15 ms·

Latest Firefox Brings Privacy Protections Front and Center

658 points by Vinnl 7y ago

AdmiralAsshat 7y ago
The downside of all of this is that I feel like sites are now intentionally being designed to break if this kind of stuff is blocked. I used to be able to use Firefox Focus (which has tracking protection built-in) to pay most of my bills. This was convenient because I would just open up the one site in FFF, pay the bill, and then close it, with all browsing history automatically deleted. In the past month about 3 of my credit card sites stopped working on FFF, as well as my ISP's site. Some would flat out reject the agent ("Your browser is no longer supported"), others would let me log in but then immediately tell me I had been logged out or redirect back to the home page. So now I'm forced to open them back up in regular Firefox, history and tracking included. It's one thing to say "Don't use sites that exploit your data", but it's not like the average person really has a choice when it comes to paying utility bills.
- metalliqaz 7y ago
  > The downside of all of this is that I feel like sites are now intentionally being designed to break if this kind of stuff is blocked. That's fine by me. It's an up-front indication that I don't want to use that service. In the case of bill pay, I would just change my user agent string.
  - dmortin 7y ago
    > In the case of bill pay, I would just change my user agent string. He also mentioned "others would let me log in but then immediately tell me I had been logged out". If they implement logging in with some tracking cookies, then changing your agent won't help.
  - johnisgood 7y ago
    You are working around the problem, but the underlying issue is still there, which is not fine. I do not consider those practices fine just because I may have found a workaround. :/
- babuskov 7y ago
  > it's not like the average person really has a choice when it comes to paying utility bills. You can always use a dedicated browser for that and only that. Brave, Opera, Vivaldi, IE, Chrome, whatever. At least there's enough browsers around to have each dedicated for certain purpose.
  - AdmiralAsshat 7y ago
    Well, that's the thing: Firefox Focus was my dedicated browser for that purpose. So now that's really no longer an option. I guess I can use Chrome in Incognito mode, but god knows how long it will be before payment sites start blacklisting that, too.
    - clinta 7y ago
      Temporary tab containers are a great alternative to a dedicated browser or incognito mode. https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
  - MaxBarraclough 7y ago
    No need. Use Incognito/Private Browsing. With the usual provisos, of course: https://en.wikipedia.org/wiki/Evercookie https://en.wikipedia.org/wiki/Evercookie https://panopticlick.eff.org/ https://panopticlick.eff.org/
- rcMgD2BwE72F 7y ago
  The more I protect my personal data (hi, GDPR!), the more websites are adding recaptacha to all their pages. Blocking trackers makes Google suspicious, so they're adding more and more recaptcha challenges to let me pass their tests, sometimes 5 to 10 in a row. I'm now working for Google's IA for free just to be able to make purchases online, access some services that I already paid for, or filling in support request forms (sometimes it's for websites operated by local communities and funded by tax payers). I have absolutely no control over what Google does with all my recaptcha inputs, it could be to build a fleet of autonomous cars (that could end up killing the public transportation in my city), or improving an algorithms that helps drones identify targets during a social unrest (could be a future me). Just because I want my privacy rights to be respected to the minimum (just don't track me for political/advertising purposes), I have to spend several minutes of my day working for Google and help them make money on advertising and sell AI to governments. How dystopian.
  - dmortin 7y ago
    > that could end up killing the public transportation in my city Don't forget that public transportation can also be self driving and it will be cheaper than riding in a self driving car. So I don't expect public transportation killed, I expect self driving buses.
  - vezycash 7y ago
    Use Buster captha solver addon
    - dessant 7y ago
      Thanks for recommending Buster (author here), but I think the right solution is to encourage people to stand up against Google's abuse, especially because they are working on making reCAPTCHA even more pervasive an inescapable. The recommended way of integrating reCAPTCHA v3 is to load it on every page of your site, not just on pages with forms. Given the popularity of this service, reCAPTCHA v3 is set to become a browsing history and behavioral data collector on a global scale.
- hospadar 7y ago
  I think helps expose the actual (bidirectional) flow of information - web sites give you stuff because you give them stuff. Usually you give them personal info about what you do on their site so that they can monetize you, in return you get news, messaging, etc. If you're unwilling to give them that stuff, maybe it's OK that they are unwilling to give you their (presumably valuable, because you're requesting it) stuff (articles, videos, etc). Often when I get "we won't show this to you with an adblocker on", I simply turn it off for that page. I want to read that article and I'm happy to exchange some personal info to get it for free. At least in this context I have the chance to opt-in. I agree that there are probably a lot of places where anti-content-blocking tools are overused (i.e. services that I have already actually paid $$ for), and probably other situations where I'd like more options ("plz disable adblocker OR pay us $0.05 for this article [obviously need some way to pay that doesn't in turn expose my personal info]")
  - Vinnl 7y ago
    GP's specific situation was paying utility bills, so the stuff they give to those websites is... Actual money?
  - magduf 7y ago
    We're not talking about news or content sites here, we're talking about bill-paying sites. People should be able to pay their utility bills with whatever browser they want, without being tracked. The argument over free content vs. ads is a valid argument, but it doesn't apply here at all.
- mfontani 7y ago
  For something similar, I use a Firefox docker container whose data settings are saved to the ephemeral disk which disappears once the browser closes. It's just a standard Firefox (or Chrome, or Brave, or..) otherwise. I use the same mechanism - but with persisting user data - for things like banking etc. in which I only open that one site.
- floatboth 7y ago
  That particular example is just extremely odd because… well, the business model of the utilities whose bills you pay (nor the bank's) shouldn't be based on advertising?? Maybe it's just a pile of web development fail, using 3rd party cookies for no good reason..
  - deleted 7y ago
    [deleted]
  - gbear605 7y ago
    I’ve seen sites fail to load if google analytics doesn’t load, so that could be it.
  - mindslight 7y ago
    Likely they've been sold a bunch of snake oil to prevent "fraud" based around sniffing up their customers' asses. But you should still use all of the anti-surveillance tech you can, lest the downward spiral continue. The methods are implemented gradually, with soft heuristics. The more customers they have without such vulnerabilities, the harder it is to justify turning the screws.
  - harterrt 7y ago
    Utilities shouldn't need advertising in theory, but utilities don't behave well (economically speaking) in general. There is to much regulation (limiting upside from selling their services means squeezing money out of less ethical verticals) or there are monopolistic incentives (you don't have a choice, so we can make you give us ad revenue)
    - TeMPOraL 7y ago
      It's arguably the second. Advertising/surveillance as an additional revenue stream is a no-brainer for ethically challenged companies.
    - orhmeh09 7y ago
      Where is there too much regulation of utilities? Particularly considering the issue with PG&E, it seems unlikely this would be the case in the US; the money in the US is being squeezed toward bonuses and the like.
- Vinnl 7y ago
  Not usable on mobile, but one extension you might be interested in is Trash Panda: https://addons.mozilla.org/en-US/firefox/addon/trash-bear/ https://addons.mozilla.org/en-US/firefox/addon/trash-bear/ Whenever I see a link to a website I suspect of siphoning off all my data (usually news websites), I right-click it and select "Open in new Trash Container". Do my thing, then close the tab, and all cookies and such for that site are cleared. It's almost like a Firefox Focus tab, the main difference being that it's not discernable from a regular tab.
  - floatboth 7y ago
    Or you could go all in with Multi-Account + Temporary containers :)
    - wasdfff 7y ago
      Tried that for a month and I couldn’t stand it. When you open a link that opens in a new container, you loose the history that brought you to that link. Clicking a link actually opens a new tab and simultaneously closes your current one. Going backwards is now broken and you have to shift cmd t to go through all your recently closed tabs or dig through your history if you are a user who regularly uses back on a browser. I also ran into a bug where infinite temporary containers would open until the browser finally crashed. The fix was removing the add on. Great idea, sloppy implementation.
      - floatboth 7y ago
        > Clicking a link actually opens a new tab I don't have that enabled, even ctrl-clicking something opens in the same container for me. Not perfect in terms of privacy paranoia (my HN container gets cookies from sites I go from HN to, unless I take the effort to explicitly open in a different container) but it has never annoyed me.
- irrational 7y ago
  It's a pain, but what I do is pay by utility bills in other ways. Usually I can pay in person, over the phone, via a check in the mail, or login once and setup automatic billing.
- magduf 7y ago
  >In the past month about 3 of my credit card sites stopped working on FFF, as well as my ISP's site. Which sites are these? When you make claims like this, you should specifically name the businesses that do this, so the rest of us can try to avoid them.
  - AdmiralAsshat 7y ago
    I avoided doing so because I don't really want the internet to know what credit cards I have. With that said, let's say I specifically name "Chase". Are you going to cancel your existing Chase bank account or credit card upon hearing this?
    - magduf 7y ago
      >With that said, let's say I specifically name "Chase". Are you going to cancel your existing Chase bank account or credit card upon hearing this? Well put it this way: if you specifically name "Chase", I'm going to think twice about applying for a credit card there or opening a bank account there. It's harder when you're already invested in a business, but when someone is shopping for a new one, when they hear credible information that shows that business to be a bad actor or that it will provide them a bad experience, it's pretty easy to cause many of them to choose something else. BTW, I would never advise anyone to get a Chase bank account; they're pretty well-known to be horrible. You can get far better service and interest rates from a good online bank like Ally, Schwab, Discover, etc.
      - AdmiralAsshat 7y ago
        > BTW, I would never advise anyone to get a Chase bank account; they're pretty well-known to be horrible. You can get far better service and interest rates from a good online bank like Ally, Schwab, Discover, etc. Again, it was a placeholder name. But I'll be honest for the sake of those curious and just say "the credit card that's offered through Costco" :)
      - clairity 7y ago
        yah, absolutely avoid the big 4: chase, citibank, bank of america, and wells fargo. there's always a better local/regional/online alternative at a lower cost and with (often much) better service.
- lacker 7y ago
  You can take a small action in support of privacy by complaining to your utility or your ISP that the website is not working in your browser.
  - hellcow 7y ago
    We're talking about utility companies. It wouldn't surprise me if the answer is "Please use Internet Explorer 8"
    - PTcartelsLOL 7y ago
      Then our answer would be: fix your website or you lose a customer or maybe several of them.
    - lacker 7y ago
      I wouldn't expect it to succeed immediately. But there are often frontend developers within these companies that would prefer to build high-quality websites that work in many browsers, and if there are complaints from end users, it will help these people in their arguments that they should invest more time in quality.
- dhimes 7y ago
  Definitely complain to the site: an email saying that the site allows possible exploits might get somebody's attention. But if I still need to allow/use the site, I use containers. Hopefully this gives me some security.
  - autoexec 7y ago
    I agree you should email the site, but i would be careful not to suggest the site is vulnerable unless you have clear evidence of that or you risk not being taken seriously. Just be honest about it. The devs might not want that shit on their sites either, but were told they had to include them in which case they'd probably love to have something to show it's causing users problems.
    - dhimes 7y ago
      Excellent point.
- capdeck 7y ago
  We have squandered our privacy rights by using "free" services and software. Now getting those back will be an uphill battle.
- mcintyre1994 7y ago
  Somewhat related, I saw a site today that did a fake Cloudflare style bot check countdown, and then said “click allow to confirm you’re not a bot” before popping up a notification send request UI. I bailed then but presumably it wouldn’t show anything if you declined that, who knows what spam they were sending if you didn’t. Thought that was a clever-ish very shitty way to work around permissions.
  - gtsteve 7y ago
    I had hoped that the notification API would just silently not send a notification if the user had explicitly denied this. Unfortunately that's not the case: https://developer.mozilla.org/en-US/docs/Web/API/Notification/permission https://developer.mozilla.org/en-US/docs/Web/API/Notificatio... It's a shame the designers of this feature didn't think of the abuse potential.
    - simcop2387 7y ago
      I'd like to have that option, but i can understand why they did it this way. If you just hide the notification then the site can still use them to get around other restrictions like how much time the javascript is allowed to run in the background and things like that.
- lugg 7y ago
  They now have a setting in content blocking that lets you choose between a less or more aggressive block list similar to how ublock works. I rarely see things break anymore.
- JohnFen 7y ago
  > it's not like the average person really has a choice when it comes to paying utility bills. Your utility only takes payments through their website? That's hard to believe. In most places I've lived, the utility companies contract with various local businesses to allow you to pay your bills in person through them, and all have still accepted payments through the mail.
- joewee 7y ago
  Browser Fingerprinting is also used for fraud detection and identify verification. There is often overlap between persistent tracking and security verification services.
- StavrosK 7y ago
  Well, rejoice. Now that the set of people for whom this breaks got expanded from "you" to "20% of everybody", they will likely fix the problem.
  - rasz 7y ago
    "20% of everybody" where everybody is somewhere between 4 and 9 percent.
- BurningFrog 7y ago
  I don't want to sound naive, but... I wonder how much of this might be innocent bugs because developers just don't test the site on this browser configuration?
- greendude29 7y ago
  That's really not a good excuse. Doing the right thing should be a much greater desire than minor inconveniences. Are there other reasons you don't like FFX or prefer other browsers?
dajonker 7y ago
I see one risk for Firefox: if they block all trackers, e.g. Google Analytics, then it would appear to people viewing browser statistics in Google Analytics that no-one is using Firefox, and thus the developers will be told they don't need to test anything on Firefox.
- bn7t 7y ago
  Website owners can just use the user agent in weblogs to determine this.
  - dajonker 7y ago
    Yes they can. But in my experience, at big organizations, the people using Google Analytics are not developers and will have no idea what weblogs are or how they could use them to determine the real browser statistics.
    - NotASithLord 7y ago
      I'm a dev and I have no idea what weblogs have to do with this discussion. Quick search didn't do anything to clue me in either.
      - 0xffff2 7y ago
        Which part is confusing? The browser sends lots of data to the server with each request. The server usually logs at least some of that data. Among other things, that data can be used to generate a subset of the data that is typically gathered by GA and other client-side analytics tools.
- zaarn 7y ago
  Nobody looks at logs anymore? Strange, those are very useful. Google Analytics isn't the only analytics tool and as blockers have become more prevalent relying on GA as your sole source of truth is becoming increasingly desperate to worship Google. Ideally you run a simple analytics tool alongside that is lightweight and doesn't get blocked (ie, privacy friendly) as well as running a log analyzer on your apache/webserver logs.
ropiwqefjnpoa 7y ago
So, FireFox or Brave? I'm currently using Brave and very happy with it.
- FactolSarin 7y ago
  I think Brave is fine, but the important difference between the two is that Brave is Chromium, and ultimately dependent on Chromium development. Firefox is 100% independent, and a true "third party" browser implementation. With Microsoft/Edge switching to Chromium I think that's more important than ever.
- zaarn 7y ago
  Firefox unless you want to continue to support Google's development of a privacy hostile browser (Brave is after all a Chromium browser).
- bn7t 7y ago
  There are good reasons not to use brave: - received venture capital from Peter Thiel (Chairman of Palantir) - BAT tokens aren't backed by any real value - https://jlelse.blog/posts/ditch-chrome/ https://jlelse.blog/posts/ditch-chrome/ More reasons: https://twitter.com/corbindavenport/status/1134143209389666305 https://twitter.com/corbindavenport/status/11341432093896663...
  - floatboth 7y ago
    IIRC they even collected the tokens on behalf of sites that didn't sign up, creating a quite weird and rather unethical "you basically have to sign up now" situation for publishers.
- ahbyb 7y ago
  Brave is fine, in fact I find it faster than Firefox.
- zelly 7y ago
  If Mozilla had any sense of the future, they would start working on Brave instead of Firefox. Chromium already won on technical reasons. Now someone needs to professionally maintain a privacy fork of it.
alexfromapex 7y ago
The new weapon to fight back against the extreme invasion of privacy is exposing the companies and making them accountable. I love this along with the bluetooth warnings on iOS 13.
- dylan604 7y ago
  I never realized how many apps were trying to use bluetooth until these new notifications started to pop up. I appreciate this update as well.
MikusR 7y ago
Do they include also the google analytics that are built into firefox addons page?
- PavlovsCat 7y ago
  Can you elaborate what page you mean? I see nothing in the source of https://addons.mozilla.org/en-US/firefox/search/?q=blah https://addons.mozilla.org/en-US/firefox/search/?q=blah or about:addons
  - robbya 7y ago
    I believe they are talking about an outdated issue: https://github.com/mozilla/addons-frontend/issues/2785#issuecomment-315212909 https://github.com/mozilla/addons-frontend/issues/2785#issue...
    - brynjolf 7y ago
      It is not outdated since it requires you to enable Do not track which makes you a target for tracking. It is bad design and they know it. They don't even respect their own disable analytics toggle.
      - vunie 7y ago
        Not only that, but Mozilla deliberately continues to send telemetry about your network, browser, and OS even when you explicitly disable telemetry: https://www.ghacks.net/2018/09/21/mozilla-wants-to-estimate-firefoxs-telemetry-off-population/ https://www.ghacks.net/2018/09/21/mozilla-wants-to-estimate-... When Microsoft is more honest and upfront about user privacy then you are, then you have a problem.
- akerro 7y ago
  No, these cannot be skipped without external request blocking, like on DNS level. Even µblock won't block GA built-in in Firefox.
sunasra 7y ago
I love the way Firefox is putting their efforts towards the privacy. Each releases increases my trust on them. Kudos to the team
- m463 7y ago
  They report a lot of data by default back to mozilla though.
  - clairity 7y ago
    yah, i'd love to have a list of sites and what's being sent. for example, a new one that popped up recently: private-network.firefox.com
fencepost 7y ago
It's interesting to contemplate that some of the features Firefox now has built in (bookmark sync, password sync, dark web monitoring) overlap with things that are or have been available as paid services as well.
- isostatic 7y ago
  Web Browsers were paid for at one time, as were operating systems.
p7IDD243 7y ago
It's a noble effort, the amount of tracking going on is just digusting, I have 1.9k blocked trackers in just the past week and I visit a small set of websites.
lprd 7y ago
This is great! On another note, I'm wondering when I can remove uBlock Origin?
- kgwxd 7y ago
  Don't, ever. There's no reason to trust Mozilla will keep this up forever. They're not even close to doing what uBO does. Blockers are best kept as a third-party solution with no conflict of interest. If too many people stop using uBO because the FF built in tools are "good enough", eventually we'll loose proper extension support and we will be at the mercy of browser vendors again.
  - Vinnl 7y ago
    What's Mozilla's conflict of interest?
    - symlinkk 7y ago
      Most of their funding comes from Google, in return for making Google search the default search engine on Firefox
- Someone1234 7y ago
  I guess it boils down to your goal with using uBlock Origin. Are you anti-tracking or anti-ad? This blocks some ads as almost a side-effect but that isn't its goal. If ads aren't tracking, they're fully visible/working. I use this because I value my privacy, but choose not to use uBlock Origin because I understand websites I use need revenue. It is about finding your own personal balance.
  - JohnFen 7y ago
    I'm anti-tracking. I don't, and have never, blocked ads specifically. I do block scripts, though. The side-effect of that is that I don't see most ads, but that isn't the point.
- sp332 7y ago
Bantros 7y ago
Too little, too late
ntxy 7y ago
must be a joke since this link gets eaten by privacy badger. Full of trackers. edit: originally referred to blog.mozilla.com
- sp332 7y ago
  Privacy Badger gave me one hit, netdna-ssl, at the "Blocked Cookies" level. No hits on uBlock or the new enhanced tracking protection thing. What trackers are you seeing?
  - ntxy 7y ago
    Oh, I meant the OPs Link to the Blog Post. I suspect the 5 trackers of post are from the youtube embed. Anyways, my point still stands.
- jdorw 7y ago
  Yep, both google-analytics and doubleclick on blog.mozilla.com
svnpenn 7y ago
Honestly its getting out of hand. I have everything blocked I can think of [1], and even browsing in private mode, I still sometimes get the "recommended for you" on YouTube. Stop invading my privacy. [1] https://cup.github.io/rosso/youtube https://cup.github.io/rosso/youtube
- pitaj 7y ago
  It's probably just using your IP address.
  - dwild 7y ago
    Yeah that's probably that. I always laugh when I see an ads for me on any of my colleague computer. if they use that on ads, they certainly use it on Youtube. I also gets recommendation for videos that my SO watches even though we don't use the same computer. It's rare but it happens.
  - sucrose 7y ago
    So it's possible that by using a VPN, you're seeing ads recommended for other people using the same VPN?
    - Zenbit_UX 7y ago
      Yes, that is exactly what happens when you use a VPN. Only services like primevideo and Netflix bother to detect VPNs and force you to get off, 99% of the web treats you like a regular user, but with an insane diversity of interests.
      - daedalus_j 7y ago
        That's becoming less and less true. For example, the wiki.debian.org blocks users of (at least) privateinternetaccess VPN. (You get a 403 forbidden. This doesn't happen when I use my personal VPN routed out through a VPS provider, only through PIA.) I have encountered this with various other sites as well, both outright blocks and degraded experience. Frustrating. Although I don't really trust VPN providers, I trust my ISP even less, and a VPN helps me get by some of their more heavy handed shaping.
Gondolin 7y ago
It would be nice to know the priority of blocking elements between firefox default anti-tracker list, ublock origin, and privacy badger. When I see a tracker hit ublock origin does it mean that it bypassed firefox anti-tracker blocking, or is it the reverse? Having three anti-trackers installed is also a bit inconvenient when this breaks a site, I have to disable each one successively to try to make it work again...
- angott 7y ago
  Based on my experience, uBlock Origin has priority over the built-in blocker.
  - beckler 7y ago
    I'm seeing the same thing, my report doesn't have a ton of data (~10 blocks a day on average), and the only other blocker I have is uBlock.
- m463 7y ago
  I use uMatrix (same folks as ublock origin) and I've noticed if you go into reader mode, some things seem to be unblocked.
sucrose 7y ago
The inactive CSS feature is great, I've spent a lot of time cleaning up global stylesheets for my employer recently, and it's a big task. Even though I doubt it catches CSS toggled by Javascript, I'm excited to use it.
Kaiyou 7y ago
Meanwhile, Firefox won't selectively delete hundreds of cookies, despite all the options indicating that it would be possible. Instead, it hangs and fails to delete selected cookies.
- fzzzy 7y ago
  I mean, that's a bug. File a bug, or see if you can fix it yourself, since you can repro it.
- dhimes 7y ago
  But it also doesn't delete my passwords, like Chrome does every single damn update I think. It's been an issue for 10 years. [And don't start with me about lastpass, etc. ...]
  - Kaiyou 7y ago
    I agree that it is the least worse browser, hence I'm using it. Though, that will change once Addon support is added to qutebrowser.
orenak 7y ago
this will make me switch to firefox, only feature I needed as multi lingual user
brynjolf 7y ago
Still wonder why they have multiple backdoor into their own browser and several layers of analytics included. Including when you start the browser for the first time. Feels hypocritical.
Animats 7y ago
Can you remove Pocket yet?
- 0xdeadb00f 7y ago
  You can through an about:config/user.js flag: user_pref("extensions.pocket.enabled", false);

658 points by Vinnl 7y ago

The downside of all of this is that I feel like sites are now intentionally being designed to break if this kind of stuff is blocked. I used to be able to use Firefox Focus (which has tracking protection built-in) to pay most of my bills. This was convenient because I would just open up the one site in FFF, pay the bill, and then close it, with all browsing history automatically deleted. In the past month about 3 of my credit card sites stopped working on FFF, as well as my ISP's site. Some would flat out reject the agent ("Your browser is no longer supported"), others would let me log in but then immediately tell me I had been logged out or redirect back to the home page. So now I'm forced to open them back up in regular Firefox, history and tracking included. It's one thing to say "Don't use sites that exploit your data", but it's not like the average person really has a choice when it comes to paying utility bills.

metalliqaz 7y ago
> The downside of all of this is that I feel like sites are now intentionally being designed to break if this kind of stuff is blocked. That's fine by me. It's an up-front indication that I don't want to use that service. In the case of bill pay, I would just change my user agent string.
- dmortin 7y ago
  > In the case of bill pay, I would just change my user agent string. He also mentioned "others would let me log in but then immediately tell me I had been logged out". If they implement logging in with some tracking cookies, then changing your agent won't help.
- johnisgood 7y ago
  You are working around the problem, but the underlying issue is still there, which is not fine. I do not consider those practices fine just because I may have found a workaround. :/
babuskov 7y ago
> it's not like the average person really has a choice when it comes to paying utility bills. You can always use a dedicated browser for that and only that. Brave, Opera, Vivaldi, IE, Chrome, whatever. At least there's enough browsers around to have each dedicated for certain purpose.
- AdmiralAsshat 7y ago
  Well, that's the thing: Firefox Focus was my dedicated browser for that purpose. So now that's really no longer an option. I guess I can use Chrome in Incognito mode, but god knows how long it will be before payment sites start blacklisting that, too.
  - clinta 7y ago
    Temporary tab containers are a great alternative to a dedicated browser or incognito mode. https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
- MaxBarraclough 7y ago
  No need. Use Incognito/Private Browsing. With the usual provisos, of course: https://en.wikipedia.org/wiki/Evercookie https://en.wikipedia.org/wiki/Evercookie https://panopticlick.eff.org/ https://panopticlick.eff.org/
rcMgD2BwE72F 7y ago
The more I protect my personal data (hi, GDPR!), the more websites are adding recaptacha to all their pages. Blocking trackers makes Google suspicious, so they're adding more and more recaptcha challenges to let me pass their tests, sometimes 5 to 10 in a row. I'm now working for Google's IA for free just to be able to make purchases online, access some services that I already paid for, or filling in support request forms (sometimes it's for websites operated by local communities and funded by tax payers). I have absolutely no control over what Google does with all my recaptcha inputs, it could be to build a fleet of autonomous cars (that could end up killing the public transportation in my city), or improving an algorithms that helps drones identify targets during a social unrest (could be a future me). Just because I want my privacy rights to be respected to the minimum (just don't track me for political/advertising purposes), I have to spend several minutes of my day working for Google and help them make money on advertising and sell AI to governments. How dystopian.
- dmortin 7y ago
  > that could end up killing the public transportation in my city Don't forget that public transportation can also be self driving and it will be cheaper than riding in a self driving car. So I don't expect public transportation killed, I expect self driving buses.
- vezycash 7y ago
  Use Buster captha solver addon
  - dessant 7y ago
    Thanks for recommending Buster (author here), but I think the right solution is to encourage people to stand up against Google's abuse, especially because they are working on making reCAPTCHA even more pervasive an inescapable. The recommended way of integrating reCAPTCHA v3 is to load it on every page of your site, not just on pages with forms. Given the popularity of this service, reCAPTCHA v3 is set to become a browsing history and behavioral data collector on a global scale.
hospadar 7y ago
I think helps expose the actual (bidirectional) flow of information - web sites give you stuff because you give them stuff. Usually you give them personal info about what you do on their site so that they can monetize you, in return you get news, messaging, etc. If you're unwilling to give them that stuff, maybe it's OK that they are unwilling to give you their (presumably valuable, because you're requesting it) stuff (articles, videos, etc). Often when I get "we won't show this to you with an adblocker on", I simply turn it off for that page. I want to read that article and I'm happy to exchange some personal info to get it for free. At least in this context I have the chance to opt-in. I agree that there are probably a lot of places where anti-content-blocking tools are overused (i.e. services that I have already actually paid $$ for), and probably other situations where I'd like more options ("plz disable adblocker OR pay us $0.05 for this article [obviously need some way to pay that doesn't in turn expose my personal info]")
- Vinnl 7y ago
  GP's specific situation was paying utility bills, so the stuff they give to those websites is... Actual money?
- magduf 7y ago
  We're not talking about news or content sites here, we're talking about bill-paying sites. People should be able to pay their utility bills with whatever browser they want, without being tracked. The argument over free content vs. ads is a valid argument, but it doesn't apply here at all.
mfontani 7y ago
For something similar, I use a Firefox docker container whose data settings are saved to the ephemeral disk which disappears once the browser closes. It's just a standard Firefox (or Chrome, or Brave, or..) otherwise. I use the same mechanism - but with persisting user data - for things like banking etc. in which I only open that one site.
floatboth 7y ago
That particular example is just extremely odd because… well, the business model of the utilities whose bills you pay (nor the bank's) shouldn't be based on advertising?? Maybe it's just a pile of web development fail, using 3rd party cookies for no good reason..
- deleted 7y ago
  [deleted]
- gbear605 7y ago
  I’ve seen sites fail to load if google analytics doesn’t load, so that could be it.
- mindslight 7y ago
  Likely they've been sold a bunch of snake oil to prevent "fraud" based around sniffing up their customers' asses. But you should still use all of the anti-surveillance tech you can, lest the downward spiral continue. The methods are implemented gradually, with soft heuristics. The more customers they have without such vulnerabilities, the harder it is to justify turning the screws.
- harterrt 7y ago
  Utilities shouldn't need advertising in theory, but utilities don't behave well (economically speaking) in general. There is to much regulation (limiting upside from selling their services means squeezing money out of less ethical verticals) or there are monopolistic incentives (you don't have a choice, so we can make you give us ad revenue)
  - TeMPOraL 7y ago
    It's arguably the second. Advertising/surveillance as an additional revenue stream is a no-brainer for ethically challenged companies.
  - orhmeh09 7y ago
    Where is there too much regulation of utilities? Particularly considering the issue with PG&E, it seems unlikely this would be the case in the US; the money in the US is being squeezed toward bonuses and the like.
Vinnl 7y ago
Not usable on mobile, but one extension you might be interested in is Trash Panda: https://addons.mozilla.org/en-US/firefox/addon/trash-bear/ https://addons.mozilla.org/en-US/firefox/addon/trash-bear/ Whenever I see a link to a website I suspect of siphoning off all my data (usually news websites), I right-click it and select "Open in new Trash Container". Do my thing, then close the tab, and all cookies and such for that site are cleared. It's almost like a Firefox Focus tab, the main difference being that it's not discernable from a regular tab.
- floatboth 7y ago
  Or you could go all in with Multi-Account + Temporary containers :)
  - wasdfff 7y ago
    Tried that for a month and I couldn’t stand it. When you open a link that opens in a new container, you loose the history that brought you to that link. Clicking a link actually opens a new tab and simultaneously closes your current one. Going backwards is now broken and you have to shift cmd t to go through all your recently closed tabs or dig through your history if you are a user who regularly uses back on a browser. I also ran into a bug where infinite temporary containers would open until the browser finally crashed. The fix was removing the add on. Great idea, sloppy implementation.
    - floatboth 7y ago
      > Clicking a link actually opens a new tab I don't have that enabled, even ctrl-clicking something opens in the same container for me. Not perfect in terms of privacy paranoia (my HN container gets cookies from sites I go from HN to, unless I take the effort to explicitly open in a different container) but it has never annoyed me.
irrational 7y ago
It's a pain, but what I do is pay by utility bills in other ways. Usually I can pay in person, over the phone, via a check in the mail, or login once and setup automatic billing.
magduf 7y ago
>In the past month about 3 of my credit card sites stopped working on FFF, as well as my ISP's site. Which sites are these? When you make claims like this, you should specifically name the businesses that do this, so the rest of us can try to avoid them.
- AdmiralAsshat 7y ago
  I avoided doing so because I don't really want the internet to know what credit cards I have. With that said, let's say I specifically name "Chase". Are you going to cancel your existing Chase bank account or credit card upon hearing this?
  - magduf 7y ago
    >With that said, let's say I specifically name "Chase". Are you going to cancel your existing Chase bank account or credit card upon hearing this? Well put it this way: if you specifically name "Chase", I'm going to think twice about applying for a credit card there or opening a bank account there. It's harder when you're already invested in a business, but when someone is shopping for a new one, when they hear credible information that shows that business to be a bad actor or that it will provide them a bad experience, it's pretty easy to cause many of them to choose something else. BTW, I would never advise anyone to get a Chase bank account; they're pretty well-known to be horrible. You can get far better service and interest rates from a good online bank like Ally, Schwab, Discover, etc.
    - AdmiralAsshat 7y ago
      > BTW, I would never advise anyone to get a Chase bank account; they're pretty well-known to be horrible. You can get far better service and interest rates from a good online bank like Ally, Schwab, Discover, etc. Again, it was a placeholder name. But I'll be honest for the sake of those curious and just say "the credit card that's offered through Costco" :)
    - clairity 7y ago
      yah, absolutely avoid the big 4: chase, citibank, bank of america, and wells fargo. there's always a better local/regional/online alternative at a lower cost and with (often much) better service.
lacker 7y ago
You can take a small action in support of privacy by complaining to your utility or your ISP that the website is not working in your browser.
- hellcow 7y ago
  We're talking about utility companies. It wouldn't surprise me if the answer is "Please use Internet Explorer 8"
  - PTcartelsLOL 7y ago
    Then our answer would be: fix your website or you lose a customer or maybe several of them.
  - lacker 7y ago
    I wouldn't expect it to succeed immediately. But there are often frontend developers within these companies that would prefer to build high-quality websites that work in many browsers, and if there are complaints from end users, it will help these people in their arguments that they should invest more time in quality.
dhimes 7y ago
Definitely complain to the site: an email saying that the site allows possible exploits might get somebody's attention. But if I still need to allow/use the site, I use containers. Hopefully this gives me some security.
- autoexec 7y ago
  I agree you should email the site, but i would be careful not to suggest the site is vulnerable unless you have clear evidence of that or you risk not being taken seriously. Just be honest about it. The devs might not want that shit on their sites either, but were told they had to include them in which case they'd probably love to have something to show it's causing users problems.
  - dhimes 7y ago
    Excellent point.
capdeck 7y ago
We have squandered our privacy rights by using "free" services and software. Now getting those back will be an uphill battle.
mcintyre1994 7y ago
Somewhat related, I saw a site today that did a fake Cloudflare style bot check countdown, and then said “click allow to confirm you’re not a bot” before popping up a notification send request UI. I bailed then but presumably it wouldn’t show anything if you declined that, who knows what spam they were sending if you didn’t. Thought that was a clever-ish very shitty way to work around permissions.
- gtsteve 7y ago
  I had hoped that the notification API would just silently not send a notification if the user had explicitly denied this. Unfortunately that's not the case: https://developer.mozilla.org/en-US/docs/Web/API/Notification/permission https://developer.mozilla.org/en-US/docs/Web/API/Notificatio... It's a shame the designers of this feature didn't think of the abuse potential.
  - simcop2387 7y ago
    I'd like to have that option, but i can understand why they did it this way. If you just hide the notification then the site can still use them to get around other restrictions like how much time the javascript is allowed to run in the background and things like that.
lugg 7y ago
They now have a setting in content blocking that lets you choose between a less or more aggressive block list similar to how ublock works. I rarely see things break anymore.
JohnFen 7y ago
> it's not like the average person really has a choice when it comes to paying utility bills. Your utility only takes payments through their website? That's hard to believe. In most places I've lived, the utility companies contract with various local businesses to allow you to pay your bills in person through them, and all have still accepted payments through the mail.
joewee 7y ago
Browser Fingerprinting is also used for fraud detection and identify verification. There is often overlap between persistent tracking and security verification services.
StavrosK 7y ago
Well, rejoice. Now that the set of people for whom this breaks got expanded from "you" to "20% of everybody", they will likely fix the problem.
- rasz 7y ago
  "20% of everybody" where everybody is somewhere between 4 and 9 percent.
BurningFrog 7y ago
I don't want to sound naive, but... I wonder how much of this might be innocent bugs because developers just don't test the site on this browser configuration?
greendude29 7y ago
That's really not a good excuse. Doing the right thing should be a much greater desire than minor inconveniences. Are there other reasons you don't like FFX or prefer other browsers?

dajonker 7y ago

I see one risk for Firefox: if they block all trackers, e.g. Google Analytics, then it would appear to people viewing browser statistics in Google Analytics that no-one is using Firefox, and thus the developers will be told they don't need to test anything on Firefox.

bn7t 7y ago
Website owners can just use the user agent in weblogs to determine this.
- dajonker 7y ago
  Yes they can. But in my experience, at big organizations, the people using Google Analytics are not developers and will have no idea what weblogs are or how they could use them to determine the real browser statistics.
  - NotASithLord 7y ago
    I'm a dev and I have no idea what weblogs have to do with this discussion. Quick search didn't do anything to clue me in either.
    - 0xffff2 7y ago
      Which part is confusing? The browser sends lots of data to the server with each request. The server usually logs at least some of that data. Among other things, that data can be used to generate a subset of the data that is typically gathered by GA and other client-side analytics tools.
zaarn 7y ago
Nobody looks at logs anymore? Strange, those are very useful. Google Analytics isn't the only analytics tool and as blockers have become more prevalent relying on GA as your sole source of truth is becoming increasingly desperate to worship Google. Ideally you run a simple analytics tool alongside that is lightweight and doesn't get blocked (ie, privacy friendly) as well as running a log analyzer on your apache/webserver logs.

ropiwqefjnpoa 7y ago

So, FireFox or Brave? I'm currently using Brave and very happy with it.

FactolSarin 7y ago
I think Brave is fine, but the important difference between the two is that Brave is Chromium, and ultimately dependent on Chromium development. Firefox is 100% independent, and a true "third party" browser implementation. With Microsoft/Edge switching to Chromium I think that's more important than ever.
zaarn 7y ago
Firefox unless you want to continue to support Google's development of a privacy hostile browser (Brave is after all a Chromium browser).
bn7t 7y ago
There are good reasons not to use brave: - received venture capital from Peter Thiel (Chairman of Palantir) - BAT tokens aren't backed by any real value - https://jlelse.blog/posts/ditch-chrome/ https://jlelse.blog/posts/ditch-chrome/ More reasons: https://twitter.com/corbindavenport/status/1134143209389666305 https://twitter.com/corbindavenport/status/11341432093896663...
- floatboth 7y ago
  IIRC they even collected the tokens on behalf of sites that didn't sign up, creating a quite weird and rather unethical "you basically have to sign up now" situation for publishers.
ahbyb 7y ago
Brave is fine, in fact I find it faster than Firefox.
zelly 7y ago
If Mozilla had any sense of the future, they would start working on Brave instead of Firefox. Chromium already won on technical reasons. Now someone needs to professionally maintain a privacy fork of it.

alexfromapex 7y ago

The new weapon to fight back against the extreme invasion of privacy is exposing the companies and making them accountable. I love this along with the bluetooth warnings on iOS 13.

dylan604 7y ago
I never realized how many apps were trying to use bluetooth until these new notifications started to pop up. I appreciate this update as well.

MikusR 7y ago

Do they include also the google analytics that are built into firefox addons page?

PavlovsCat 7y ago
Can you elaborate what page you mean? I see nothing in the source of https://addons.mozilla.org/en-US/firefox/search/?q=blah https://addons.mozilla.org/en-US/firefox/search/?q=blah or about:addons
- robbya 7y ago
  I believe they are talking about an outdated issue: https://github.com/mozilla/addons-frontend/issues/2785#issuecomment-315212909 https://github.com/mozilla/addons-frontend/issues/2785#issue...
  - brynjolf 7y ago
    It is not outdated since it requires you to enable Do not track which makes you a target for tracking. It is bad design and they know it. They don't even respect their own disable analytics toggle.
    - vunie 7y ago
      Not only that, but Mozilla deliberately continues to send telemetry about your network, browser, and OS even when you explicitly disable telemetry: https://www.ghacks.net/2018/09/21/mozilla-wants-to-estimate-firefoxs-telemetry-off-population/ https://www.ghacks.net/2018/09/21/mozilla-wants-to-estimate-... When Microsoft is more honest and upfront about user privacy then you are, then you have a problem.
akerro 7y ago
No, these cannot be skipped without external request blocking, like on DNS level. Even µblock won't block GA built-in in Firefox.

sunasra 7y ago

I love the way Firefox is putting their efforts towards the privacy. Each releases increases my trust on them. Kudos to the team

m463 7y ago
They report a lot of data by default back to mozilla though.
- clairity 7y ago
  yah, i'd love to have a list of sites and what's being sent. for example, a new one that popped up recently: private-network.firefox.com

fencepost 7y ago

It's interesting to contemplate that some of the features Firefox now has built in (bookmark sync, password sync, dark web monitoring) overlap with things that are or have been available as paid services as well.

isostatic 7y ago
Web Browsers were paid for at one time, as were operating systems.

p7IDD243 7y ago

It's a noble effort, the amount of tracking going on is just digusting, I have 1.9k blocked trackers in just the past week and I visit a small set of websites.

lprd 7y ago

This is great! On another note, I'm wondering when I can remove uBlock Origin?

kgwxd 7y ago
Don't, ever. There's no reason to trust Mozilla will keep this up forever. They're not even close to doing what uBO does. Blockers are best kept as a third-party solution with no conflict of interest. If too many people stop using uBO because the FF built in tools are "good enough", eventually we'll loose proper extension support and we will be at the mercy of browser vendors again.
- Vinnl 7y ago
  What's Mozilla's conflict of interest?
  - symlinkk 7y ago
    Most of their funding comes from Google, in return for making Google search the default search engine on Firefox
Someone1234 7y ago
I guess it boils down to your goal with using uBlock Origin. Are you anti-tracking or anti-ad? This blocks some ads as almost a side-effect but that isn't its goal. If ads aren't tracking, they're fully visible/working. I use this because I value my privacy, but choose not to use uBlock Origin because I understand websites I use need revenue. It is about finding your own personal balance.
- JohnFen 7y ago
  I'm anti-tracking. I don't, and have never, blocked ads specifically. I do block scripts, though. The side-effect of that is that I don't see most ads, but that isn't the point.
sp332 7y ago

Bantros 7y ago

Too little, too late

ntxy 7y ago

must be a joke since this link gets eaten by privacy badger. Full of trackers. edit: originally referred to blog.mozilla.com

sp332 7y ago
Privacy Badger gave me one hit, netdna-ssl, at the "Blocked Cookies" level. No hits on uBlock or the new enhanced tracking protection thing. What trackers are you seeing?
- ntxy 7y ago
  Oh, I meant the OPs Link to the Blog Post. I suspect the 5 trackers of post are from the youtube embed. Anyways, my point still stands.
jdorw 7y ago
Yep, both google-analytics and doubleclick on blog.mozilla.com

svnpenn 7y ago

Honestly its getting out of hand. I have everything blocked I can think of [1], and even browsing in private mode, I still sometimes get the "recommended for you" on YouTube. Stop invading my privacy. [1] https://cup.github.io/rosso/youtube https://cup.github.io/rosso/youtube

pitaj 7y ago
It's probably just using your IP address.
- dwild 7y ago
  Yeah that's probably that. I always laugh when I see an ads for me on any of my colleague computer. if they use that on ads, they certainly use it on Youtube. I also gets recommendation for videos that my SO watches even though we don't use the same computer. It's rare but it happens.
- sucrose 7y ago
  So it's possible that by using a VPN, you're seeing ads recommended for other people using the same VPN?
  - Zenbit_UX 7y ago
    Yes, that is exactly what happens when you use a VPN. Only services like primevideo and Netflix bother to detect VPNs and force you to get off, 99% of the web treats you like a regular user, but with an insane diversity of interests.
    - daedalus_j 7y ago
      That's becoming less and less true. For example, the wiki.debian.org blocks users of (at least) privateinternetaccess VPN. (You get a 403 forbidden. This doesn't happen when I use my personal VPN routed out through a VPS provider, only through PIA.) I have encountered this with various other sites as well, both outright blocks and degraded experience. Frustrating. Although I don't really trust VPN providers, I trust my ISP even less, and a VPN helps me get by some of their more heavy handed shaping.

Gondolin 7y ago

It would be nice to know the priority of blocking elements between firefox default anti-tracker list, ublock origin, and privacy badger. When I see a tracker hit ublock origin does it mean that it bypassed firefox anti-tracker blocking, or is it the reverse? Having three anti-trackers installed is also a bit inconvenient when this breaks a site, I have to disable each one successively to try to make it work again...

angott 7y ago
Based on my experience, uBlock Origin has priority over the built-in blocker.
- beckler 7y ago
  I'm seeing the same thing, my report doesn't have a ton of data (~10 blocks a day on average), and the only other blocker I have is uBlock.
m463 7y ago
I use uMatrix (same folks as ublock origin) and I've noticed if you go into reader mode, some things seem to be unblocked.

sucrose 7y ago

The inactive CSS feature is great, I've spent a lot of time cleaning up global stylesheets for my employer recently, and it's a big task. Even though I doubt it catches CSS toggled by Javascript, I'm excited to use it.

Kaiyou 7y ago

Meanwhile, Firefox won't selectively delete hundreds of cookies, despite all the options indicating that it would be possible. Instead, it hangs and fails to delete selected cookies.

fzzzy 7y ago
I mean, that's a bug. File a bug, or see if you can fix it yourself, since you can repro it.
dhimes 7y ago
But it also doesn't delete my passwords, like Chrome does every single damn update I think. It's been an issue for 10 years. [And don't start with me about lastpass, etc. ...]
- Kaiyou 7y ago
  I agree that it is the least worse browser, hence I'm using it. Though, that will change once Addon support is added to qutebrowser.

orenak 7y ago

this will make me switch to firefox, only feature I needed as multi lingual user

brynjolf 7y ago

Still wonder why they have multiple backdoor into their own browser and several layers of analytics included. Including when you start the browser for the first time. Feels hypocritical.

Animats 7y ago

Can you remove Pocket yet?

0xdeadb00f 7y ago
You can through an about:config/user.js flag: user_pref("extensions.pocket.enabled", false);