4 ms·
An important feature of Firefox that isn't nearly as well known as it should be is first party isolation. It can be a bit annoying due to eg Recaptcha, but it
by the_duke 6y ago
An important feature of Firefox that isn't nearly as well known as it should be is first party isolation.
It can be a bit annoying due to eg Recaptcha, but it works fine 99% of the time. Some sites will break, but these are far and few between. I just use another browser for those.
It was upstreamed from TOR and will scope all data (cookies, caches, etc) per domain. It's not a panacea, but definitely a good step.
(about:config , privacy.firstparty.isolate)
I feel like something like this should be the (standardized) behaviour of browsers. Sharing any kind of observable state between domains should require an explicit opt-in with a prompt.
Like: "Privacy Warning: techcrunch.com wants to share your data with facebook.com. Do you want to allow this?"
(such fine grained permissions are a complicated topic of course, but that's a longer discussion...)
- GoblinSlayer 6y agoI just disabled third party cookies and everything works fine.
- kohtatsu 6y agoThankfully this became the default in Safari: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/ https://webkit.org/blog/10218/full-third-party-cookie-blocki... Previously it only enabled third-party cookies for domains you had explicitly visited. https://www.theverge.com/2017/9/14/16308138/apple-safari-11-advertiser-groups-cookie-tracking-letter https://www.theverge.com/2017/9/14/16308138/apple-safari-11-...
- mywittyname 6y agoUnfortunately, people are working out ways to get around this now that it's become a default.
- kevin_thibedeau 6y agoUse a generic JS blocker. It protects you from workarounds and zero days.
- foobar_ 6y agoDoesn't stop tracking pixels.
- brunoqc 6y agoIf you use umatrix and only allow 1st party cookies it should block those right? The pixel would load but without any cookie.
- kevin_thibedeau 6y agoTracking pixels don't need a cookie if they're using dynamically generated URLs.
- guug 6y agoumatrix can block third-party images as easily as it blocks cookies.
- Wowfunhappy 6y agoIt also blocks JS.
- PhantomGremlin 6y agoYou say that like it's a bad thing?
- Merem 6y agoDisabling third-party cookies hasn't really been that useful in a long time though. "When third-party cookies are allowed, 101 domains can reconstruct over 50% of a user's history and 161 could recover over 40%. Even when these cookies are blocked, 44 domains could recover over 40% of a user's history."[1] [1] Study back in 2014: https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf https://securehomes.esat.kuleuven.be/~gacar/persistent/the_w... Add to that web beacons, ads, like buttons, browser fingerprinting via HTTP header, javascript, canvas, plug-ins, add-ons or hardware, keystroke biometrics and gestures on smartphones. Of course, there are also several techniques for e-mail tracking as well as tracking of documents (word, .pdfs etc).
- m463 6y agoSharing would just be routed through cdn.firstparty.com
- cpeterso 6y agoFirefox's First Party Isolation can break some websites that might rely on third-party authentication. This may be acceptable for Tor users, but not regular users, which is why First Party Isolation is still off by default in Firefox. Mozilla is actively testing a variation called Dynamic First Party Isolation that will support those workflows. For more details, here is the Firefox bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=1549587 https://bugzilla.mozilla.org/show_bug.cgi?id=1549587 To enable Dynamic First Party Isolation: in Firefox Nightly's about:preferences#privacy, select "Custom" Enhanced Tracking Protection and "Cookies" = "Cross-site and social media trackers, and isolate remaining cookies". Or just set `network.cookie.cookieBehavior` pref = 5 in about:config.
- the_resistence 6y agoThanks very much. Useful