets set in which area. There would also still be a reason for google to be the default search engine even in a browser that blocks third party trackers by default, namely the original reason of getting users to use your search engine. So I don't see a problem here and I doubt Google would or could force Mozilla to not make that change, even though the business people in Google probably don't like it.
  - darkpuma 8y ago
    Mozilla released the extension "Facebook Container", which is great, but that's only one of the FANG companies notorious for invading privacy. Where is the "Google Container" extension from Mozilla? There exists such an extension but it's by a third party, not by Mozilla. It would be nice to see it from Mozilla since I trust them more than I trust some random extension developer; I can feel confident in recommending Facebook Container to people but I'd have to keep up on the reputation and ownership of the Google Container extension to feel good about recommending it to others. I guess what I'm saying is it would be nice for Mozilla to be a bit more bold in demonstrating this independence from Google. It seems to me they still fear/respect Google more than Facebook. https://addons.mozilla.org/en-US/firefox/addon/facebook-container/ https://addons.mozilla.org/en-US/firefox/addon/facebook-cont... https://addons.mozilla.org/en-US/firefox/addon/google-container/ https://addons.mozilla.org/en-US/firefox/addon/google-contai...
    - kasbah 8y ago
      Those container extensions are just the "Firefox Multi-Account Containers" extension developed by Mozilla with some default settings for Facebook and Google. https://github.com/mozilla/multi-account-containers https://github.com/mozilla/multi-account-containers
      - beatgammit 8y ago
        Yup, and I use it religiously. I keep my work Google account separate from my personal Google account, which is separate from everything else. If I don't trust it, it gets a separate container.
    - tialaramex 8y ago
      Putting Facebook in a box is easier for many people because they have fewer things that are connected to their Facebook. Any such things break with containerisation. Firefox spells that out, but people will be surprised anyway. Let's give a real world example. I use Facebook container. I also have YouTube premium. So, normally I don't see YouTube adverts because I'm logged into my account with Premium. But inside the Facebook container, I am an anonymous YouTube user, with no Premium account. So if a user embeds a YouTube video, it has adverts. Now, if I used the Google Container, all YouTube videos, other than on YouTube itself, would be anonymous and so have adverts. There's a lot more integration like this for Google than Facebook, and so the experience with containers is worse for Google than Facebook.
- dvfjsdhgfv 8y ago
  One of the main reasons to use Firefox these days is to be more free from the tentacles of Google. So this move is a logical step in the right direction. If you're OK with being permanently tracked by Google, you might as well use Chrome.
  - jraph 8y ago
    One might also want to use Firefox to resist against a Chrome monopoly. I do use Firefox for both reasons. The fact that I prefer it to Chrome also for convenience and practical reasons helps a lot of course.
KozmoNau7 8y ago
Will this also force Do Not Track to be on, similar to the current tracking blocklists in Firefox? That's the primary reason why I have it turned off and rely on uBlock Origin + a few other extensions.
- rbinv 8y ago
  DNT is pretty much dead because no one ever really honored it.
  - Fnoord 8y ago
    Irrelevant information to the question. Firefox right now has two options related to DNT: "Send web sites a “Do Not Track” signal that you don’t want to be tracked (_) Always (_) Only when Firefox is set to block known trackers" These two options don't become irrelevant, but the choice related to them does if the default is "block known trackers" (if that is the same as "block all 3rd party trackers by default).
  - KozmoNau7 8y ago
    And that is exactly why I would like it to not be forced on (or off). I want my browser to report no DNT setting at all, to reduce my fingerprinting profile.
    - rejberg 8y ago
      https://panopticlick.eff.org/ https://panopticlick.eff.org/ reports that 1 in 1.67 browsers send the DNT header, so the best option fingerprinting-wise might be to leave it on, at least information-wise. Of course, that ratio will likely change when Safari drops support for DNT entirely. See discussion here https://news.ycombinator.com/item?id=19101156 https://news.ycombinator.com/item?id=19101156
      - KozmoNau7 8y ago
        They send the header, but with which value? I probably didn't express myself well enough, I want my browser to send the "DNT not configured" value.
kowdermeister 8y ago
Do you use server side visitor tracking on your projects? This will probably if not already shift analytics more to the backend.
- andrethegiant 8y ago
  I'm using a self-hosted instance of Countly for a new project. It's been great so far. Still client-side, but since you host it, the domain isn't blacklisted.
wbxrs 8y ago
I think this is a bad idea. Even though I personally block 3rd party trackers by default, breaking the web by default will cause problems. Also, ad blocking will start being a problem when enough people start doing it. I still remember the days of no websites yelling at you for blocking their ads. Things are going to get much worse.
- PhantomGremlin 8y ago
  breaking the web by default will cause problems Doesn't Safari already do this (or something like this)? Safari works pretty well on most web sites. So what will Firefox be doing differently that will "break" the web?
  - currysausage 8y ago
    Yes, it’s quite complex though: https://webkit.org/blog/category/privacy/ https://webkit.org/blog/category/privacy/
- happyvalley 8y ago
  > I think this is a bad idea. Even though I personally block 3rd party trackers by default, breaking the web by default will cause problems. How is this “breaking the web”? Honest question, I would not subscribe to that sentiment, but am interested in other points of view.
  - wbxrs 8y ago
    By default, unless the user has changed his settings, if a website tells a browser to load something, the browser should do so.
    - zaarn 8y ago
      What if the website told the browser to load malware? Browsers in the modern web need to defend the user, not execute arbitrary instructions from random websites that nobody cares about.
anc84 8y ago
What is a "tracker" here? How will Firefox determine that?
- salawat 8y ago
  A tracker is a script included as part of a webpage's content, often utilizing some combination of tracking pixels (an http request for a 1x1 image file from the tracking script's providers domain), a persistent cookie, and increasingly some form of browser/device fingerprint which is used to identify a particular machine. The user's machine presents back to the tracking network the cookie and a bunch of http params to the tracking provider whilst interacting with pages that support the script, which the tracker stores in a database to sell access to. It gives developers/businesses a way to collect metrics while offloading the trouble of keeping track of and maintaining the infrastructure to do so to someone else. Firefox will probably be enforcing a cross-origin isolation constraint, requiring that all material be hosted by the domain you're requesting from in the first place, which doesn't really fix the problem since people will probably just try to build ways around the limitation. Until the industry breaks itself free of it's current fetish for wholesale data collection, it's just going to be an arms race.
  - gnud 8y ago
    Moving everything to first-party tracking could potentially solve a lot of the problems. It could reduce the across-the-entire-web tracking, categorizing and labeling of users, and instead limit analytics to useful things like "what percentage of my users are on mobile".
  - drukenemo 8y ago
    But Firefox also identify as trackers APIs - see here https://ibb.co/QFXYjhL https://ibb.co/QFXYjhL Firefox uses the Disconnect blocking list to determine what is tracking, and Disconnect doesn't only filter out cookies. https://support.mozilla.org/en-US/kb/content-blocking https://support.mozilla.org/en-US/kb/content-blocking "Disconnect Private Browsing automatically detects when your browser tries to make a connection to anything other than the site you are visiting. We call these other attempted connections “network requests" https://disconnect.me/help https://disconnect.me/help
fimdomeio 8y ago
One thing mentioned on the responses that might be really concerning is the fact that this will mean that for a lot of analytics it will look like firefox usage is close to zero. No usage data, devs caring less about firefox, users having more problems when using firefox, less users using firefox, less users having 3rd party trackers blocked, chrome monopoly growing.
- dvfjsdhgfv 8y ago
  Since when we decided it is OK to install global tracking for everybody, whether they want it or not? The User-Agent is still visible to the website I'm visiting. It's enough that a few large websites provide stats summary for their users. It is not necessary that Google, FB and co. track the entire Internet.
- traderjane 8y ago
  But you're saying here that metrics might not faithfully keep track with reality; presumably an industry that cares will simply improve their metrics until they don't care.
  - Drakim 8y ago
    In an ideal world yes, but what actually tends to happen is that the company starts to work towards improving their metric numbers at the cost of actually doing good business. I've seen this happen over and over again.
- sam_goody 8y ago
  Alternatively, it work to FF's benefit that no one can know what the real percentage of users are. There might be some positive press around "the numbers in Analytics do not reflect users on FF"
  - Jonnax 8y ago
    Nah. People making decisions don't care. Firefox usage will be reported as super low, and it won't be tested.
rbinv 8y ago
Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/ https://webkit.org/blog/8613/intelligent-tracking-prevention... ITP 2.1 also removes support for Do Not Track (as it's not honored anyway).
- hellonicksmith8 8y ago
  Why do you believe that first party cookies will be able to be re-issued/kept alive? It seems unclear if a visit within 7 days can refresh that timer
- darkpuma 8y ago
  I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.
  - senorjazz 8y ago
    I've never used umatrix and just stuck with noscript over the years due to the lengthy process of allowing scripts / domains, going through random external scripts required to make pages work that are not self-explanatory. Is there anything in umatrix to make the switch worthwhile?
    - islon 8y ago
      I use uMatrix since 2 years or so and it works out of the box for 70/80% of websites. By working I mean they are not completely broken. For the ones that don't work it's normally 1 or 2 clicks in the UI to allow some 3rd parties and save it. Sometimes a site works by default in the "broken" state but as soon as I give it more permissions it breaks by adding a paywall or some modal window. uMatrix is like linux: it requires more work upfront but give you more control and customization options.
traderjane 8y ago
Firefox's Container's approach has been quite interesting to use, but if a suggestion could get out to the Firefox team, I would advise improved streamlining of workflow for the extension, including with sync and returning browser setup, and for organizing and setting up new containers (configuring them to always open for a domain, putting them in folders).
- fxfan 8y ago
  Containers have some great add-ons built around them, have you taken a look? I agree with your point completely though- needs to be a front and center feature. I'd like to add something else- firefox should ship a 'power user' edition. Comes pre-installed with uBlock origin/uMatrix/temporary containers/sidebar tabs/greasemonkey/Tridactyl (sorry emacs users ;)
  - stunt 8y ago
    > firefox should ship a 'power user' edition If you have Firefox-Sync enabled. You will get all your extensions anyway. so it is a one time setup for all those extensions that you need. First time hearing Tridactyl! I'm using Vimium. Does it have any advantage over Vimium?
    - fxfan 8y ago
      Sorry never used it but one advantage of tridactyl is that the creator lurks here and is extremely responsive and kind. I will tell you what 3-fin can and can't do- Can: Js, key bindings, can show alpha and numeric hints. In numeric mode, behaves like vimp- type char of link text. ;; for link info. ; for hover. C-d/C-f et al work. H, L navigate history. Edit in vim. C-i Cannot: Self limitation - No way to stop page load I think. Very painful :) No shortcut for search. No readline bindings in text editing regions. Webext limitation- takes a while to load. That's all I use right now.
      - bovine3dom 8y ago
        You can stop page load with `stop`, bound to x, provided that the page has loaded enough for Tridactyl to be running. Search - we actually have our own find mode now. Instructions on how to set it up are on the changelog. The default Firefox one has find next / previous bound to Ctrl-G / Ctrl-Shift-G. You can add readline binds to text regions if you want. It's mentioned and linked to on the help page somewhere near the top.
tannhaeuser 8y ago
Good. They should've done this ten years ago. However, I don't know how it'll play out in the long run. FF is already on the radar of ad-driven sites, including those that just need basic unique visitor counters verified by third parties rather than doing evil privacy invasion things. So they could decide to boycot FF alltogether. I hope this isn't going to happen, though. Anyone in the ad-driven content business here to share their opinion? Or should we go back to pixels?
moltar 8y ago
They should be careful because some sites do break without tracking.
- Simon_says 8y ago
  Who is 'they' in that sentence?
  - bashwizard 8y ago
    His/her company.
  - playpause 8y ago
    Mozilla?
    - Simon_says 8y ago
      I figured 'they' refers to website developers.
ypolito 8y ago
It's a huge step forward. Does it block Google Ads too? If so, ad companies should consider some kind of functionality to proxy the advertisements through the partners' websites. I've seen ublock struggle with Server Side Ads Injection.
mosselman 8y ago
My work laptop is a very fast upper end macbook and I can somewhat reliably run Firefox on that. My personal laptop is an older macbook pro retina model and whenever I use firefox on that it gets incredibly slow and from time to time the computer just freezes for 20-40 seconds. So, sadly, I can't use firefox on that. At one point someone on HN posted a link to the bug report on mozilla's bug tracker about this issue with retina macbooks. Does anyone have that link? I can't find it.
- arusahni 8y ago
  Is this it? https://bugzilla.mozilla.org/show_bug.cgi?id=1404042 https://bugzilla.mozilla.org/show_bug.cgi?id=1404042
  - mosselman 8y ago
    Yes that seems to be it! Thank you. Always good to not be alone when experiencing such problems.
- isostatic 8y ago
  I've got a bottom of the line 2013 macbook air. I closed everything down earlier to update to mojave, and firefox told me it would close 7 windows and 71 tabs. Never had a problem with it. My main desktop is an ubuntu 16.04 machine with 16GB of memory and I've never had a slowdown, often get upto the 100+ tab range across different windows.
  - mosselman 8y ago
    The MacBook Air doesn’t have a retina screen, it appears to be related to that. I also use ff on Ubuntu without issues.
- anthony_doan 8y ago
  I'm currently surfing on a "MacBook Pro (Retina, 15-inch, Late 2013)". It works fine with 4 window opened (1 private, 2 with ~20 tabs, main one with at least 50 tabs). I'm also running 10+ extensions. Works pretty well for me. Sometime after awhile the video playback goes wonky though. I end up doing `sudo killall firefox`.
playpause 8y ago
Why now, as opposed to several years ago? Are there downsides to blocking 3rd party trackers by default, and if so, what has changed recently to allow this to happen now?
- SimeVidas 8y ago
  Sites use third parties to provide various functionality. If you block them, the site can appear partially broken. I assume Mozilla has been testing and working on minimizing breakage.
- MivLives 8y ago
  I have 3rd party cookie blocking on Chrome. Honestly the two things I've noticed are: - I have to fill out recaptcha. A lot. - I've been applying for jobs, some companies have a button for linked in auto fill. Sometimes this works sometimes it doesn't Beyond that there's a few other thing like, wikidot, that don't really work. In this case the cookie is given by wikidot for sign in, then you're redirected to the custom url wikidot instance (Scp foundation in this case) and you're just not logged in until you allow cookies in this case.
slasaus 8y ago
I think this is huge. It reminds me of the early days of Firefox (back then still known as Phoenix) in a world where IE6 and pop-up ads dominated. At launch IE6 was really the best and most innovative browser of it's time (IMHO). But after IE6 had beaten Netscape, Microsoft stopped putting money in IE development and the situation got worse over time. It was Phoenix with, among other things, a pop-up blocker that was on by default that brought down Internet Explorers hegemony. Today, with Chrome being dominant the situation is different because Google is still innovating Chrome at light speed. The one and only Achilles heel to beat this giant is by attacking their business model, which is to enable ad blocking by default. I expect this is something people want, just like pop-up blockers back in the days. Google will never be able to lead, or even follow in this direction without changing their business model. Unfortunately, Mozilla’s own business model also heavily relies on selling ads, albeit indirectly. According to this statement from an independent audit report[1]: "Note 10 - Concentrations of Risk: Mozilla has entered into contracts with search engine providers for royalties which expire through November 2020. Approximately 93% and 94% of Mozilla’s royalty revenues were derived from these contracts for 2017 and 2016, respectively, with receivables from these contracts representing approximately 75% and 79% of the December 31, 2017 and 2016 outstanding receivables." In other words, $539 Million, which is 93% of their total revenue, comes from companies that have selling ads as their business model (Baidu, Google, Yahoo and Yandex [2]). I really hope Mozilla will be able to change this revenue stream to better align with their mission[3]. They have been trying to diversify their revenue since 2014 [4] and although they might not be as dependent on Google as they once were, they're still almost fully dependent on ads. Oh, and yeah, of course simply making a better browser than Chrome would also help ;) Background: * https://www.mozilla.org/en-US/foundation/annualreport/2017/ https://www.mozilla.org/en-US/foundation/annualreport/2017/ * https://assets.mozilla.net/annualreport/2017/mozilla-2017-form-990.pdf https://assets.mozilla.net/annualreport/2017/mozilla-2017-fo... [1] https://assets.mozilla.net/annualreport/2017/mozilla-fdn-2017-fs-short-form-final-0927.pdf https://assets.mozilla.net/annualreport/2017/mozilla-fdn-201... [2] https://wiki.mozilla.org/Global_Search_Strategy_Status https://wiki.mozilla.org/Global_Search_Strategy_Status [3] https://www.mozilla.org/en-US/mission/ https://www.mozilla.org/en-US/mission/ "An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent." [4] https://blog.mozilla.org/advancingcontent/2014/02/11/publisher-transformation-with-users-at-the-center/ https://blog.mozilla.org/advancingcontent/2014/02/11/publish...
cphoover 8y ago
How do you prevent Iframes from communicating their cookies to the parent window? Using window.postMessage? Disable all cookies for iframes? That seems like it would break the internet.
- andrethegiant 8y ago
  If you're the parent, you can use the `sandbox` attribute on the frame. If you're the child, you can use the `frame-ancestors` CSP directive.
  - cphoover 8y ago
    "If you're the parent, you can use the `sandbox` attribute on the frame. If you're the child, you can use the `frame-ancestors` CSP directive." ... Yea but that requires the parent frame not to want the tracking to take place right? Why would they put the iframe in sandbox mode if they were trying to track their users?
Proven 8y ago
Except Mozilla's own, I presume? We already found a way and it's called community patches for FF.
kerng 8y ago
I like this!

401 points by geekybiz 8y ago

Does this mean that analytics will also be blocked? If it is true it will be a shot in the foot, because Google pays a lot of money to Mozilla. Translated automatically.

dvh 8y ago
All trackers are equal, but some trackers are more equal than others.
onli 8y ago
Firefox/Mozilla is not as reliant on Google anymore as it once was, having diversified which search engine gets set in which area. There would also still be a reason for google to be the default search engine even in a browser that blocks third party trackers by default, namely the original reason of getting users to use your search engine. So I don't see a problem here and I doubt Google would or could force Mozilla to not make that change, even though the business people in Google probably don't like it.
- darkpuma 8y ago
  Mozilla released the extension "Facebook Container", which is great, but that's only one of the FANG companies notorious for invading privacy. Where is the "Google Container" extension from Mozilla? There exists such an extension but it's by a third party, not by Mozilla. It would be nice to see it from Mozilla since I trust them more than I trust some random extension developer; I can feel confident in recommending Facebook Container to people but I'd have to keep up on the reputation and ownership of the Google Container extension to feel good about recommending it to others. I guess what I'm saying is it would be nice for Mozilla to be a bit more bold in demonstrating this independence from Google. It seems to me they still fear/respect Google more than Facebook. https://addons.mozilla.org/en-US/firefox/addon/facebook-container/ https://addons.mozilla.org/en-US/firefox/addon/facebook-cont... https://addons.mozilla.org/en-US/firefox/addon/google-container/ https://addons.mozilla.org/en-US/firefox/addon/google-contai...
  - kasbah 8y ago
    Those container extensions are just the "Firefox Multi-Account Containers" extension developed by Mozilla with some default settings for Facebook and Google. https://github.com/mozilla/multi-account-containers https://github.com/mozilla/multi-account-containers
    - beatgammit 8y ago
      Yup, and I use it religiously. I keep my work Google account separate from my personal Google account, which is separate from everything else. If I don't trust it, it gets a separate container.
  - tialaramex 8y ago
    Putting Facebook in a box is easier for many people because they have fewer things that are connected to their Facebook. Any such things break with containerisation. Firefox spells that out, but people will be surprised anyway. Let's give a real world example. I use Facebook container. I also have YouTube premium. So, normally I don't see YouTube adverts because I'm logged into my account with Premium. But inside the Facebook container, I am an anonymous YouTube user, with no Premium account. So if a user embeds a YouTube video, it has adverts. Now, if I used the Google Container, all YouTube videos, other than on YouTube itself, would be anonymous and so have adverts. There's a lot more integration like this for Google than Facebook, and so the experience with containers is worse for Google than Facebook.
dvfjsdhgfv 8y ago
One of the main reasons to use Firefox these days is to be more free from the tentacles of Google. So this move is a logical step in the right direction. If you're OK with being permanently tracked by Google, you might as well use Chrome.
- jraph 8y ago
  One might also want to use Firefox to resist against a Chrome monopoly. I do use Firefox for both reasons. The fact that I prefer it to Chrome also for convenience and practical reasons helps a lot of course.

KozmoNau7 8y ago

Will this also force Do Not Track to be on, similar to the current tracking blocklists in Firefox? That's the primary reason why I have it turned off and rely on uBlock Origin + a few other extensions.

rbinv 8y ago
DNT is pretty much dead because no one ever really honored it.
- Fnoord 8y ago
  Irrelevant information to the question. Firefox right now has two options related to DNT: "Send web sites a “Do Not Track” signal that you don’t want to be tracked (_) Always (_) Only when Firefox is set to block known trackers" These two options don't become irrelevant, but the choice related to them does if the default is "block known trackers" (if that is the same as "block all 3rd party trackers by default).
- KozmoNau7 8y ago
  And that is exactly why I would like it to not be forced on (or off). I want my browser to report no DNT setting at all, to reduce my fingerprinting profile.
  - rejberg 8y ago
    https://panopticlick.eff.org/ https://panopticlick.eff.org/ reports that 1 in 1.67 browsers send the DNT header, so the best option fingerprinting-wise might be to leave it on, at least information-wise. Of course, that ratio will likely change when Safari drops support for DNT entirely. See discussion here https://news.ycombinator.com/item?id=19101156 https://news.ycombinator.com/item?id=19101156
    - KozmoNau7 8y ago
      They send the header, but with which value? I probably didn't express myself well enough, I want my browser to send the "DNT not configured" value.

kowdermeister 8y ago

Do you use server side visitor tracking on your projects? This will probably if not already shift analytics more to the backend.

andrethegiant 8y ago
I'm using a self-hosted instance of Countly for a new project. It's been great so far. Still client-side, but since you host it, the domain isn't blacklisted.

wbxrs 8y ago

I think this is a bad idea. Even though I personally block 3rd party trackers by default, breaking the web by default will cause problems. Also, ad blocking will start being a problem when enough people start doing it. I still remember the days of no websites yelling at you for blocking their ads. Things are going to get much worse.

PhantomGremlin 8y ago
breaking the web by default will cause problems Doesn't Safari already do this (or something like this)? Safari works pretty well on most web sites. So what will Firefox be doing differently that will "break" the web?
- currysausage 8y ago
  Yes, it’s quite complex though: https://webkit.org/blog/category/privacy/ https://webkit.org/blog/category/privacy/
happyvalley 8y ago
> I think this is a bad idea. Even though I personally block 3rd party trackers by default, breaking the web by default will cause problems. How is this “breaking the web”? Honest question, I would not subscribe to that sentiment, but am interested in other points of view.
- wbxrs 8y ago
  By default, unless the user has changed his settings, if a website tells a browser to load something, the browser should do so.
  - zaarn 8y ago
    What if the website told the browser to load malware? Browsers in the modern web need to defend the user, not execute arbitrary instructions from random websites that nobody cares about.

anc84 8y ago

What is a "tracker" here? How will Firefox determine that?

salawat 8y ago
A tracker is a script included as part of a webpage's content, often utilizing some combination of tracking pixels (an http request for a 1x1 image file from the tracking script's providers domain), a persistent cookie, and increasingly some form of browser/device fingerprint which is used to identify a particular machine. The user's machine presents back to the tracking network the cookie and a bunch of http params to the tracking provider whilst interacting with pages that support the script, which the tracker stores in a database to sell access to. It gives developers/businesses a way to collect metrics while offloading the trouble of keeping track of and maintaining the infrastructure to do so to someone else. Firefox will probably be enforcing a cross-origin isolation constraint, requiring that all material be hosted by the domain you're requesting from in the first place, which doesn't really fix the problem since people will probably just try to build ways around the limitation. Until the industry breaks itself free of it's current fetish for wholesale data collection, it's just going to be an arms race.
- gnud 8y ago
  Moving everything to first-party tracking could potentially solve a lot of the problems. It could reduce the across-the-entire-web tracking, categorizing and labeling of users, and instead limit analytics to useful things like "what percentage of my users are on mobile".
- drukenemo 8y ago
  But Firefox also identify as trackers APIs - see here https://ibb.co/QFXYjhL https://ibb.co/QFXYjhL Firefox uses the Disconnect blocking list to determine what is tracking, and Disconnect doesn't only filter out cookies. https://support.mozilla.org/en-US/kb/content-blocking https://support.mozilla.org/en-US/kb/content-blocking "Disconnect Private Browsing automatically detects when your browser tries to make a connection to anything other than the site you are visiting. We call these other attempted connections “network requests" https://disconnect.me/help https://disconnect.me/help

fimdomeio 8y ago

One thing mentioned on the responses that might be really concerning is the fact that this will mean that for a lot of analytics it will look like firefox usage is close to zero. No usage data, devs caring less about firefox, users having more problems when using firefox, less users using firefox, less users having 3rd party trackers blocked, chrome monopoly growing.

dvfjsdhgfv 8y ago
Since when we decided it is OK to install global tracking for everybody, whether they want it or not? The User-Agent is still visible to the website I'm visiting. It's enough that a few large websites provide stats summary for their users. It is not necessary that Google, FB and co. track the entire Internet.
traderjane 8y ago
But you're saying here that metrics might not faithfully keep track with reality; presumably an industry that cares will simply improve their metrics until they don't care.
- Drakim 8y ago
  In an ideal world yes, but what actually tends to happen is that the company starts to work towards improving their metric numbers at the cost of actually doing good business. I've seen this happen over and over again.
sam_goody 8y ago
Alternatively, it work to FF's benefit that no one can know what the real percentage of users are. There might be some positive press around "the numbers in Analytics do not reflect users on FF"
- Jonnax 8y ago
  Nah. People making decisions don't care. Firefox usage will be reported as super low, and it won't be tested.

rbinv 8y ago

Companies have begun switching tracking tech to first-party cookies (where possible) since Apple's introduction of "Intelligent Tracking Protection," so Mozilla's similar move probably won't have that much of an impact either. Apple has responded with ITP 2.1, though, limiting _all_ (persistent) cookie lifetime to 7 days, although these could probably be accurately re-issued/kept alive in my opinion: https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/ https://webkit.org/blog/8613/intelligent-tracking-prevention... ITP 2.1 also removes support for Do Not Track (as it's not honored anyway).

hellonicksmith8 8y ago
Why do you believe that first party cookies will be able to be re-issued/kept alive? It seems unclear if a visit within 7 days can refresh that timer
darkpuma 8y ago
I, and probably many other users, have begun blocking all first-party cookies by default. I only permit it on sites I sign into and want to remember me, which are very few. If Mozilla wants to make a real difference, they'd study uMatrix and figure out how to create UX that would give that degree of flexibility and power to non-technical users.
- senorjazz 8y ago
  I've never used umatrix and just stuck with noscript over the years due to the lengthy process of allowing scripts / domains, going through random external scripts required to make pages work that are not self-explanatory. Is there anything in umatrix to make the switch worthwhile?
  - islon 8y ago
    I use uMatrix since 2 years or so and it works out of the box for 70/80% of websites. By working I mean they are not completely broken. For the ones that don't work it's normally 1 or 2 clicks in the UI to allow some 3rd parties and save it. Sometimes a site works by default in the "broken" state but as soon as I give it more permissions it breaks by adding a paywall or some modal window. uMatrix is like linux: it requires more work upfront but give you more control and customization options.

traderjane 8y ago

Firefox's Container's approach has been quite interesting to use, but if a suggestion could get out to the Firefox team, I would advise improved streamlining of workflow for the extension, including with sync and returning browser setup, and for organizing and setting up new containers (configuring them to always open for a domain, putting them in folders).

fxfan 8y ago
Containers have some great add-ons built around them, have you taken a look? I agree with your point completely though- needs to be a front and center feature. I'd like to add something else- firefox should ship a 'power user' edition. Comes pre-installed with uBlock origin/uMatrix/temporary containers/sidebar tabs/greasemonkey/Tridactyl (sorry emacs users ;)
- stunt 8y ago
  > firefox should ship a 'power user' edition If you have Firefox-Sync enabled. You will get all your extensions anyway. so it is a one time setup for all those extensions that you need. First time hearing Tridactyl! I'm using Vimium. Does it have any advantage over Vimium?
  - fxfan 8y ago
    Sorry never used it but one advantage of tridactyl is that the creator lurks here and is extremely responsive and kind. I will tell you what 3-fin can and can't do- Can: Js, key bindings, can show alpha and numeric hints. In numeric mode, behaves like vimp- type char of link text. ;; for link info. ; for hover. C-d/C-f et al work. H, L navigate history. Edit in vim. C-i Cannot: Self limitation - No way to stop page load I think. Very painful :) No shortcut for search. No readline bindings in text editing regions. Webext limitation- takes a while to load. That's all I use right now.
    - bovine3dom 8y ago
      You can stop page load with `stop`, bound to x, provided that the page has loaded enough for Tridactyl to be running. Search - we actually have our own find mode now. Instructions on how to set it up are on the changelog. The default Firefox one has find next / previous bound to Ctrl-G / Ctrl-Shift-G. You can add readline binds to text regions if you want. It's mentioned and linked to on the help page somewhere near the top.

tannhaeuser 8y ago

Good. They should've done this ten years ago. However, I don't know how it'll play out in the long run. FF is already on the radar of ad-driven sites, including those that just need basic unique visitor counters verified by third parties rather than doing evil privacy invasion things. So they could decide to boycot FF alltogether. I hope this isn't going to happen, though. Anyone in the ad-driven content business here to share their opinion? Or should we go back to pixels?

moltar 8y ago

They should be careful because some sites do break without tracking.

Simon_says 8y ago
Who is 'they' in that sentence?
- bashwizard 8y ago
  His/her company.
- playpause 8y ago
  Mozilla?
  - Simon_says 8y ago
    I figured 'they' refers to website developers.

ypolito 8y ago

It's a huge step forward. Does it block Google Ads too? If so, ad companies should consider some kind of functionality to proxy the advertisements through the partners' websites. I've seen ublock struggle with Server Side Ads Injection.

mosselman 8y ago

My work laptop is a very fast upper end macbook and I can somewhat reliably run Firefox on that. My personal laptop is an older macbook pro retina model and whenever I use firefox on that it gets incredibly slow and from time to time the computer just freezes for 20-40 seconds. So, sadly, I can't use firefox on that. At one point someone on HN posted a link to the bug report on mozilla's bug tracker about this issue with retina macbooks. Does anyone have that link? I can't find it.

arusahni 8y ago
Is this it? https://bugzilla.mozilla.org/show_bug.cgi?id=1404042 https://bugzilla.mozilla.org/show_bug.cgi?id=1404042
- mosselman 8y ago
  Yes that seems to be it! Thank you. Always good to not be alone when experiencing such problems.
isostatic 8y ago
I've got a bottom of the line 2013 macbook air. I closed everything down earlier to update to mojave, and firefox told me it would close 7 windows and 71 tabs. Never had a problem with it. My main desktop is an ubuntu 16.04 machine with 16GB of memory and I've never had a slowdown, often get upto the 100+ tab range across different windows.
- mosselman 8y ago
  The MacBook Air doesn’t have a retina screen, it appears to be related to that. I also use ff on Ubuntu without issues.
anthony_doan 8y ago
I'm currently surfing on a "MacBook Pro (Retina, 15-inch, Late 2013)". It works fine with 4 window opened (1 private, 2 with ~20 tabs, main one with at least 50 tabs). I'm also running 10+ extensions. Works pretty well for me. Sometime after awhile the video playback goes wonky though. I end up doing `sudo killall firefox`.

playpause 8y ago

Why now, as opposed to several years ago? Are there downsides to blocking 3rd party trackers by default, and if so, what has changed recently to allow this to happen now?

SimeVidas 8y ago
Sites use third parties to provide various functionality. If you block them, the site can appear partially broken. I assume Mozilla has been testing and working on minimizing breakage.
MivLives 8y ago
I have 3rd party cookie blocking on Chrome. Honestly the two things I've noticed are: - I have to fill out recaptcha. A lot. - I've been applying for jobs, some companies have a button for linked in auto fill. Sometimes this works sometimes it doesn't Beyond that there's a few other thing like, wikidot, that don't really work. In this case the cookie is given by wikidot for sign in, then you're redirected to the custom url wikidot instance (Scp foundation in this case) and you're just not logged in until you allow cookies in this case.

slasaus 8y ago

I think this is huge. It reminds me of the early days of Firefox (back then still known as Phoenix) in a world where IE6 and pop-up ads dominated. At launch IE6 was really the best and most innovative browser of it's time (IMHO). But after IE6 had beaten Netscape, Microsoft stopped putting money in IE development and the situation got worse over time. It was Phoenix with, among other things, a pop-up blocker that was on by default that brought down Internet Explorers hegemony. Today, with Chrome being dominant the situation is different because Google is still innovating Chrome at light speed. The one and only Achilles heel to beat this giant is by attacking their business model, which is to enable ad blocking by default. I expect this is something people want, just like pop-up blockers back in the days. Google will never be able to lead, or even follow in this direction without changing their business model. Unfortunately, Mozilla’s own business model also heavily relies on selling ads, albeit indirectly. According to this statement from an independent audit report[1]: "Note 10 - Concentrations of Risk: Mozilla has entered into contracts with search engine providers for royalties which expire through November 2020. Approximately 93% and 94% of Mozilla’s royalty revenues were derived from these contracts for 2017 and 2016, respectively, with receivables from these contracts representing approximately 75% and 79% of the December 31, 2017 and 2016 outstanding receivables." In other words, $539 Million, which is 93% of their total revenue, comes from companies that have selling ads as their business model (Baidu, Google, Yahoo and Yandex [2]). I really hope Mozilla will be able to change this revenue stream to better align with their mission[3]. They have been trying to diversify their revenue since 2014 [4] and although they might not be as dependent on Google as they once were, they're still almost fully dependent on ads. Oh, and yeah, of course simply making a better browser than Chrome would also help ;) Background: * https://www.mozilla.org/en-US/foundation/annualreport/2017/ https://www.mozilla.org/en-US/foundation/annualreport/2017/ * https://assets.mozilla.net/annualreport/2017/mozilla-2017-form-990.pdf https://assets.mozilla.net/annualreport/2017/mozilla-2017-fo... [1] https://assets.mozilla.net/annualreport/2017/mozilla-fdn-2017-fs-short-form-final-0927.pdf https://assets.mozilla.net/annualreport/2017/mozilla-fdn-201... [2] https://wiki.mozilla.org/Global_Search_Strategy_Status https://wiki.mozilla.org/Global_Search_Strategy_Status [3] https://www.mozilla.org/en-US/mission/ https://www.mozilla.org/en-US/mission/ "An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent." [4] https://blog.mozilla.org/advancingcontent/2014/02/11/publisher-transformation-with-users-at-the-center/ https://blog.mozilla.org/advancingcontent/2014/02/11/publish...

cphoover 8y ago

How do you prevent Iframes from communicating their cookies to the parent window? Using window.postMessage? Disable all cookies for iframes? That seems like it would break the internet.

andrethegiant 8y ago
If you're the parent, you can use the `sandbox` attribute on the frame. If you're the child, you can use the `frame-ancestors` CSP directive.
- cphoover 8y ago
  "If you're the parent, you can use the `sandbox` attribute on the frame. If you're the child, you can use the `frame-ancestors` CSP directive." ... Yea but that requires the parent frame not to want the tracking to take place right? Why would they put the iframe in sandbox mode if they were trying to track their users?

Proven 8y ago

Except Mozilla's own, I presume? We already found a way and it's called community patches for FF.

kerng 8y ago

I like this!