7 ms·

The article has it wrong with Safari. While ITP (Intelligent Tracking Protection) started in 2017 indeed, Safari has been blocking all third party (and thus all

The article has it wrong with Safari. While ITP (Intelligent Tracking Protection) started in 2017 indeed, Safari has been blocking all third party (and thus all tracking) cookies since almost forever. Safari started to block all third party cookies in 2003 with the release of Safari version 1. [1] Not only that, Safari also started to partition web cache in 2013, and it's still the only browser with such partitioning. [2] Without it, tracking doesnt even need cookies. "If you only block cookies, you still have all the other storage and stateful things to worry about." - Safari ITP engineer John Wilander [3] Also the spin of the article is slightly dishonest, simply turning off third-party cookies in Chrome achieves to negate most of the explicit criticism in the article. The author probably had the conclusion of the article in mind (setting up good Firefox against evil Chrome) before looking for supporting arguments. It's a bit ironic. While mainstream media starts to discover the existence of third-party cookies, which had been a known issue for around 20 years, Big Tech tracking has already moved to first-party tracking, fingerpringing and cache tracking. For example, Facebook switched to first-party cookie tracking in 2018. [4] Everyone who wants to understand the dynamic needs to look into the relationship between Apple and ad tech, with Apple's recent counter-move being the addition of ITP 2.2. [5] Since the release of ITP 2.1, even first-party cookies now are limited to 7 days, and all first-party cookies that are even potentially tracking cookies get deleted after already 1 day. [6] Firefox doesn't play much of a role in this fight. In fact, Firefox never did anything pro-actively to make ad-tech sweat. The decision by Mozilla to block all third-party cookies in 2013 [7] was reverted in fear of Ad-Tech. Mozilla is better at marketing than with the technology, and still hasn't enabled tracking-protection except for new users. [1] https://twitter.com/brendaneich/status/982631777574338561 https://twitter.com/brendaneich/status/982631777574338561 [2] https://twitter.com/johnwilander/status/1126191449161158657 https://twitter.com/johnwilander/status/1126191449161158657 [3] https://twitter.com/johnwilander/status/1126208457214836736 https://twitter.com/johnwilander/status/1126208457214836736 [4] https://www.adweek.com/programmatic/the-facebook-pixel-will-add-a-first-party-cookie-option/ https://www.adweek.com/programmatic/the-facebook-pixel-will-... [5] https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ https://webkit.org/blog/8828/intelligent-tracking-prevention... [6] https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/ https://webkit.org/blog/8613/intelligent-tracking-prevention... [7] https://blog.mozilla.org/netpolicy/2013/02/25/firefox-getting-smarter-about-third-party-cookies/ https://blog.mozilla.org/netpolicy/2013/02/25/firefox-gettin...

wnevets 7y ago
Even tho I never use Safari I will always give its dues for blocking 3rd party cookies out of the box.
Yoric 7y ago
I'm one of the many devs who worked at one point or another on Mozilla's third-party tracking protection. We had prototypes working in ~2012, if my memory serves. Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection. Now, Apple, with their iOS monopoly, managed to strong-arm the web into a position in which third-party tracking protection was finally possible. Kudos to them, now we can finally release this technology. We're doing it slowly, because by opposition to Apple, we cannot afford to break the web. Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. So, yeah, Apple's actions have had some good impact on web-tracking, and that's great. But don't forget that they do this for strategic reasons: 1/ because they want to encourage devs to use another tracking mechanism that the competition cannot emulate; 2/ to immediately hurt the competition. Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment. Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight.
- jxdxbx 7y ago
  > Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location. Apple does of course collect some user data, e.g. for Siri or app analytics. But it's all painstakingly disclosed and its practices around differential privacy, deletion, and so on are quite good. The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users.

wnevets 7y ago

Even tho I never use Safari I will always give its dues for blocking 3rd party cookies out of the box.

Yoric 7y ago

I'm one of the many devs who worked at one point or another on Mozilla's third-party tracking protection. We had prototypes working in ~2012, if my memory serves. Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection. Now, Apple, with their iOS monopoly, managed to strong-arm the web into a position in which third-party tracking protection was finally possible. Kudos to them, now we can finally release this technology. We're doing it slowly, because by opposition to Apple, we cannot afford to break the web. Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. So, yeah, Apple's actions have had some good impact on web-tracking, and that's great. But don't forget that they do this for strategic reasons: 1/ because they want to encourage devs to use another tracking mechanism that the competition cannot emulate; 2/ to immediately hurt the competition. Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment. Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight.

jxdxbx 7y ago
> Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location. Apple does of course collect some user data, e.g. for Siri or app analytics. But it's all painstakingly disclosed and its practices around differential privacy, deletion, and so on are quite good. The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users.