7 ms·
> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-p
by 4cao 6y ago
> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers.
Would be great to have some more details about it: in particular, how do I turn it off if I prefer to add any exceptions manually.
Edit 1: Mozilla Hacks blog [1] has a bit more but still doesn't answer the question:
> In order to resolve these compatibility issues of State Partitioning, we allow the state to be unpartitioned in certain cases. When unpartitioning is taking effect, we will stop using double-keying and revert the ordinary (first-party) key.
What are these "certain cases?"
Edit 2: Reading on, there's this bit about storage access grants heuristics [2] linked from the blog. But is that really it, or is there a hardcoded whitelist as well? If so, it'd be great to see it.
This bit in particular is ambiguous in how it's supposed to work exactly (who's "we" here):
> If we discover that an origin is abusing this heuristic to gain tracking access, that origin will have the additional requirement that it must have received user interaction as a first party within the past 30 days.
1. https://hacks.mozilla.org/2021/02/introducing-state-partitioning/ https://hacks.mozilla.org/2021/02/introducing-state-partitio...
2. https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Privacy/Storage_access_policy#storage_access_grants https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Pri...
- kome 6y ago> Would be great to have some more details about it: in particular, how do I turn it off if I prefer to add any exceptions manually. (on mac) Firefox > Preferences > Privacy & Security > Custom
- 4cao 6y agoThe question is how to use "Total Cookie Protection" without any hardcoded or heuristics-based exceptions. Your answer seems to be about how to turn off "Enhanced Tracking Protection"/"Total Cookie Protection" or parts of it (resulting in weaker protection). I want to keep it enabled and disable the exceptions (for stronger protection), i.e. the opposite. I haven't installed the new version yet, so can't say for sure, but as far as I know there is no setting for this in that menu. [1] If I misunderstood what you meant, please elaborate. 1. https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop#w_adjust-your-global-enhanced-tracking-protection-settings https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...
- Caligatio 6y agoI agree I wish they had more detail about the exceptions. I've been a FPI user for years as a best-effort to reign in tracking but there are a common few sites that just break with FPI (50% of the time PayPal checkout doesn't work). Even if "Total Cookie Protection" is only 98% as effective as FPI, I'm making the switch. EDIT: FPI = first-party isolation
- johannh 6y agoYes, it’s essentially that, FPI with workarounds for common breakage. You should switch from FPI, this is essentially another take on FPI by some of its original developers, so it should have fewer issues overall, not just site breakage.
- lentil_soup 6y agoFPI?
- iruoy 6y agoFirst-Party Isolation https://www.ctrl.blog/entry/firefox-fpi.html https://www.ctrl.blog/entry/firefox-fpi.html
- mrweasel 6y agoIt will be interesting to see how many sites break with “Total Cookie Protection”. Currently I use what I consider are bare minimum of anti-tracking, that is what I can make Firefox provide on its own, plus the DuckDuckGo browser extention. Those two things alone break an alarming number of sites. The DDG extention is pretty regularly mistaken for an ad-blocker. Given Firefoxs low adoption, I fear that website owner will just ignore that their excessive tracking breaks their site in Firefox... “Works in Chrome... good enough”
- kiwijamo 6y agoI have strict tracking enabled in Firefox as well as uBlock Origin and I've yet to see a site broken. The only "broken" ones I've seen are badly coded ones that also fail to work in Chrome. Reputable sites tend to be just fine. YMMV.
- johannh 6y ago(I’m one of the developers of this feature and co-author of the blog posts) This is a great question and I’m glad you found the answer, you probably understand that for many blog posts we avoid going into too much technical detail. To answer your final question, there is no hardcoded allow-list for State Partitioning. The heuristics as described on MDN are accurate.
- 4cao 6y agoThank you for your clarification, and your work on Firefox. I guess that clears it up.
- stavros 6y agoHave you considered using something like Expounder (https://skorokithakis.github.io/expounder/ https://skorokithakis.github.io/expounder/) in your posts? (Disclosure, I made it but it's a small open source lib). I don't see why we can have full-blown web apps but our text needs to be very specifically just text these days.
- atleta 6y agoCool! I've been thinking of a similar solution to add to my (planned ;) ) longer blog posts. I'm guilty of going into the details too much sometimes.
- StavrosK 6y agoSame here, and I didn't like the tradeoff, so I figured I'd solve it with the power of T E C H N O L O G Y.
- withinboredom 6y agoThis looks amazing. Would you mind if I packaged this in a WordPress plugin?
- StavrosK 6y agoNot at all, go for it!
- laurensr 6y agoSo if I happen to run a less popular third-party login provider, my fate is sealed?
- johannh 6y agoNo, there’s no allow-list, you get the same heuristics as described on that MDN page.
- deleted 6y ago[deleted]
- nuker 6y ago> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers. Facebook and Google will be excepted? This makes it a joke, sadly.
- cmonnow 6y agoThis is basically Google (Chrome) paying Mozilla (Firefox) to kill 3rd party cookies because Google has a better way to fingerprint users without 3rd party cookies, because they have SO MUCH data about us. This move is aimed at killing other AdTech companies which rely on 3rd party cookies to track users. They painting this as a 'PRIVACY' move, after they have already found other ways of tracking users across websites and devices.
- matheusmoreira 6y agoIt's still a good thing though. Better to be tracked by one company than a whole industry.
- nuker 6y agoOne company is the whole industry, Google
- Daho0n 6y agoNo. There's no whitelist. RTFM.
- nuker 6y agoI did not say whitelisted, I said popular.
- thayne 6y agoI wish there was something better than cookies for these use cases. But then, designing something that can't be abused for tracking, that empowers all the legitimate use cases is also really hard, maybe even impossible.