10 ms·

This step is overdue and i applaud Mozilla for doing it. But: Why doesn‘t Firefox block all 3rd party cookies by default? That would be a huge win for privacy.

by Tepix 7y ago

This step is overdue and i applaud Mozilla for doing it. But: Why doesn‘t Firefox block all 3rd party cookies by default? That would be a huge win for privacy. Yes, some sites would break. But if Apple can do it with Safari, Mozilla can do it with Firefox. Be brave! Do it!

ignoranceprior 7y ago
[comment retracted]
- Tepix 7y ago
  It‘s just cookies recognized to be tracking cookies, isn‘t it? These companies are earning money by tracking you. They have a strong incentive to bypass these mechanisms.
  - ignoranceprior 7y ago
    Oh, hmm, it looks like you're right ("known third party trackers"). That's what I get for headline reading.
- lucb1e 7y ago
  (Maybe put "Edit:" in your message, for a minute I thought this was your reply, implying that the parent comment should retract their statement or something, but given the replies to your comment, I'm guessing you want to indicate that you changed your mind.)
folkrav 7y ago
I get what you mean and yes, it would definitely be a good move in terms of showing the way to sane defaults, however I would have a hard time calling it a "huge win" considering Firefox + Safari make up <20% market share. Maybe I'm just being cynical.
- deleted 7y ago
  [deleted]
- Tepix 7y ago
  Well, i guess i meant a huge win for Firefox users who use default settings.
  - folkrav 7y ago
    Seems like they're in for a treat then : https://www.bloomberg.com/news/articles/2019-06-04/firefox-follows-apple-in-blocking-third-party-cookies-online https://www.bloomberg.com/news/articles/2019-06-04/firefox-f...
discreditable 7y ago
As of right now their UI to allow third-party cookies is pretty bad. Chrome shows an icon in the address bar for it. In Nightly there is a section in tracking prevention, but it's not in normal Firefox yet.
dvfjsdhgfv 7y ago
Well, there is a real danger the web would split into two groups: those who care about privacy and use Firefox - so are a threat to several business models that are en vogue in SV right now, and those who use Chrome and are therefore better candidates for milking. Website owners would do everything to discourage people from using their websites with Firefox. Instead of seeing your favorite website in Firefox, you would see "Welcome to Oath family" or similar bullshit.
- gregknicholson 7y ago
  s/Firefox/Europe/g and this is already happening. I suspect we're just training people to click the Whatever button. As that's most “normal” people's response (I am not normal), the courts will eventually rule that a first-use roadblock doesn't produce informed consent, so doesn't excuse you under the GDPR. Hopefully, then, websites will stop performing a superficial impression of caring about privacy. (Explicit informed consent is the GDPR's last-resort excuse, which you only need if your use of personal data falls outside all of the GDPR's automatically-acceptable justifications for using and storing personal data.)
cpeterso 7y ago
> Yes, some sites would break. But if Apple can do it with Safari, Mozilla can do it with Firefox. Safari has enough market share that web developers must work within Apple's guidelines if they want their websites to work on iOS.
- SamuelAdams 7y ago
  Plus users do not have an alternative, at least on iOS. They all pass through webkit. On a desktop, if Firefox breaks, people will just switch to Chrome or something else. Plenty of people want things to "just work" out of the box. Maybe the better solution is to have a guided install process. When installing firefox, ask the user if they want it to "just work" or be "privacy conscious"? Warn them of the tradeoffs of both and let them decide once.
user17843 7y ago
Good question. It would have made everything so much easier. How much work was done on this selective cookie blocking implementation? Personally I always hoped they would simply copy Privacy Badger and develop an algorithm, instead of relying on a black list.
yholio 7y ago
I strongly agree. There is no legitimate functionality that can't be implemented without 3rd party cookies. Some sites will break at first until they are fixed, and we could have a whitelist for a while, while making it very cumbersome to be added to that list. New sites would simply need to workaround the lack of 3rd party cookies and accept that user tracking is technically illegal. The surveillance internet is something that was allowed to evolve by a lack of foresight from the standard authors in their desire to build a rich web. We should put an end to it as soon as possible. The browser should not leak unique identifiers in any situation and all standard browsers should be as finger-print resistant as the Tor Browser. In my view, if you leak data that is critical to the privacy of the user, it's as bad if not worse than an improper implementation of TLS. It takes only two, modestly skilled, collaborating webadmins (one site "shameful" and one used with authentication) to possibly destroy a person's life, reputation and family. A practical attack on SSL2.0 is orders of magnitude more difficult. Let's put responsibility for privacy back where it should be: on the browsers and web standard authors.
- svieira 7y ago
  I'm genuinely curious about your assertion. Let's say I have an application for my business and I want to embedded a report on one of my pages from a separate application. This other application is a SaaS application, so I can't just "mount" it at mydomain/some-sub-path. How do I have secure reports without third-party cookies? Store cookie-like stateless tokens in my wrapping app and send them in the URL?
  - a1369209993 7y ago
    Assuming I'm understanding your question correctly, yes, you would have something like: <iframe src="https://saasapp.com/report?url= https://mydomain.com/data/1234.json%3F v%3D42%26auth%3D__79_Pv6-fj39vX08_Lx8A++"/> (spaces added for readability)
    - tetraca 7y ago
      Cool, if third party tracking cookies are "defeated", this will be the next step in the arms race.
ianbicking 7y ago
When sites break, people leave Firefox. No amount of explaining or media changes that: the number one (by far) reason people leave a browser is because a site is broken.
- smacktoward 7y ago
  Yes, this. Anyone who was around for the launch of Windows Vista could see this effect in action. Vista's added security measures like UAC (https://en.wikipedia.org/wiki/User_Account_Control https://en.wikipedia.org/wiki/User_Account_Control) broke a lot of poorly coded Windows applications that didn't bother to follow the rules of the platform. Who did the users blame when those apps broke? Microsoft. Why? "It worked fine until I upgraded to Vista!" Sigh.
  - fwip 7y ago
    Further evidence: Windows 7 wasn't even that much of a change from Vista. The main differences were 1) software had adjusted to deal with UAC and 2) new laptops were more powerful. But most of the good new architectural features had premiered with Vista. I think they did improve the UAC situation with Vista SP1, if memory serves.
    - autoexec 7y ago
      MS changed UAC for windows 7 so much in an effort to stop annoying window's users that people complained that defeated the point https://www.networkworld.com/article/2253987/microsoft--neutered--uac-in-windows-7--says-researcher.html https://www.networkworld.com/article/2253987/microsoft--neut...
      - TazeTSchnitzel 7y ago
        The main UAC change in Windows 7 was just that it didn't pop up for changing of settings. But UAC on settings wasn't the problem (in fact, macOS basically has this and it's a non-issue), UAC on legacy Windows apps only tested on Windows 9x or on administrator accounts on NT systems was.
bzbarsky 7y ago
Safari does not block all 3rd party cookies by default last I checked. It does something a lot more complicated that still allows 3rd party cookies in various cases.

by Tepix 7y ago

ignoranceprior 7y ago

[comment retracted]

Tepix 7y ago
It‘s just cookies recognized to be tracking cookies, isn‘t it? These companies are earning money by tracking you. They have a strong incentive to bypass these mechanisms.
- ignoranceprior 7y ago
  Oh, hmm, it looks like you're right ("known third party trackers"). That's what I get for headline reading.
lucb1e 7y ago
(Maybe put "Edit:" in your message, for a minute I thought this was your reply, implying that the parent comment should retract their statement or something, but given the replies to your comment, I'm guessing you want to indicate that you changed your mind.)

folkrav 7y ago

I get what you mean and yes, it would definitely be a good move in terms of showing the way to sane defaults, however I would have a hard time calling it a "huge win" considering Firefox + Safari make up <20% market share. Maybe I'm just being cynical.

deleted 7y ago
[deleted]
Tepix 7y ago
Well, i guess i meant a huge win for Firefox users who use default settings.
- folkrav 7y ago
  Seems like they're in for a treat then : https://www.bloomberg.com/news/articles/2019-06-04/firefox-follows-apple-in-blocking-third-party-cookies-online https://www.bloomberg.com/news/articles/2019-06-04/firefox-f...

discreditable 7y ago

As of right now their UI to allow third-party cookies is pretty bad. Chrome shows an icon in the address bar for it. In Nightly there is a section in tracking prevention, but it's not in normal Firefox yet.

dvfjsdhgfv 7y ago

Well, there is a real danger the web would split into two groups: those who care about privacy and use Firefox - so are a threat to several business models that are en vogue in SV right now, and those who use Chrome and are therefore better candidates for milking. Website owners would do everything to discourage people from using their websites with Firefox. Instead of seeing your favorite website in Firefox, you would see "Welcome to Oath family" or similar bullshit.

gregknicholson 7y ago
s/Firefox/Europe/g and this is already happening. I suspect we're just training people to click the Whatever button. As that's most “normal” people's response (I am not normal), the courts will eventually rule that a first-use roadblock doesn't produce informed consent, so doesn't excuse you under the GDPR. Hopefully, then, websites will stop performing a superficial impression of caring about privacy. (Explicit informed consent is the GDPR's last-resort excuse, which you only need if your use of personal data falls outside all of the GDPR's automatically-acceptable justifications for using and storing personal data.)

cpeterso 7y ago

> Yes, some sites would break. But if Apple can do it with Safari, Mozilla can do it with Firefox. Safari has enough market share that web developers must work within Apple's guidelines if they want their websites to work on iOS.

SamuelAdams 7y ago
Plus users do not have an alternative, at least on iOS. They all pass through webkit. On a desktop, if Firefox breaks, people will just switch to Chrome or something else. Plenty of people want things to "just work" out of the box. Maybe the better solution is to have a guided install process. When installing firefox, ask the user if they want it to "just work" or be "privacy conscious"? Warn them of the tradeoffs of both and let them decide once.

user17843 7y ago

Good question. It would have made everything so much easier. How much work was done on this selective cookie blocking implementation? Personally I always hoped they would simply copy Privacy Badger and develop an algorithm, instead of relying on a black list.

yholio 7y ago

I strongly agree. There is no legitimate functionality that can't be implemented without 3rd party cookies. Some sites will break at first until they are fixed, and we could have a whitelist for a while, while making it very cumbersome to be added to that list. New sites would simply need to workaround the lack of 3rd party cookies and accept that user tracking is technically illegal. The surveillance internet is something that was allowed to evolve by a lack of foresight from the standard authors in their desire to build a rich web. We should put an end to it as soon as possible. The browser should not leak unique identifiers in any situation and all standard browsers should be as finger-print resistant as the Tor Browser. In my view, if you leak data that is critical to the privacy of the user, it's as bad if not worse than an improper implementation of TLS. It takes only two, modestly skilled, collaborating webadmins (one site "shameful" and one used with authentication) to possibly destroy a person's life, reputation and family. A practical attack on SSL2.0 is orders of magnitude more difficult. Let's put responsibility for privacy back where it should be: on the browsers and web standard authors.

svieira 7y ago
I'm genuinely curious about your assertion. Let's say I have an application for my business and I want to embedded a report on one of my pages from a separate application. This other application is a SaaS application, so I can't just "mount" it at mydomain/some-sub-path. How do I have secure reports without third-party cookies? Store cookie-like stateless tokens in my wrapping app and send them in the URL?
- a1369209993 7y ago
  Assuming I'm understanding your question correctly, yes, you would have something like: <iframe src="https://saasapp.com/report?url= https://mydomain.com/data/1234.json%3F v%3D42%26auth%3D__79_Pv6-fj39vX08_Lx8A++"/> (spaces added for readability)
  - tetraca 7y ago
    Cool, if third party tracking cookies are "defeated", this will be the next step in the arms race.

ianbicking 7y ago

When sites break, people leave Firefox. No amount of explaining or media changes that: the number one (by far) reason people leave a browser is because a site is broken.

smacktoward 7y ago
Yes, this. Anyone who was around for the launch of Windows Vista could see this effect in action. Vista's added security measures like UAC (https://en.wikipedia.org/wiki/User_Account_Control https://en.wikipedia.org/wiki/User_Account_Control) broke a lot of poorly coded Windows applications that didn't bother to follow the rules of the platform. Who did the users blame when those apps broke? Microsoft. Why? "It worked fine until I upgraded to Vista!" Sigh.
- fwip 7y ago
  Further evidence: Windows 7 wasn't even that much of a change from Vista. The main differences were 1) software had adjusted to deal with UAC and 2) new laptops were more powerful. But most of the good new architectural features had premiered with Vista. I think they did improve the UAC situation with Vista SP1, if memory serves.
  - autoexec 7y ago
    MS changed UAC for windows 7 so much in an effort to stop annoying window's users that people complained that defeated the point https://www.networkworld.com/article/2253987/microsoft--neutered--uac-in-windows-7--says-researcher.html https://www.networkworld.com/article/2253987/microsoft--neut...
    - TazeTSchnitzel 7y ago
      The main UAC change in Windows 7 was just that it didn't pop up for changing of settings. But UAC on settings wasn't the problem (in fact, macOS basically has this and it's a non-issue), UAC on legacy Windows apps only tested on Windows 9x or on administrator accounts on NT systems was.

bzbarsky 7y ago

Safari does not block all 3rd party cookies by default last I checked. It does something a lot more complicated that still allows 3rd party cookies in various cases.