3 ms·

Firefox and Safari are way ahead of Chrome on this. Safari has blocked third-party cookies for years, with no way to opt-in to supporting them. Ad companies hav

Firefox and Safari are way ahead of Chrome on this. Safari has blocked third-party cookies for years, with no way to opt-in to supporting them. Ad companies have worked around that restriction, using a number of circumventions that Chrome does not currently intend to block. When ad companies attempt to circumvent Safari's third-party cookie policy, Safari tries to block them as part of their non-standard ITP (Intelligent Tracking Prevention) program. https://clearcode.cc/blog/intelligent-tracking-prevention/ https://clearcode.cc/blog/intelligent-tracking-prevention/ Firefox has followed suit with an "Enhanced Tracking Protection" feature, which was optional, but became mandatory in September of this year. https://blog.mozilla.org/blog/2019/09/03/todays-firefox-blocks-third-party-tracking-cookies-and-cryptomining-by-default/ https://blog.mozilla.org/blog/2019/09/03/todays-firefox-bloc... Rather than fearing to break the web, Apple has broken the web's ad tech frequently and aggressively; users seem not to mind. Browser vendors fear "breaking the web," in part because they're afraid that users will switch browsers if their favorite web site stops working. But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place.

danShumway 7y ago
The point of this change isn't to break ads, the tracking benefits are at best incidental. Ad networks can just opt-out anyway. The point is to block CSRF attacks on ordinary websites for developers who don't know enough to secure their cookies. > But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place. Breaking just the web's ads wouldn't have the same impact on security. The reason this change is valuable is because it's not restricted to specific blacklists or domains or applied via an algorithm, it's universal. I really like the tracking protections that Safari/Firefox are adding, but comparing them to this is apples and oranges. They're policies that are designed for different purposes.
cpeterso 7y ago
Firefox's Enhanced Tracking Protection is not mandatory. It's just enabled by default now. You can configure it in your Firefox settings or disable for individual sites via the address bar's shield icon.

danShumway 7y ago

The point of this change isn't to break ads, the tracking benefits are at best incidental. Ad networks can just opt-out anyway. The point is to block CSRF attacks on ordinary websites for developers who don't know enough to secure their cookies. > But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place. Breaking just the web's ads wouldn't have the same impact on security. The reason this change is valuable is because it's not restricted to specific blacklists or domains or applied via an algorithm, it's universal. I really like the tracking protections that Safari/Firefox are adding, but comparing them to this is apples and oranges. They're policies that are designed for different purposes.

cpeterso 7y ago

Firefox's Enhanced Tracking Protection is not mandatory. It's just enabled by default now. You can configure it in your Firefox settings or disable for individual sites via the address bar's shield icon.