31 ms·

Latest Firefox rolls out Enhanced Tracking Protection 2.0

789 points by LinuxBender 6y ago

tarkin2 6y ago
I understand: cookies are deleted every 24 hours unless you’ve visited the site before in the last 45 days. Does this mean if I visit a site twice the cookie stays but otherwise it’s gone in 24 hours?
- ysavir 6y ago
  I think it means that 3rd party cookies will be deleted in 24 hours unless you visited the site of origin in the last 45 days. So if you get a 3rd party cookie from www.marketingsite.com, but never visited that site, it will be deleted in 24 hours. But if you get a 3rd party cookie from facebook, and you're a semi-active facebook user, the cookie will be kept.
  - cletusw 6y ago
    Thank you! I wasn't quite getting the 3rd party cookie vs. actual site visit distinction from their post.
  - tarkin2 6y ago
    I don't think it's only third party cookies. But all cookies if you've only visited the site once once in 24 hours. The article mentions you get redirected to a website before going to your destination, so the third-party cookie is no longer 'third' but 'first' since you (unbeknownst to you) visited the site.
    - ysavir 6y ago
      Looks like we're both not entirely correct (and probably both skipped the security blog posts!). In the security blog post, they explicitly say "An origin will be cleared if it [...] is classified as a tracker in our Tracking Protection list" and "[has] No origin with the same base domain (eTLD+1) has a user-interaction permission". So it's not a catch-all for any and all redirect trackers, just those Mozilla knows about, and whitelists trackers that are first-party in spirit. I do wish they didn't frame it as "we're blocking redirect trackers" but instead as "we extended our tracking blacklist to include known redirect trackers, unless we have a good reason to think you allow them".
bzb3 6y ago
I'm waiting for it to get so good that it becomes effective at removing the ads Mozilla added to the new tab page.
- dkdk8283 6y ago
  How else do they pay developers?
  - bzb3 6y ago
    With the huge paycheck they get from Google every year.
    - tuukkah 6y ago
      Being less dependent of Google (or any other actor) would be better for the world.
- Wowfunhappy 6y ago
  Tracking Protection is quite explicitly not an ad blocker. It blocks tracking, and that's not the same thing.
- ziddoap 6y ago
  As another user pointed out, this is anti-tracking not anti-advertisement. I can't help but wonder why you don't just go to the front page of your settings, and select "Blank page" on the "New tab" field though. Unless I am misunderstanding where you are talking about.
- neilsimp1 6y ago
  You can remove everything from the New Tab page to make it completely blank now, although I do agree I'd prefer if it was blank by default with no ads or anything.
- compscistd 6y ago
  Firefox > Preferences > Home > New Windows and Tabs (very first option!) > Homepage and New Windows, New Tabs > Blank Page I like that Firefox Home is the default option because you as the user are offered something. If you don't like it, you say no, go to the settings page, and are never offered it again. If you do like it or don't mind it, you keep it. Win-win. If Firefox Home wasn't on by default, those that might have preferred it wouldn't know what they're missing. It seems difficult to think someone would actually prefer ads but if there's some engagement, then that speaks for itself.
dependenttypes 6y ago
I never understood this feature. Why not use an addon instead? Ublock origin for example is much better compared to the firefox tracking protection.
- ocdtrekkie 6y ago
  Because the default should be to block tracking. We just shouldn't allow it. Imagine someone telling you a popup blocker (something even IE8 had standard) should be acquire separately.
  - kgwxd 6y ago
    I agree with parent though, Firefox should just ship with uBlock Origin installed. I think putting privacy features in the hands of a third-party prevents some poor choices being made due to several conflicts of interest browser vendors have.
    - ocdtrekkie 6y ago
      Addons pose a significant increased security risk. (I would honestly advocate for the radical position of requiring you enable a "allow addons" checkbox, with a warning, before installing any browser extensions.) I absolutely agree that browser vendors have huge conflicts of interest, and we need to address those by forcibly separating browsers from companies inherently in conflict with privacy.
      - SamuelAdams 6y ago
        Yep, just remember the controversy when Firefox included Pocket naively. Some people loved it, others hated it.
    - jonnytran 6y ago
      Luckily, Mozilla is a non-profit organization. Their interests do not conflict with protecting their users. But it makes you wonder, if other browser vendors' interests do conflict with ad blocking, why would they ship with uBlock Origin? They would want to control what most people do by controlling the defaults. The vast majority of users never change the default settings.
vikbytes 6y ago
This is fantastic. I never liked the cookies sticking around forever, and managing them manually was a massive pain if you wanted to keep some of them. Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once.
- Yoric 6y ago
  > Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once. Is that still the case? I remember that one of the developers was seriously working on improving that.
  - vikbytes 6y ago
    Yep, still a problem for me last week, deleting entries numbering more than about 300 seems to be the magical breaking point.
  - ainar-g 6y ago
    Yes. The “magic number” seems to be 300 items on my machine. Anything above that will start to seriously freeze the browser.
  - weaksauce 6y ago
    I remember looking into this and it's a bit of a tangle. some of the oldest code in the codebase I think.
  - catalogia 6y ago
    > Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once. Nine year old bug related to this: https://bugzilla.mozilla.org/show_bug.cgi?id=734643 https://bugzilla.mozilla.org/show_bug.cgi?id=734643 The 'Library' window in general is clearly neglected trash. For instance it still doesn't get themed like the rest of Firefox.
- ainar-g 6y ago
  > This is fantastic. I never liked the cookies sticking around forever, and managing them manually was a massive pain if you wanted to keep some of them. You might like the CookieAutoDelete plugin[1]. It's a recommended plugin which allows you to set a list of domains and domain patterns which retain their cookies while others are deleted. I've been using it for a couple of months now, and I love it. [1] https://addons.mozilla.org/en-GB/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-GB/firefox/addon/cookie-autode...
DangerousPie 6y ago
Nice. Firefox has making some great improvements recently.
UI_at_80x24 6y ago
I've been a user since they first split from Netscape. Very happy to see continued efforts in this project. Congrats folks! I'm glad you exist. Related: I don't know if this applies to other platforms, but the newest version of FireFox on FreeBSD (79.0,1) generates errors on every website you visit stating insufficient security. (including google & mozilla.org) This is somehow related to not having a virus scanner installed or something. This is the about:config setting to disable that: network.http.spdy.enabled.http2=false
- drewg123 6y ago
  I'm running the same version of Firefox on FreeBSD (firefox-79.0,1) and I don't see this (with http2=true). I'm running 13-current (r363668) and using the 12-stable quarterly packages (FreeBSD:12:amd64/quarterly)
  - UI_at_80x24 6y ago
    I'm running 12.1-RELEASE-p5 [quarterly], so that's interesting. We should be overlapping somewhat. I inclined to believe that it's just my luck. You need somebody to find edge-case bugs? I'm your stooge.
    - floatingatoll 6y ago
      If you'd like the Firefox team to investigate that issue further, I imagine they'd certainly welcome a bug filed about it: https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&component=General https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&c...
    - drewg123 6y ago
      I hear that. The latest update to kde / plasma5 changed something enough that it took me 4 logins before I got a task manager. Dealing with these these super disruptive / breaking kde changes only a few times a year are why I run the stable packages rather than the -current packages. I think I'm just going to give up and switch to lxde
tdhz77 6y ago
I keep encouraging people to use Firefox over the others. My efforts keep failing. Mozilla’s focus on privacy is important and should be to others. People have been burned in the past and are willing to give up privacy for something that just works. The irony.
- deleted 6y ago
  [deleted]
- mitchdoogle 6y ago
  Do people think Firefox doesn't work? I've noticed zero difference between using Firefox and Chrome and I've used both daily for five years or so.
  - Widow 6y ago
    Google has an incredible walled garden of apps and things that 'just' work together seamlessly. I remember switching from FF to Chrome years ago as Chrome was measurably faster. The staying power was using Google's entire suite of apps with Chrome. Things like copying and pasting without formatting or searching for strings all contribute to stickiness.
    - infinityplus1 6y ago
      I have to frequently open Google Meet in Chrome because other users can't see my screen while screen sharing using Firefox.
      - kiwijamo 6y ago
        Interestingly, when we had lockdown in my country I tried using Google Meets in Chrome and it just shat itself. Switched to Firefox and Meets worked so much better in Firefox. Very strange...
      - BuckRogers 6y ago
        It works fine in Edge as well if you don't want to support that sort of neglectful behavior by Google.
atombender 6y ago
I'm a fan of ETP, except it breaks a lot of sites that use embeds. For example, sites that use Twitter or Instagram [1] embeds won't show the embeds. And there's no way, as far as I can tell, to whitelist those. The only solution is to whitelist the sites that have embeds, but that ends up enabling all the tracking and stuff you don't want. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1446243 https://bugzilla.mozilla.org/show_bug.cgi?id=1446243
- duhi88 6y ago
  Pretty sure that embeds enable all the tracking stuff you don't want, too.
  - ffpip 6y ago
    Yes. Embeds aren't broken, they just appear text only. When you block twitter embeds , you can't like the tweet without opening the tweet in a separate tab. You can't do both. Either have the like functionality, or block it.
- ilikehurdles 6y ago
  Sounds like a good idea would be to somehow run the embeds in their own isolated container? Not sure how feasible that feature would be to implement.
  - atombender 6y ago
    Indeed. Twitter, Instagram, and YouTube embeds all use iframes, so it should be entirely feasible to run these things in isolated containers.
    - the8472 6y ago
      adding the sandbox, csp and referrerpolicy attributes to the iframe when it gets inserted to the DOM tree allows a lot of fine-grained control. Adding sandbox without allow-same-origin puts it into a null origin which makes the iframe isolated from all other origins which is similar to an ephemeral container. It might break CORS stuff though.
Ijumfs 6y ago
It all seems pretty pointless when every tracker tracks you by IP address and the only real way to defeat this is to use Tor, which BTW is blocked on an ever-growing list of sites.
- anonymousDan 6y ago
  Hmm, is there anyway to configure tor to reduce the number of hops in order to improve performance? It seems like multihop Tor is overkill for this use case. Wouldn't solve the problem with sites blocking Tor I guess.
- M2Ys4U 6y ago
  IP is a much coarser level of tracking, for most people. GCNAT, roaming (WiFi <-> mobile), shared networks (NAT/IPv6 Privacy Addresses). All of these things mean you can't be sure you're tracking the _same_ person, unlike with cookies.
wadkar 6y ago
This sounds very similar to Safari blocking/deleting cookies?
MilaM 6y ago
Does this mean that data from actively visited sites (first-party) will be automatically deleted 45 days after the last visit?
colordrops 6y ago
Off topic, but every time I see an article like this I load up Firefox and try it out to see how it has progressed. I inevitably stop using it, and this time I decided to introspect and see why. It turns out that it's mouse wheel scrolling doesn't feel as snappy as other browsers, and for some reason it bothers me a lot. I'm going to try changing the scroll wheel settings and see if I can stick with it.
- philliphaydon 6y ago
  Honestly I don’t notice any difference between FF and Chrome for scrolling. What do you mean it doesn’t feel as snappy?
- m463 6y ago
  I've noticed some sites affect scrolling somehow, either because they intercept it somehow, or you scroll over a text box or some other widget and the scrolling targets the box instead of the page. I think if you can keep the mouse off the page and on the scrollbar at the side (I'm on mac) it scrolls more predicably.
- weaksauce 6y ago
  that's funny because in chrome i hate the scrolling because it doesn't have the middle mouse click autoscroll feature and all the "solutions" to fix that are janky webextensions.
  - fireattack 6y ago
    Chrome has autoscroll here, on Windows. What platform do you use?
    - weaksauce 6y ago
      mac os... they may have added it since i stopped using it. but i like firefox more for it not being google
- robbyking 6y ago
svnpenn 6y ago
> Latest Firefox rolls out Enhanced Tracking Protection 2.0; blocking redirect trackers by default Isnt that what is used with Google Search? For example if you go here: https://www.google.com/search?q=sunday https://www.google.com/search?q=sunday the first result appears to be: https://en.wikipedia.org/wiki/Sunday https://en.wikipedia.org/wiki/Sunday but its really: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiE45DBuoTrAhUJP60KHb-LAgcQFjAAegQIAhAB&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSunday&usg=AOvVaw3AEEL2UuDK8DJPu1wtWera https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...
- martin-adams 6y ago
  If that's true, surely that's going to play havoc for the Search Console
- tamwahba 6y ago
  It seems like the feature here is 'blocking' the trackers by deleting cookies from sites you haven't interacted with. It's not preventing the redirect as far as I understand.
- input_sh 6y ago
  More details here[0], but in short, they'll "block them" by deleting cookies and site data of redirect trackers every 24h, preventing long term profile building, while not breaking the redirects. There's also a "Google search link fix" recommended extension that fixes those URLs (replaces https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiE45DBuoTrAhUJP60KHb-LAgcQFjAAegQIAhAB&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSunday&usg=AOvVaw3AEEL2UuDK8DJPu1wtWera https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c... to https://en.wikipedia.org/wiki/Sunday https://en.wikipedia.org/wiki/Sunday in your example). Also available for Chrome and Opera. [0] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Privacy/Redirect_Tracking_Protection https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Pri...
  - godzillabrennus 6y ago
    Those fixes still have to resolve the url. The best fix is using duck.com and getting off Google search.
xref 6y ago
Hopefully this will make affiliate-link based sites like Wirecutter change their ways. I dont mind them earning affiliate money but I can’t even click a link at Wirecutter anymore since their bounce redirect to Amazon or wherever is totally blocked by my DNS settings originally via AdGuard now via nextdns.io
- untog 6y ago
  Can you add an exception for the site? It seems like a slightly inconsistent position that you don't mind them earning affiliate money yet you're actively blocking them from doing so.
  - deleted 6y ago
    [deleted]
  - clairity 6y ago
    it seems the objection is to unearned affiliate revenue (for any purchases at amazon for some period just for visiting wirecutter), not earned affiliate revenue (by clicking on a product you intend to buy), which is consistent and fair.
    - untog 6y ago
      From what the OP said I don't think that's the case. They're specifically talking about clicking on links not working.
      - clairity 6y ago
        i read it as links between pages on wirecutter, not out (i haven't tested if theres actually an interstitial affiliate marker page though).
    - shostack 6y ago
      What you described sounds like cookie stuffing and is almost certainly prohibited by Amazon and any competently run affiliate network/program.
gruez 6y ago
Can we talk about how google isn't affected by any sort of mainstream tracking protection? They're not going to be affected by this, because you visit google domains (directly or indirectly) multiple times daily. They're also not affected by blacklists, because they own recaptcha, and that's explicitly whitelisted in in popular blocking lists.
octernion 6y ago
i switched to firefox after using chrome for close to a decade and it's been a breath of fresh air -- very excited and congrats on the launch!
acd 6y ago
Mozilla are the Good Girls and Good Guys of the Internet! They do the right thing. Its also quite easy to see who are the bad actors.
shock 6y ago
Unfortunately, even with Enhanced Tracking Protection 2.0 you can still be tracked by using ETags. There are extensions for Firefox that block ETag tracking, but I haven't reviewed a specific extension sufficiently to recommend one.
- ffpip 6y ago
  Remove Etags with the CleanURL addons. Just turn off everything else it does, if you only want to remove ETag. Clean URL cleans many links. No utm_source, no amazon trackers, no google/yandex changing links just right before you click it. It has adblock built in, so turn it off if you already have an adblocker. You can also do it with https://addons.mozilla.org/en-US/firefox/addon/netflix-party-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/netflix-party...
  - benhurmarcel 6y ago
    I wish CleanURL had a whitelist. It breaks a few websites.
    - ffpip 6y ago
      What feature of Clean URL breaks the website? E-Tag removal? Can you link a site here or report to https://gitlab.com/KevinRoebert/ClearUrls https://gitlab.com/KevinRoebert/ClearUrls ?
      - benhurmarcel 6y ago
        I don't know which one it is, I'd have to investigate more. I don't have a Gitlab account yet. One example is hey.com's webmail. With ClearURL messages are never marked as read.
  - mderazon 6y ago
    Wow first time I read about etag tracking. The creativity of adtech companies is really impressive
shock 6y ago
If you can tolerate it, I recommend using Temporary Containers as a supercharged version of Enhanced Tracking Protection.
DavideNL 6y ago
So which version of Firefox will have this feature?
- floatingatoll 6y ago
  The post says that it's being rolled out gradually on Release channel, so as long as you haven't blocked automatic updates in various ways, you'll get it soon (assuming that the rollout continues without any significant issues being uncovered that halt it). Presumably if you want to run ahead of that, there's ways to get it early via Beta or Nightly channels, but I don't know what those are.
daffy 6y ago
Qutebrowser with a Firefox backend would be nice.
- The-Compiler 6y ago
  Still waiting for Servo or https://mozilla.github.io/geckoview/ https://mozilla.github.io/geckoview/ to be usable as a library on desktop platforms. Unfortunately, that hasn't happened so far...
mancerayder 6y ago
I'm happy to see stuff like this. I'd be even happier if the tricks to get video to play were somehow canceled. I have adblocker and video blockers, but somehow, news sites have a video that plays. If I scroll off the page, the video pops out into the lower right hand of the page and resumes playing, even if the big version of the video at the top of the page was stopped /paused (which it is by default), and it needs to be stopped again. On mobile (Android) this is a double nightmare, even in Firefox, because the little video has a tiny little X, and somehow my finger doesn't ever hit X the first time. I can plug in a USB-A connector in the right way faster than I can press that little X. Is there an explanation for this, and am I the only one?
- tome 6y ago
  Isn't the small video in the corner a feature actually implemented in Firefox itself (picture-in-picture) and nothing to do with the web page? If so then that seems doubly bad!
  - calmworm 6y ago
    Firefox doesn't force it. The feature is that you have the option to pull the embedded video into a non static location within your browser window. So you could allow the video to play in view while you scroll through the remainder of the page.
  - ric2b 6y ago
    No, the Firefox PiP requires you to click a blue icon, it doesn't activate automatically when you scroll off the video.
- floatingatoll 6y ago
  If you temporarily set about:config "image.animation_mode" to the value "none", and then restart Firefox, does it stop that video from autoplaying? If so, it's because they're using an animated GIF, which isn't a video. (You can right-click the value you modified in about:config to Reset it back to the default, so that animated GIFs work again, after you're done testing that.)
- 6y ago
onyva 6y ago
The only browser we can trust today. Glad to see they’re making privacy online a priority, on top of an already amazing browser I use regularly and exclusively both on Linux and iOS.
- subhro 6y ago
  Honest question, what's wrong with Safari, that you can not trust it?
  - andrewshadura 6y ago
    It's not open source, how can you trust it?
    - subhro 6y ago
      I thought Webkit, the core engine is open source. Or, are you saying Webkit != Safari?
      - jasonlotito 6y ago
        Safari can use Webkit, but Webkit isn't Safari. Basically, if Webkit = Safari, then anything using Webkit would also be equally safe.
    - jneplokh 6y ago
      But if you are using iOS, aren’t you already trusting Apple?
  - onyva 6y ago
    Firefox sync is not something I’m willing to give up. Also like Firefox UI better compared with safari on iOS.
  - TacoToni 6y ago
    I use safari on my Mac and iOS devices, but switched from Chrome to Firefox on my work PC.
dzink 6y ago
What stops trackers from using local storage on redirects instead?
typon 6y ago
My friend who works in an adtech company: "Protip: Use Firefox instead of Chrome. We get very little data from Firefox users"
- stiray 6y ago
  Protip #2, for what cant be traced using conventional methods, they will use fingerprinting and those add-ons take care about most common methods of fingerprinting - canvas, webgl, fonts and audio: https://addons.mozilla.org/en-US/firefox/addon/canvas-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/canvas-finger... https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... https://addons.mozilla.org/en-US/firefox/addon/font-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/font-fingerpr... https://addons.mozilla.org/en-US/firefox/addon/audioctx-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/audioctx-fing... I would really love to have more addins like this, doing one thing and doing it good. They will kill fingerprinting and as a proof, I was downvoted the next moment i posted the links in another post but I want you to know there is a way out.
  - deleted 6y ago
    [deleted]
  - xvector 6y ago
    Firefox already includes many of these, some of those plugins are redundant or unnecessary.
    - danShumway 6y ago
      > already includes many of these Make sure you turn them on though! Firefox by default doesn't block canvas fingerprinting, that's a setting you need to enable in `about:config` under the `privacy.resistFingerprinting` section.
      - maltalex 6y ago
yelloworangefog 6y ago
I'm really happy to be using Firefox again. I had abandoned it in favor of Chrome around 2014 because of how sluggish it had been getting. They really got it together with the quantum update though in my opinion. It still gets outperformed by Chrome (especially in the javascript department), but it's not a big enough difference to be a deal breaker for me, and I like feeling like I'm doing my small part to help combat Chrome's growing monopoly.
markosaric 6y ago
Nice improvements! Firefox keeps delivering! But Chrome browser market share is now up on 71% while Firefox is down to 7.3% :(
- aembleton 6y ago
  How is that market share determined? Is it by looking at data from tracking? Those tracking numbers will reduce, the more that Firefox cracks down on it. User agents hitting server logs are probably more accurate now.
  - bishalb 6y ago
    Maybe via user agent headers.
nabaraz 6y ago
If only I can get Chromecast working on Firefox. I would never touch Chrome ever again.
- rmorey 6y ago
  I mean, you would still be touching chrome, as Chromecast devices are well, running Chrome... but your point is taken
gentleman11 6y ago
Epic games seems to be using captchas for ue4 accounts that break for Firefox users who are using tracking protection. Not a complaint against Firefox, just very annoyed by game dev in general for privacy reasons. - more or less forced to use windows for development / to access marketplace content - have to modify engine source code to disable analytics - have to use Chrome to access their sites and dashboards I really miss my old Linux setup
tgb 6y ago
I'm trying to get myself to finally switch to Firefox thanks to this post. But I'm having problems with ctrl +/- changing of font sizes. In Chrome, that setting affects one domain only. Here I'm getting confused because I open a new tab and the font is tiny or huge, even sometimes on sites I've never visited before. Ctrl 0 fixes it but then I seem to reset sites that I do want enlarged (like HN). What's the logic here? I haven't figured out the steps to reproduce this, it seems random.
- irontinkerer 6y ago
  I've had the same experience! Well sort of, I think it's related to the experimental zoom I enabled. Trying to track down how to reproduce so I can open a bug, but it's sporadic for me. Other than that, I'm pretty happy with the browser
  - tgb 6y ago
    I've possibly figured it out. If you scroll quickly and while the inertia carries the scrolling onwards hit ctrl+w to close the tab, it'll resize the next tab that gains focus. Presumably that's because ctrl is held down and it's scrolling, even though the scrolling is only from inertia. Obviously scrolling shouldn't carry over to the new tab, so it does look like a bug. Moreover, it also resizes the website of the tab you just closed. Guess I need to submit a bug report. Edit: apparently Bugzilla requires passwords longer than 10 characters - wow! At least the that's the error I got (password too short) when I tried to sign up. Seems excessive.
apotatopot 6y ago
meanwhile I typed a draft of an email with links in it and 2 seconds after saving it got an email from Mozilla saying "stop sending yourself links via email!". I'm not OK with that.
nightski 6y ago
I'm on the latest Firefox and it's allowing a Set-Cookie with the Secure flag over http (for localhost). This seems wrong to me, but maybe it's allowed for localhost specifically? Anyone else experience this?
- bugmen0t 6y ago
  Yes. localhost is considered a Secure Context via https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin https://w3c.github.io/webappsec-secure-contexts/#potentially... - This is intentional to testing APIs which require a Secure Context easier to use during development. E.g., ServiceWorkers.
symlinkk 6y ago
What if cookies were opt in? E.g. blocked by default everywhere unless you decide to allow them, same as access to the webcam for example.
- xook 6y ago
  Side benefit: It helps a ton with testing changes instead of clearing everything and starting over!
- dgb23 6y ago
  I want this rather than the weird cookie messages that you get everywhere now.
eklavya 6y ago
I wish Apple realised that more competition in browsers on iOS is better for the user and they shouldn’t be greedy about it. How wonderful would it be to have proper Firefox in iOS.
- parsimo2010 6y ago
  I use Firefox on iOS. It has some tracking protection. Probably not the full-fat version of desktop Firefox, but I find it to be more tolerable than Safari on iOS.
kgraves 6y ago
Why should I trust Firefox with this "enhanced tracking protection 2.0", when Mozilla gets their funding from Google just to be the default search engine?
stiray 6y ago
Add those add-ons: https://addons.mozilla.org/en-US/firefox/addon/canvas-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/canvas-finger... https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... https://addons.mozilla.org/en-US/firefox/addon/font-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/font-fingerpr... https://addons.mozilla.org/en-US/firefox/addon/audioctx-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/audioctx-fing... I would really love to have more addins like this, doing one thing and doing it good. They will kill fingerprinting and as a proof, I was downvoted the next moment i posted the links.
- simonebrunozzi 6y ago
  Not sure that's the reason why you were downvoted. Perhaps (I am trying to guess) it would have been more helpful to explain why these four add-ons, individually, are so necessary. Or perhaps a more expanded comment on why you picked these, and what effect they provide.
alleyshack 6y ago
I want to switch to Firefox, but of all things, its tab management is keeping me away. On my last try, I gave up after five minutes because I couldn't see all my open tabs at once (had to scroll). Does anyone know of an extension or setting I can use to force Chrome-like tab behavior, where all tabs are shown at once regardless of how small they become?
- ric2b 6y ago
  I use tree style tabs, which is amazing for tab hoarders like me: https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/ https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...
  - alleyshack 6y ago
    Do you still have to navigate? Like, click or scroll or whatever, to get between tabs? I'm looking for a UI that shows me all my tabs, all at once, no clicks/scrolling/navigation required.
- LocalPCGuy 6y ago
  For people with a lot of tabs, I recommend trying a Vertical Tabs add-on. I am currently using Vertical Tabs Reloaded, but there are a couple different ones. Usually people have plenty of horizontal space and you have a scrollable sidebar with all your tabs in it.
  - alleyshack 6y ago
    Thanks, but I'm looking for something that doesn't require scrolling - where I can see all my open tabs at the same time, no scrolling, clicks, or other interaction required. I toggle between tabs a LOT, and having to scroll or otherwise navigate to find the right tab is a hard no for me.
    - LocalPCGuy 6y ago
      The Firefox search also searches open tabs a lot. Which could be even quicker than using the mouse. There is a limit on Chromium browsers - tabs smaller than the favicon aren't really that useful.
btrask 6y ago
https://support.mozilla.org/en-US/kb/how-do-you-use-leanplum-firefox https://support.mozilla.org/en-US/kb/how-do-you-use-leanplum... > What data is collected and sent to the Leanplum backend? > Leanplum tracks events such as when a user loads bookmarks, opens a new tab, opens a Pocket trending story, clears data, saves a password and login, takes a screenshot, downloads media, interacts with a search URL or signs in to a Firefox Account.
SamuelAdams 6y ago
Honestly the best thing you can do is use Firefox and set the browser settings to "Never remember history". This deletes everything in the cache, cookies, etc every time your browser closes. Drawbacks - you have to log back in to every site every time you relaunch the browser. But then these cookies and tracking methods do not follow you around.
rootusrootus 6y ago
Will this be enough to trigger the Google captcha punishment on every site I go to? I already run into that more than I'd like.
jchook 6y ago
Surprisingly extensive article from Brave[1] from Aug 2018 -- two years ago! About redirect tracking, it says this: > Brave’s policy of disallowing any third party state by default makes it already more privacy-preserving than ITP 2.0 in regards to third party redirection-based tracking. Brave users however may benefit from an ITP-like protection from first-party trackers, although their number is small. Apparently Safari had ITP, a similar type of redirect tracking mitigation, for some time. 1. https://brave.com/redirection-based-tracking/ https://brave.com/redirection-based-tracking/
Razengan 6y ago
I love Firefox as an alternative to Chrome but I hate how it goes of its way to be as cumbersome as possible. Witness this example of the most terrible UI ever; how frustratingly convoluted it is to delete specific cookies: 1: Open Preferences 2: Search "cookies" 3: See a bunch of cluttered stuff 4: Scroll all the way down to "Cookies and Site Data" 5: Click "Clear Data" 6: Oops, that's not it. Cancel and try "Manage Data" 7: Search "google" for example (to avoid their crappy tactic of signing you into Search when you sign into YouTube or Gmail, but that's another story) 8: Click "Remove All Shown" 9: Click "Save Changes" 10: Get hit with a modal alert in your face showing you the list of changes to confirm. 11: Click "Remove" https://i.imgur.com/QrE4EH3.gif https://i.imgur.com/QrE4EH3.gif
- corford 6y ago
  It isn't great but imho it's better than Chrome which confuses me each time and feels super limited: 1. Open settings 2. Privacy and security 3. Scroll down to find the tiny "See all cookies and site data" 4. Use the search box for the site you want 5. Then you only have the option of removing everything from that site?? There's a little X icon to the right of each cookie but clicking it does nothing Unless there's a better way I haven't seen (I use chrome infrequently)
treefry 6y ago
Recently Amazon starts to ask for OTP every time I open its website. Is it due to the new tracking protection feature?
perryizgr8 6y ago
I think Firefox's first order of business should be to focus on making it as good as Chrome first, then focus on other things. I can do all the blocking I want on Chrome with extensions. I cannot make Firefox fast, or work well with the touchpad with any extension.
joveian 6y ago
Another option is to always delete cookies and site data when you close Firefox and set exceptions for the few sites you care about. If you are like me and only start Firefox once or twice a day this prevents too much annoyance while limiting cookie based tracking. Also, Mozilla should really think about what is wrong with the statement "Since we enabled ETP by default, we’ve blocked 3.4 trillion tracking cookies." I imagine most people who care about tracking would like to not be tracked by anyone, not just anyone other than Mozilla.
hi41 6y ago
I think we should buy either windows or apple based computers instead of chromebooks because the former allows us to install Firefox while the latter does not allow that. I tried Firefox recently and I really liked it.
k_sze 6y ago
I don't quite understand. The latest version of FF is 79.0, released on July 28. This article is dated Aug 4. So is Mozilla going to remotely activate ETP 2.0 for users of FF 79 without requiring an update?
BuckRogers 6y ago
From reading the comments, it sounds like the only real choice is the Tor Browser if you want to be anonymous, or just accept all of it and use your device's native browser for best performance. What I'd be interested to know is if all of this anti-tracking technology matters if you just isolate domains by using containers. My guess is that Google and company have so many tracking domains that containers have no impact on that, at least 3rd party. But it seems like part of a real solution.

789 points by LinuxBender 6y ago

I understand: cookies are deleted every 24 hours unless you’ve visited the site before in the last 45 days. Does this mean if I visit a site twice the cookie stays but otherwise it’s gone in 24 hours?

ysavir 6y ago
I think it means that 3rd party cookies will be deleted in 24 hours unless you visited the site of origin in the last 45 days. So if you get a 3rd party cookie from www.marketingsite.com, but never visited that site, it will be deleted in 24 hours. But if you get a 3rd party cookie from facebook, and you're a semi-active facebook user, the cookie will be kept.
- cletusw 6y ago
  Thank you! I wasn't quite getting the 3rd party cookie vs. actual site visit distinction from their post.
- tarkin2 6y ago
  I don't think it's only third party cookies. But all cookies if you've only visited the site once once in 24 hours. The article mentions you get redirected to a website before going to your destination, so the third-party cookie is no longer 'third' but 'first' since you (unbeknownst to you) visited the site.
  - ysavir 6y ago
    Looks like we're both not entirely correct (and probably both skipped the security blog posts!). In the security blog post, they explicitly say "An origin will be cleared if it [...] is classified as a tracker in our Tracking Protection list" and "[has] No origin with the same base domain (eTLD+1) has a user-interaction permission". So it's not a catch-all for any and all redirect trackers, just those Mozilla knows about, and whitelists trackers that are first-party in spirit. I do wish they didn't frame it as "we're blocking redirect trackers" but instead as "we extended our tracking blacklist to include known redirect trackers, unless we have a good reason to think you allow them".

bzb3 6y ago

I'm waiting for it to get so good that it becomes effective at removing the ads Mozilla added to the new tab page.

dkdk8283 6y ago
How else do they pay developers?
- bzb3 6y ago
  With the huge paycheck they get from Google every year.
  - tuukkah 6y ago
    Being less dependent of Google (or any other actor) would be better for the world.
Wowfunhappy 6y ago
Tracking Protection is quite explicitly not an ad blocker. It blocks tracking, and that's not the same thing.
ziddoap 6y ago
As another user pointed out, this is anti-tracking not anti-advertisement. I can't help but wonder why you don't just go to the front page of your settings, and select "Blank page" on the "New tab" field though. Unless I am misunderstanding where you are talking about.
neilsimp1 6y ago
You can remove everything from the New Tab page to make it completely blank now, although I do agree I'd prefer if it was blank by default with no ads or anything.
compscistd 6y ago
Firefox > Preferences > Home > New Windows and Tabs (very first option!) > Homepage and New Windows, New Tabs > Blank Page I like that Firefox Home is the default option because you as the user are offered something. If you don't like it, you say no, go to the settings page, and are never offered it again. If you do like it or don't mind it, you keep it. Win-win. If Firefox Home wasn't on by default, those that might have preferred it wouldn't know what they're missing. It seems difficult to think someone would actually prefer ads but if there's some engagement, then that speaks for itself.

dependenttypes 6y ago

I never understood this feature. Why not use an addon instead? Ublock origin for example is much better compared to the firefox tracking protection.

ocdtrekkie 6y ago
Because the default should be to block tracking. We just shouldn't allow it. Imagine someone telling you a popup blocker (something even IE8 had standard) should be acquire separately.
- kgwxd 6y ago
  I agree with parent though, Firefox should just ship with uBlock Origin installed. I think putting privacy features in the hands of a third-party prevents some poor choices being made due to several conflicts of interest browser vendors have.
  - ocdtrekkie 6y ago
    Addons pose a significant increased security risk. (I would honestly advocate for the radical position of requiring you enable a "allow addons" checkbox, with a warning, before installing any browser extensions.) I absolutely agree that browser vendors have huge conflicts of interest, and we need to address those by forcibly separating browsers from companies inherently in conflict with privacy.
    - SamuelAdams 6y ago
      Yep, just remember the controversy when Firefox included Pocket naively. Some people loved it, others hated it.
  - jonnytran 6y ago
    Luckily, Mozilla is a non-profit organization. Their interests do not conflict with protecting their users. But it makes you wonder, if other browser vendors' interests do conflict with ad blocking, why would they ship with uBlock Origin? They would want to control what most people do by controlling the defaults. The vast majority of users never change the default settings.

vikbytes 6y ago

This is fantastic. I never liked the cookies sticking around forever, and managing them manually was a massive pain if you wanted to keep some of them. Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once.

Yoric 6y ago
> Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once. Is that still the case? I remember that one of the developers was seriously working on improving that.
- vikbytes 6y ago
  Yep, still a problem for me last week, deleting entries numbering more than about 300 seems to be the magical breaking point.
- ainar-g 6y ago
  Yes. The “magic number” seems to be 300 items on my machine. Anything above that will start to seriously freeze the browser.
- weaksauce 6y ago
  I remember looking into this and it's a bit of a tangle. some of the oldest code in the codebase I think.
- catalogia 6y ago
  > Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once. Nine year old bug related to this: https://bugzilla.mozilla.org/show_bug.cgi?id=734643 https://bugzilla.mozilla.org/show_bug.cgi?id=734643 The 'Library' window in general is clearly neglected trash. For instance it still doesn't get themed like the rest of Firefox.
ainar-g 6y ago
> This is fantastic. I never liked the cookies sticking around forever, and managing them manually was a massive pain if you wanted to keep some of them. You might like the CookieAutoDelete plugin[1]. It's a recommended plugin which allows you to set a list of domains and domain patterns which retain their cookies while others are deleted. I've been using it for a couple of months now, and I love it. [1] https://addons.mozilla.org/en-GB/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-GB/firefox/addon/cookie-autode...

DangerousPie 6y ago

Nice. Firefox has making some great improvements recently.

UI_at_80x24 6y ago

I've been a user since they first split from Netscape. Very happy to see continued efforts in this project. Congrats folks! I'm glad you exist. Related: I don't know if this applies to other platforms, but the newest version of FireFox on FreeBSD (79.0,1) generates errors on every website you visit stating insufficient security. (including google & mozilla.org) This is somehow related to not having a virus scanner installed or something. This is the about:config setting to disable that: network.http.spdy.enabled.http2=false

drewg123 6y ago
I'm running the same version of Firefox on FreeBSD (firefox-79.0,1) and I don't see this (with http2=true). I'm running 13-current (r363668) and using the 12-stable quarterly packages (FreeBSD:12:amd64/quarterly)
- UI_at_80x24 6y ago
  I'm running 12.1-RELEASE-p5 [quarterly], so that's interesting. We should be overlapping somewhat. I inclined to believe that it's just my luck. You need somebody to find edge-case bugs? I'm your stooge.
  - floatingatoll 6y ago
    If you'd like the Firefox team to investigate that issue further, I imagine they'd certainly welcome a bug filed about it: https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&component=General https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&c...
  - drewg123 6y ago
    I hear that. The latest update to kde / plasma5 changed something enough that it took me 4 logins before I got a task manager. Dealing with these these super disruptive / breaking kde changes only a few times a year are why I run the stable packages rather than the -current packages. I think I'm just going to give up and switch to lxde

tdhz77 6y ago

I keep encouraging people to use Firefox over the others. My efforts keep failing. Mozilla’s focus on privacy is important and should be to others. People have been burned in the past and are willing to give up privacy for something that just works. The irony.

deleted 6y ago
[deleted]
mitchdoogle 6y ago
Do people think Firefox doesn't work? I've noticed zero difference between using Firefox and Chrome and I've used both daily for five years or so.
- Widow 6y ago
  Google has an incredible walled garden of apps and things that 'just' work together seamlessly. I remember switching from FF to Chrome years ago as Chrome was measurably faster. The staying power was using Google's entire suite of apps with Chrome. Things like copying and pasting without formatting or searching for strings all contribute to stickiness.
  - infinityplus1 6y ago
    I have to frequently open Google Meet in Chrome because other users can't see my screen while screen sharing using Firefox.
    - kiwijamo 6y ago
      Interestingly, when we had lockdown in my country I tried using Google Meets in Chrome and it just shat itself. Switched to Firefox and Meets worked so much better in Firefox. Very strange...
    - BuckRogers 6y ago
      It works fine in Edge as well if you don't want to support that sort of neglectful behavior by Google.

atombender 6y ago

I'm a fan of ETP, except it breaks a lot of sites that use embeds. For example, sites that use Twitter or Instagram [1] embeds won't show the embeds. And there's no way, as far as I can tell, to whitelist those. The only solution is to whitelist the sites that have embeds, but that ends up enabling all the tracking and stuff you don't want. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1446243 https://bugzilla.mozilla.org/show_bug.cgi?id=1446243

duhi88 6y ago
Pretty sure that embeds enable all the tracking stuff you don't want, too.
- ffpip 6y ago
  Yes. Embeds aren't broken, they just appear text only. When you block twitter embeds , you can't like the tweet without opening the tweet in a separate tab. You can't do both. Either have the like functionality, or block it.
ilikehurdles 6y ago
Sounds like a good idea would be to somehow run the embeds in their own isolated container? Not sure how feasible that feature would be to implement.
- atombender 6y ago
  Indeed. Twitter, Instagram, and YouTube embeds all use iframes, so it should be entirely feasible to run these things in isolated containers.
  - the8472 6y ago
    adding the sandbox, csp and referrerpolicy attributes to the iframe when it gets inserted to the DOM tree allows a lot of fine-grained control. Adding sandbox without allow-same-origin puts it into a null origin which makes the iframe isolated from all other origins which is similar to an ephemeral container. It might break CORS stuff though.

Ijumfs 6y ago

It all seems pretty pointless when every tracker tracks you by IP address and the only real way to defeat this is to use Tor, which BTW is blocked on an ever-growing list of sites.

anonymousDan 6y ago
Hmm, is there anyway to configure tor to reduce the number of hops in order to improve performance? It seems like multihop Tor is overkill for this use case. Wouldn't solve the problem with sites blocking Tor I guess.
M2Ys4U 6y ago
IP is a much coarser level of tracking, for most people. GCNAT, roaming (WiFi <-> mobile), shared networks (NAT/IPv6 Privacy Addresses). All of these things mean you can't be sure you're tracking the _same_ person, unlike with cookies.

wadkar 6y ago

This sounds very similar to Safari blocking/deleting cookies?

MilaM 6y ago

Does this mean that data from actively visited sites (first-party) will be automatically deleted 45 days after the last visit?

colordrops 6y ago

Off topic, but every time I see an article like this I load up Firefox and try it out to see how it has progressed. I inevitably stop using it, and this time I decided to introspect and see why. It turns out that it's mouse wheel scrolling doesn't feel as snappy as other browsers, and for some reason it bothers me a lot. I'm going to try changing the scroll wheel settings and see if I can stick with it.

philliphaydon 6y ago
Honestly I don’t notice any difference between FF and Chrome for scrolling. What do you mean it doesn’t feel as snappy?
m463 6y ago
I've noticed some sites affect scrolling somehow, either because they intercept it somehow, or you scroll over a text box or some other widget and the scrolling targets the box instead of the page. I think if you can keep the mouse off the page and on the scrollbar at the side (I'm on mac) it scrolls more predicably.
weaksauce 6y ago
that's funny because in chrome i hate the scrolling because it doesn't have the middle mouse click autoscroll feature and all the "solutions" to fix that are janky webextensions.
- fireattack 6y ago
  Chrome has autoscroll here, on Windows. What platform do you use?
  - weaksauce 6y ago
    mac os... they may have added it since i stopped using it. but i like firefox more for it not being google
robbyking 6y ago

svnpenn 6y ago

> Latest Firefox rolls out Enhanced Tracking Protection 2.0; blocking redirect trackers by default Isnt that what is used with Google Search? For example if you go here: https://www.google.com/search?q=sunday https://www.google.com/search?q=sunday the first result appears to be: https://en.wikipedia.org/wiki/Sunday https://en.wikipedia.org/wiki/Sunday but its really: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiE45DBuoTrAhUJP60KHb-LAgcQFjAAegQIAhAB&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSunday&usg=AOvVaw3AEEL2UuDK8DJPu1wtWera https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

martin-adams 6y ago
If that's true, surely that's going to play havoc for the Search Console
tamwahba 6y ago
It seems like the feature here is 'blocking' the trackers by deleting cookies from sites you haven't interacted with. It's not preventing the redirect as far as I understand.
input_sh 6y ago
More details here[0], but in short, they'll "block them" by deleting cookies and site data of redirect trackers every 24h, preventing long term profile building, while not breaking the redirects. There's also a "Google search link fix" recommended extension that fixes those URLs (replaces https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiE45DBuoTrAhUJP60KHb-LAgcQFjAAegQIAhAB&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSunday&usg=AOvVaw3AEEL2UuDK8DJPu1wtWera https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c... to https://en.wikipedia.org/wiki/Sunday https://en.wikipedia.org/wiki/Sunday in your example). Also available for Chrome and Opera. [0] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Privacy/Redirect_Tracking_Protection https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Pri...
- godzillabrennus 6y ago
  Those fixes still have to resolve the url. The best fix is using duck.com and getting off Google search.

xref 6y ago

Hopefully this will make affiliate-link based sites like Wirecutter change their ways. I dont mind them earning affiliate money but I can’t even click a link at Wirecutter anymore since their bounce redirect to Amazon or wherever is totally blocked by my DNS settings originally via AdGuard now via nextdns.io

untog 6y ago
Can you add an exception for the site? It seems like a slightly inconsistent position that you don't mind them earning affiliate money yet you're actively blocking them from doing so.
- deleted 6y ago
  [deleted]
- clairity 6y ago
  it seems the objection is to unearned affiliate revenue (for any purchases at amazon for some period just for visiting wirecutter), not earned affiliate revenue (by clicking on a product you intend to buy), which is consistent and fair.
  - untog 6y ago
    From what the OP said I don't think that's the case. They're specifically talking about clicking on links not working.
    - clairity 6y ago
      i read it as links between pages on wirecutter, not out (i haven't tested if theres actually an interstitial affiliate marker page though).
  - shostack 6y ago
    What you described sounds like cookie stuffing and is almost certainly prohibited by Amazon and any competently run affiliate network/program.

gruez 6y ago

Can we talk about how google isn't affected by any sort of mainstream tracking protection? They're not going to be affected by this, because you visit google domains (directly or indirectly) multiple times daily. They're also not affected by blacklists, because they own recaptcha, and that's explicitly whitelisted in in popular blocking lists.

octernion 6y ago

i switched to firefox after using chrome for close to a decade and it's been a breath of fresh air -- very excited and congrats on the launch!

acd 6y ago

Mozilla are the Good Girls and Good Guys of the Internet! They do the right thing. Its also quite easy to see who are the bad actors.

shock 6y ago

Unfortunately, even with Enhanced Tracking Protection 2.0 you can still be tracked by using ETags. There are extensions for Firefox that block ETag tracking, but I haven't reviewed a specific extension sufficiently to recommend one.

ffpip 6y ago
Remove Etags with the CleanURL addons. Just turn off everything else it does, if you only want to remove ETag. Clean URL cleans many links. No utm_source, no amazon trackers, no google/yandex changing links just right before you click it. It has adblock built in, so turn it off if you already have an adblocker. You can also do it with https://addons.mozilla.org/en-US/firefox/addon/netflix-party-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/netflix-party...
- benhurmarcel 6y ago
  I wish CleanURL had a whitelist. It breaks a few websites.
  - ffpip 6y ago
    What feature of Clean URL breaks the website? E-Tag removal? Can you link a site here or report to https://gitlab.com/KevinRoebert/ClearUrls https://gitlab.com/KevinRoebert/ClearUrls ?
    - benhurmarcel 6y ago
      I don't know which one it is, I'd have to investigate more. I don't have a Gitlab account yet. One example is hey.com's webmail. With ClearURL messages are never marked as read.
- mderazon 6y ago
  Wow first time I read about etag tracking. The creativity of adtech companies is really impressive

shock 6y ago

If you can tolerate it, I recommend using Temporary Containers as a supercharged version of Enhanced Tracking Protection.

DavideNL 6y ago

So which version of Firefox will have this feature?

floatingatoll 6y ago
The post says that it's being rolled out gradually on Release channel, so as long as you haven't blocked automatic updates in various ways, you'll get it soon (assuming that the rollout continues without any significant issues being uncovered that halt it). Presumably if you want to run ahead of that, there's ways to get it early via Beta or Nightly channels, but I don't know what those are.

daffy 6y ago

Qutebrowser with a Firefox backend would be nice.

The-Compiler 6y ago
Still waiting for Servo or https://mozilla.github.io/geckoview/ https://mozilla.github.io/geckoview/ to be usable as a library on desktop platforms. Unfortunately, that hasn't happened so far...

mancerayder 6y ago

I'm happy to see stuff like this. I'd be even happier if the tricks to get video to play were somehow canceled. I have adblocker and video blockers, but somehow, news sites have a video that plays. If I scroll off the page, the video pops out into the lower right hand of the page and resumes playing, even if the big version of the video at the top of the page was stopped /paused (which it is by default), and it needs to be stopped again. On mobile (Android) this is a double nightmare, even in Firefox, because the little video has a tiny little X, and somehow my finger doesn't ever hit X the first time. I can plug in a USB-A connector in the right way faster than I can press that little X. Is there an explanation for this, and am I the only one?

tome 6y ago
Isn't the small video in the corner a feature actually implemented in Firefox itself (picture-in-picture) and nothing to do with the web page? If so then that seems doubly bad!
- calmworm 6y ago
  Firefox doesn't force it. The feature is that you have the option to pull the embedded video into a non static location within your browser window. So you could allow the video to play in view while you scroll through the remainder of the page.
- ric2b 6y ago
  No, the Firefox PiP requires you to click a blue icon, it doesn't activate automatically when you scroll off the video.
floatingatoll 6y ago
If you temporarily set about:config "image.animation_mode" to the value "none", and then restart Firefox, does it stop that video from autoplaying? If so, it's because they're using an animated GIF, which isn't a video. (You can right-click the value you modified in about:config to Reset it back to the default, so that animated GIFs work again, after you're done testing that.)
6y ago

onyva 6y ago

The only browser we can trust today. Glad to see they’re making privacy online a priority, on top of an already amazing browser I use regularly and exclusively both on Linux and iOS.

subhro 6y ago
Honest question, what's wrong with Safari, that you can not trust it?
- andrewshadura 6y ago
  It's not open source, how can you trust it?
  - subhro 6y ago
    I thought Webkit, the core engine is open source. Or, are you saying Webkit != Safari?
    - jasonlotito 6y ago
      Safari can use Webkit, but Webkit isn't Safari. Basically, if Webkit = Safari, then anything using Webkit would also be equally safe.
  - jneplokh 6y ago
    But if you are using iOS, aren’t you already trusting Apple?
- onyva 6y ago
  Firefox sync is not something I’m willing to give up. Also like Firefox UI better compared with safari on iOS.
- TacoToni 6y ago
  I use safari on my Mac and iOS devices, but switched from Chrome to Firefox on my work PC.

dzink 6y ago

What stops trackers from using local storage on redirects instead?

typon 6y ago

My friend who works in an adtech company: "Protip: Use Firefox instead of Chrome. We get very little data from Firefox users"

stiray 6y ago
Protip #2, for what cant be traced using conventional methods, they will use fingerprinting and those add-ons take care about most common methods of fingerprinting - canvas, webgl, fonts and audio: https://addons.mozilla.org/en-US/firefox/addon/canvas-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/canvas-finger... https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... https://addons.mozilla.org/en-US/firefox/addon/font-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/font-fingerpr... https://addons.mozilla.org/en-US/firefox/addon/audioctx-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/audioctx-fing... I would really love to have more addins like this, doing one thing and doing it good. They will kill fingerprinting and as a proof, I was downvoted the next moment i posted the links in another post but I want you to know there is a way out.
- deleted 6y ago
  [deleted]
- xvector 6y ago
  Firefox already includes many of these, some of those plugins are redundant or unnecessary.
  - danShumway 6y ago
    > already includes many of these Make sure you turn them on though! Firefox by default doesn't block canvas fingerprinting, that's a setting you need to enable in `about:config` under the `privacy.resistFingerprinting` section.
    - maltalex 6y ago

yelloworangefog 6y ago

I'm really happy to be using Firefox again. I had abandoned it in favor of Chrome around 2014 because of how sluggish it had been getting. They really got it together with the quantum update though in my opinion. It still gets outperformed by Chrome (especially in the javascript department), but it's not a big enough difference to be a deal breaker for me, and I like feeling like I'm doing my small part to help combat Chrome's growing monopoly.

markosaric 6y ago

Nice improvements! Firefox keeps delivering! But Chrome browser market share is now up on 71% while Firefox is down to 7.3% :(

aembleton 6y ago
How is that market share determined? Is it by looking at data from tracking? Those tracking numbers will reduce, the more that Firefox cracks down on it. User agents hitting server logs are probably more accurate now.
- bishalb 6y ago
  Maybe via user agent headers.

nabaraz 6y ago

If only I can get Chromecast working on Firefox. I would never touch Chrome ever again.

rmorey 6y ago
I mean, you would still be touching chrome, as Chromecast devices are well, running Chrome... but your point is taken

gentleman11 6y ago

Epic games seems to be using captchas for ue4 accounts that break for Firefox users who are using tracking protection. Not a complaint against Firefox, just very annoyed by game dev in general for privacy reasons. - more or less forced to use windows for development / to access marketplace content - have to modify engine source code to disable analytics - have to use Chrome to access their sites and dashboards I really miss my old Linux setup

tgb 6y ago

I'm trying to get myself to finally switch to Firefox thanks to this post. But I'm having problems with ctrl +/- changing of font sizes. In Chrome, that setting affects one domain only. Here I'm getting confused because I open a new tab and the font is tiny or huge, even sometimes on sites I've never visited before. Ctrl 0 fixes it but then I seem to reset sites that I do want enlarged (like HN). What's the logic here? I haven't figured out the steps to reproduce this, it seems random.

irontinkerer 6y ago
I've had the same experience! Well sort of, I think it's related to the experimental zoom I enabled. Trying to track down how to reproduce so I can open a bug, but it's sporadic for me. Other than that, I'm pretty happy with the browser
- tgb 6y ago
  I've possibly figured it out. If you scroll quickly and while the inertia carries the scrolling onwards hit ctrl+w to close the tab, it'll resize the next tab that gains focus. Presumably that's because ctrl is held down and it's scrolling, even though the scrolling is only from inertia. Obviously scrolling shouldn't carry over to the new tab, so it does look like a bug. Moreover, it also resizes the website of the tab you just closed. Guess I need to submit a bug report. Edit: apparently Bugzilla requires passwords longer than 10 characters - wow! At least the that's the error I got (password too short) when I tried to sign up. Seems excessive.

apotatopot 6y ago

meanwhile I typed a draft of an email with links in it and 2 seconds after saving it got an email from Mozilla saying "stop sending yourself links via email!". I'm not OK with that.

nightski 6y ago

I'm on the latest Firefox and it's allowing a Set-Cookie with the Secure flag over http (for localhost). This seems wrong to me, but maybe it's allowed for localhost specifically? Anyone else experience this?

bugmen0t 6y ago
Yes. localhost is considered a Secure Context via https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin https://w3c.github.io/webappsec-secure-contexts/#potentially... - This is intentional to testing APIs which require a Secure Context easier to use during development. E.g., ServiceWorkers.

symlinkk 6y ago

What if cookies were opt in? E.g. blocked by default everywhere unless you decide to allow them, same as access to the webcam for example.

xook 6y ago
Side benefit: It helps a ton with testing changes instead of clearing everything and starting over!
dgb23 6y ago
I want this rather than the weird cookie messages that you get everywhere now.

eklavya 6y ago

I wish Apple realised that more competition in browsers on iOS is better for the user and they shouldn’t be greedy about it. How wonderful would it be to have proper Firefox in iOS.

parsimo2010 6y ago
I use Firefox on iOS. It has some tracking protection. Probably not the full-fat version of desktop Firefox, but I find it to be more tolerable than Safari on iOS.

kgraves 6y ago

Why should I trust Firefox with this "enhanced tracking protection 2.0", when Mozilla gets their funding from Google just to be the default search engine?

stiray 6y ago

Add those add-ons: https://addons.mozilla.org/en-US/firefox/addon/canvas-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/canvas-finger... https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... https://addons.mozilla.org/en-US/firefox/addon/font-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/font-fingerpr... https://addons.mozilla.org/en-US/firefox/addon/audioctx-fingerprint-defender https://addons.mozilla.org/en-US/firefox/addon/audioctx-fing... I would really love to have more addins like this, doing one thing and doing it good. They will kill fingerprinting and as a proof, I was downvoted the next moment i posted the links.

simonebrunozzi 6y ago
Not sure that's the reason why you were downvoted. Perhaps (I am trying to guess) it would have been more helpful to explain why these four add-ons, individually, are so necessary. Or perhaps a more expanded comment on why you picked these, and what effect they provide.

alleyshack 6y ago

I want to switch to Firefox, but of all things, its tab management is keeping me away. On my last try, I gave up after five minutes because I couldn't see all my open tabs at once (had to scroll). Does anyone know of an extension or setting I can use to force Chrome-like tab behavior, where all tabs are shown at once regardless of how small they become?

ric2b 6y ago
I use tree style tabs, which is amazing for tab hoarders like me: https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/ https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...
- alleyshack 6y ago
  Do you still have to navigate? Like, click or scroll or whatever, to get between tabs? I'm looking for a UI that shows me all my tabs, all at once, no clicks/scrolling/navigation required.
LocalPCGuy 6y ago
For people with a lot of tabs, I recommend trying a Vertical Tabs add-on. I am currently using Vertical Tabs Reloaded, but there are a couple different ones. Usually people have plenty of horizontal space and you have a scrollable sidebar with all your tabs in it.
- alleyshack 6y ago
  Thanks, but I'm looking for something that doesn't require scrolling - where I can see all my open tabs at the same time, no scrolling, clicks, or other interaction required. I toggle between tabs a LOT, and having to scroll or otherwise navigate to find the right tab is a hard no for me.
  - LocalPCGuy 6y ago
    The Firefox search also searches open tabs a lot. Which could be even quicker than using the mouse. There is a limit on Chromium browsers - tabs smaller than the favicon aren't really that useful.

btrask 6y ago

https://support.mozilla.org/en-US/kb/how-do-you-use-leanplum-firefox https://support.mozilla.org/en-US/kb/how-do-you-use-leanplum... > What data is collected and sent to the Leanplum backend? > Leanplum tracks events such as when a user loads bookmarks, opens a new tab, opens a Pocket trending story, clears data, saves a password and login, takes a screenshot, downloads media, interacts with a search URL or signs in to a Firefox Account.

SamuelAdams 6y ago

Honestly the best thing you can do is use Firefox and set the browser settings to "Never remember history". This deletes everything in the cache, cookies, etc every time your browser closes. Drawbacks - you have to log back in to every site every time you relaunch the browser. But then these cookies and tracking methods do not follow you around.

rootusrootus 6y ago

Will this be enough to trigger the Google captcha punishment on every site I go to? I already run into that more than I'd like.

jchook 6y ago

Surprisingly extensive article from Brave[1] from Aug 2018 -- two years ago! About redirect tracking, it says this: > Brave’s policy of disallowing any third party state by default makes it already more privacy-preserving than ITP 2.0 in regards to third party redirection-based tracking. Brave users however may benefit from an ITP-like protection from first-party trackers, although their number is small. Apparently Safari had ITP, a similar type of redirect tracking mitigation, for some time. 1. https://brave.com/redirection-based-tracking/ https://brave.com/redirection-based-tracking/

Razengan 6y ago

I love Firefox as an alternative to Chrome but I hate how it goes of its way to be as cumbersome as possible. Witness this example of the most terrible UI ever; how frustratingly convoluted it is to delete specific cookies: 1: Open Preferences 2: Search "cookies" 3: See a bunch of cluttered stuff 4: Scroll all the way down to "Cookies and Site Data" 5: Click "Clear Data" 6: Oops, that's not it. Cancel and try "Manage Data" 7: Search "google" for example (to avoid their crappy tactic of signing you into Search when you sign into YouTube or Gmail, but that's another story) 8: Click "Remove All Shown" 9: Click "Save Changes" 10: Get hit with a modal alert in your face showing you the list of changes to confirm. 11: Click "Remove" https://i.imgur.com/QrE4EH3.gif https://i.imgur.com/QrE4EH3.gif

corford 6y ago
It isn't great but imho it's better than Chrome which confuses me each time and feels super limited: 1. Open settings 2. Privacy and security 3. Scroll down to find the tiny "See all cookies and site data" 4. Use the search box for the site you want 5. Then you only have the option of removing everything from that site?? There's a little X icon to the right of each cookie but clicking it does nothing Unless there's a better way I haven't seen (I use chrome infrequently)

treefry 6y ago

Recently Amazon starts to ask for OTP every time I open its website. Is it due to the new tracking protection feature?

perryizgr8 6y ago

I think Firefox's first order of business should be to focus on making it as good as Chrome first, then focus on other things. I can do all the blocking I want on Chrome with extensions. I cannot make Firefox fast, or work well with the touchpad with any extension.

joveian 6y ago

Another option is to always delete cookies and site data when you close Firefox and set exceptions for the few sites you care about. If you are like me and only start Firefox once or twice a day this prevents too much annoyance while limiting cookie based tracking. Also, Mozilla should really think about what is wrong with the statement "Since we enabled ETP by default, we’ve blocked 3.4 trillion tracking cookies." I imagine most people who care about tracking would like to not be tracked by anyone, not just anyone other than Mozilla.

hi41 6y ago

I think we should buy either windows or apple based computers instead of chromebooks because the former allows us to install Firefox while the latter does not allow that. I tried Firefox recently and I really liked it.

k_sze 6y ago

I don't quite understand. The latest version of FF is 79.0, released on July 28. This article is dated Aug 4. So is Mozilla going to remotely activate ETP 2.0 for users of FF 79 without requiring an update?

BuckRogers 6y ago

From reading the comments, it sounds like the only real choice is the Tor Browser if you want to be anonymous, or just accept all of it and use your device's native browser for best performance. What I'd be interested to know is if all of this anti-tracking technology matters if you just isolate domains by using containers. My guess is that Google and company have so many tracking domains that containers have no impact on that, at least 3rd party. But it seems like part of a real solution.