11 ms·

State Partitioning

331 points by oedmarap 6y ago

Joe8Bit 6y ago
This is a very positive change, but I'd be interested to know how the Mozilla folks think about 'collateral damage' from a policy point of view. The exceptions and shared state lead me to believe they've thought about it and tried to mitigate it as much as possible, but how much is acceptable? If this breaks more than they thought it would, is it something they'd be comfortable rolling back or changing? For example, if I read this post correctly, this change would put a hard upper limit in SSO logins to 30 days for Firefox users (because StorageAccess is only granted for 30 days). That might not be a _huge_ issue for most people, but it'll add a hard limit to something that's never had a browser enforced hard limit before.
- Chilinot 6y ago
  I guess the SSO token will still be valid, just not usable for SSO purposes after those 30 days. And most likely you will just have to click "Accept" again on the cookie popup to get it working as before for another 30 days. However, dont basically all SSO cookies live far shorter than 30 days? To my knowledge all SSO services i have used have expired earlier requiring me to log back in again.
  - stickfigure 6y ago
    > However, dont basically all SSO cookies live far shorter than 30 days? At least in the case of Google auth: While G may reauthenticate you every 30 days, it's global to your web browser. So after you have reauthenticated, you are back to "logged in" to websites you've logged in to with Google. In the "old way" you only need to reauthenticate to Google, Microsoft, etc once a month. With this new Firefox UX, you still need to reauthenticate to Google, Microsoft, etc once a month, but you also need to click "OK Keep StorageAccess granted" once a month for every website that you use federated login on. There are few auth providers but many more auth consumers.
- mxxx 6y ago
  The 30 day limit is access to the storage API. So presumably the data is still there, you just need to give permission for it to be accessed again. It doesn’t necessarily imply that it just logs you out on 30 days by emptying the state.
- pyentropy 6y ago
  Just do a redirect with session as a query parameter (like many OAuth apps do it anyway). Each site can then persist the user session for more than a month.
- Ayesh 6y ago
  I think cookies have a limit too. It may be not from the spec, but I never saw a single cookie in my Firefox that's longer than a year.
joenathanone 6y ago
This needs to be bypassed to use SSO, to bypass it the SSO providers site will need to ask for Storage Access, in some cases the user will be asked for permission… “After the user has granted access, Firefox will remember the storage permission for 30 days.” So lay users will get used to just clicking through and blindly granting the permission. The end result will be an additional step for trackers, and a bunch of headaches for all the legit services that get broken from this change. I’m all for less tracking but this doesnt seem like a good solution.
- swiley 6y ago
  At least they're getting asked. That's a huge improvement over what was there before. I still prefer the lynx UI: prompt yes/no/always for accepting any cookie.
  - ancarda 6y ago
    It's a shame that "always" will whitelist a whole site though. It'd be nice if Lynx whitelisted a cookie name (per site). That way I could permit "PHPSESSID", but not "_ga". I never found a Firefox plugin that let me whitelist specific cookies. I might try to write one when I have time.
    - nerdponx 6y ago
      +1 to both of these. That'd be a killer feature for me in both Lynx and Firefox.
- marcosdumay 6y ago
  > So lay users will get used to just clicking through and blindly granting the permission. Does it break anything else besides cookie based SSO? Because for those, people will probably just login into the site, and ignore the permission. Firefox is also adopting the policy of not showing those permission windows at most cases, just showing a small notification. It's not clear on that page if this is one of those cases. Anyway, I agree that limiting the permissions to 30 days is bad. The users should be entitled to make permanent changes, and revert them themselves when they want. Firefox should at least give them the option, even if it's not the default one.
undecisive 6y ago
I commend Firefox for trying to do this... but it worries me. 3 obvious holes: - Proliferation of dialogs. When you don't know whether a site will suddenly break or not, standard users will be implicitly trained to say yes to all dialogs. - Domain "homogenizing" (spoofing) services will win. Trackers that offer a widget you can install on your server will win. Facebook et all will still know where they sent you, and will be able to track you server side. If mozilla provide a centralized whitelist, then SSO providers who also provide trackers will win. Essentially, the big players will find a way, the little players (who users weren't worried about anyway) will still lose. - The web will break. SSO will be broken for a good couple of months on over 50% of websites using it - possibly more. "This only works in Google Chrome" will become more and more popular. Potentially, Firefox doesn't have the market share to make this work. Those of us who will stick with Firefox regardless are in for a world of pain, and not a lot of gain. I guess it's necessary to move the web on, but the pessimist in me doesn't see that happening any time soon.
- sdeframond 6y ago
  > Firefox doesn't have the market share to make this work. Potentially indeed. On the other hand it will give FF evangelists one more selling point. "Why should I switch to Firefox?" - "Because it lets you chose who is tracking you and who is not."
  - laurent92 6y ago
    It’s a difficult argument, depleted of its true meaning by its overuse in VPN ads (which make it... easier to track you at the VPN level). But Firefox has a good enough corporate image to tell that _they_ are the ones who really do it.
- kuu 6y ago
  > Facebook et all will still know where they sent you, and will be able to track you server side This is not a problem a browser can fix
- ThePhysicist 6y ago
  SSO really doesn't need cookies to function, you can e.g. pass short-lived authentication tokens via URL hash fragments, that is already supported by OAuth 2.0 via the implicit grant flow (and for API-based flows it's not a problem).
timwis 6y ago
This seems brilliant! But the solution for SSO concerns me, given most SSO providers (Google, Facebook) are among the main ones partitioning aims to stop from tracking you. By giving Google SSO unpartitioned access, doesn’t that also let google track you anywhere?
- ambentzen 6y ago
  My understanding is that if you use Google SSO from xyz.com Google can track you only there and not abc.com. So the partition is only lifted for a single domain.
ThePhysicist 6y ago
I think what you want is essentially an entirely fresh browser session for every website you visit. Pretty mind-boggling to what lengths we need to go in order to prevent companies from tracking us. That said most tracking companies seem to have devised strategies to construct fingerprints from data like IP addresses, user-agent strings and any other meta-data they can get their hands on, so the next step will probably be to restrict what kind of information can be learned about the browser environment via JS (e.g. getting exact screen resolution). Also, data exfiltration via browser extensions is still not a solved problem, there are very popular extensions (Ghostery for example) that are highly privileged in the browser and often collect a ridiculous amount of data. Really can't get my head around why browser vendors still allow that while being so strict on all other forms of tracking.
- TedDoesntTalk 6y ago
  > Ghostery for example What data is Ghostery collecting?
  - ThePhysicist 6y ago
    https://www.ghostery.com/about-ghostery/ghostery-plans-and-products-privacy-policy/ https://www.ghostery.com/about-ghostery/ghostery-plans-and-p...
- iainmerrick 6y ago
  I use “private tabs” exclusively on my phone now, and it works great with not too many downsides. On HN, I can browse just fine; when I want to vote or comment, logging in only takes a few seconds. News sites either just work, work with some nagging that you have to click through, or hit paywalls and other dead ends. I’m happy to stick with the sites that work and spend less time on the more annoying ones. Edit to add: I realise I’m still being tracked, but at least I’m making a best effort to limit it. So the idea of a completely siloed browsing session per site sounds great to me.
- mckirk 6y ago
  There's the awesome 'Containerise'[1] add-on for Firefox that lets you define containers for specific sites based on URL filter expressions. Pretty handy to e.g. keep Google cookies in their own Google container. (The only downside I've found is that, if you navigate from Google directly to a site belonging to a different container, the tab will forget its history and you won't be able to go back to the Google results using the Back button. You just need to remember to open results in a new tab instead.) Using 'Cookie Quick Manager'[2] you can also move your existing cookies for some domain to their new container, so you don't have to re-login everywhere after creating your new custom containers. [1]: https://addons.mozilla.org/en-US/firefox/addon/containerise/ https://addons.mozilla.org/en-US/firefox/addon/containerise/ [2]: https://addons.mozilla.org/en-US/firefox/addon/cookie-quick-manager/ https://addons.mozilla.org/en-US/firefox/addon/cookie-quick-...
the8472 6y ago
How long until someone will do side-channel attacks on cookie stores for tracking purposes?
- Ayesh 6y ago
  You can't. The permission is granted per embedded domain per top domain.
eMGm4D0zgUAVXc7 6y ago
Can the heuristics which do allow cross-site state access be disabled so cross-site access is never possible unless I explicitly allow it?
cameronh90 6y ago
I understand from the article is they're saying the future way of doing SSO is through an iframe with the Storage Access API? How does this work with being able to verify the HTTPS URL? How do I know I'm typing my credentials into my legit SSO provider and not a phishing site?
- pyentropy 6y ago
  You don't need a shared storage if you do SSO the right way. Just redirect with a session token. And if the SSO server wants to share state with the other services, like forcing a logout on a specific app, it can always do it on the server side (app backend <-> SSO backend with user token).
  - cameronh90 6y ago
    Sure and that is how we do SSO (though SameSite=Strict can interfere with that method too). But if that's the recommended approach, why are they providing a standard route to do SSO via an iframe with the Storage Access API? Does that API have any other valid uses that aren't tracking or SSO related?
    - deleted 6y ago
      [deleted]
    - pyentropy 6y ago
      If the SSO system is legacy and must use cookies, then to request access for cookies you need to call requestStorageAccess() in a frame hosted on the origin, which will open a prompt asking the user to allow such cookie access.
boshomi 6y ago
Is co.uk a registrable domain?
- dstick 6y ago
  Yes? https://www.namecheap.com/domains/registration/cctld/co-uk/ https://www.namecheap.com/domains/registration/cctld/co-uk/ Has been for as long as I can remember. It's the UK's ccTLD.
  - GavinMcG 6y ago
    Whether something is a TLD isn't equivalent to whether it is a domain. The comment taken literally asked about the latter.
- jefftk 6y ago
  No. It's a public suffix. Subdomains of public suffixes (example.co.uk) are registrable domains. The list of public suffixes is: https://publicsuffix.org/ https://publicsuffix.org/
intrasight 6y ago
From the title, I thought perhaps the article was about FINALLY partitioning California into two states ;)
sambe 6y ago
Looking at the proposed permission UI, I would - as a programmer and heavy web user - have no real clue what to click/what the implications were. If it were Google - do I know and trust them? Well, sort of. I know them; I trust them in the same sense I don't trust a scammer. Also: 30 day timeout? I'm getting pretty fed up of re-logging into websites already over the last couple of years. Add on re-allowing various permissions for access to various things (sometimes every single time), trying to figure out why websites are broken (ad-blocker vs browser blocker vs not cross-browser tested vs temporary problem vs just totally broken) and it's rather a big productivity drain.
- onion2k 6y ago
  30 day timeout? I'm getting pretty fed up of re-logging into websites already over the last couple of years. Users having to log in to a website 12 times a year, or 13 times in a bad year, is a price worth paying to improve privacy and security across the internet.
  - kevincox 6y ago
    I disagree. This is making a significant UX downgrade to a core workflow while making the tiniest blip on tracking. (Oh no! You lose cookies every 30 days)
  - mFixman 6y ago
    According to Firefox I have 217 saved logins in different websites. Even if I only used a fifth of them once a month, I wouldn't want to re-login 521 times every year. This is a big UX decline for pretty much zero privacy gain.
  - sambe 6y ago
    I'm not sure why you'd think you should make a statement on behalf of everyone. If you are happy with this trade-off, you are free to make it. The 30-day timeout is for Storage Access API - cookies expire much more often already. As I said, there is an accumulation of productivity harms. My claim is that the pro-privacy solutions are not good enough relative to the problems they cause (and their effect on improving privacy is also debatable).
kome 6y ago
Isn't blocking all third party cookies still better after all?
foolinaround 6y ago
Can privacy focussed browsers that extend Chrome ( Brave, Vivaldi, etc) provide something similar to this, or is it baked deep within Chrome internals, and cannot be overriden?
- miedpo 6y ago
  Brave already does this as far as I know (cross-site cookies are blocked by default). Don't know about Vivaldi, but I would not be surprised if they do.
GiftCard2021 6y ago
7 Most Common Birds That You Can Find In Singapore http://bit.ly/3shBg7U http://bit.ly/3shBg7U
eevilspock 6y ago
California should split into at least 4 states ;)
stickfigure 6y ago
I like this. After it rolls out, can we quit with those silly GPDR cookie messages? That always seemed like "a social solution for a technical problem", with all the jurisdictional and enforcement problems you would expect from one political body trying to legislate behavior worldwide. Don't want to be tracked? It's your browser after all, just stop handing the trackers data!
- coldpie 6y ago
  NoScript mostly fixes those, and there's also this[1] if you want to try something less drastic. [1] https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  - chrisan 6y ago
    Thanks for this! I'm at a point where I am way more annoyed by cookie banners all over the place than whatever tracking is being done on me that I almost wanted to go back in time before GDPR, now I don't have to :)
    - coldpie 6y ago
      NoScript also blocks those fucking "give us your email address!!!!!!!!" popups and other similar trash. It's a hassle to use, and it sucks that it's required, but that's the web we built.
- tomjen3 6y ago
  I would happily set my browser to only accept cookies for a few sites but if you do that, those cookie popups are even worse.
- jefftk 6y ago
  > After it rolls out, can we quit with those silly GPDR cookie messages? Cookie banners also include notification around first party cookies. For example, first-party cookies used to implement analytics are included. See https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002 https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
ComodoHacker 6y ago
Can you imagine the next step adtech will take in this arms race? I can imagine adtech giants like Google offering free web hosting and cloud resources to gather most of the Web under a few TLDs. They did it with e-mail, they can do it again with Web.
deostroll 6y ago
Found a concise video explaining the concept: https://www.youtube.com/watch?v=ETYmvjxc1h4 https://www.youtube.com/watch?v=ETYmvjxc1h4
warent 6y ago
I'm unconvinced. It's not even possible to whitelist websites for their current "Enhanced Tracking Protection" feature[1]. This smells like another case of over engineering stuff that people never asked for while ignoring what your users ask for. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1432644 https://bugzilla.mozilla.org/show_bug.cgi?id=1432644
artjomb 6y ago
Link moved here: https://hacks.mozilla.org/introducing-state-partitioning/ https://hacks.mozilla.org/introducing-state-partitioning/

331 points by oedmarap 6y ago

This is a very positive change, but I'd be interested to know how the Mozilla folks think about 'collateral damage' from a policy point of view. The exceptions and shared state lead me to believe they've thought about it and tried to mitigate it as much as possible, but how much is acceptable? If this breaks more than they thought it would, is it something they'd be comfortable rolling back or changing? For example, if I read this post correctly, this change would put a hard upper limit in SSO logins to 30 days for Firefox users (because StorageAccess is only granted for 30 days). That might not be a _huge_ issue for most people, but it'll add a hard limit to something that's never had a browser enforced hard limit before.

Chilinot 6y ago
I guess the SSO token will still be valid, just not usable for SSO purposes after those 30 days. And most likely you will just have to click "Accept" again on the cookie popup to get it working as before for another 30 days. However, dont basically all SSO cookies live far shorter than 30 days? To my knowledge all SSO services i have used have expired earlier requiring me to log back in again.
- stickfigure 6y ago
  > However, dont basically all SSO cookies live far shorter than 30 days? At least in the case of Google auth: While G may reauthenticate you every 30 days, it's global to your web browser. So after you have reauthenticated, you are back to "logged in" to websites you've logged in to with Google. In the "old way" you only need to reauthenticate to Google, Microsoft, etc once a month. With this new Firefox UX, you still need to reauthenticate to Google, Microsoft, etc once a month, but you also need to click "OK Keep StorageAccess granted" once a month for every website that you use federated login on. There are few auth providers but many more auth consumers.
mxxx 6y ago
The 30 day limit is access to the storage API. So presumably the data is still there, you just need to give permission for it to be accessed again. It doesn’t necessarily imply that it just logs you out on 30 days by emptying the state.
pyentropy 6y ago
Just do a redirect with session as a query parameter (like many OAuth apps do it anyway). Each site can then persist the user session for more than a month.
Ayesh 6y ago
I think cookies have a limit too. It may be not from the spec, but I never saw a single cookie in my Firefox that's longer than a year.

joenathanone 6y ago

This needs to be bypassed to use SSO, to bypass it the SSO providers site will need to ask for Storage Access, in some cases the user will be asked for permission… “After the user has granted access, Firefox will remember the storage permission for 30 days.” So lay users will get used to just clicking through and blindly granting the permission. The end result will be an additional step for trackers, and a bunch of headaches for all the legit services that get broken from this change. I’m all for less tracking but this doesnt seem like a good solution.

swiley 6y ago
At least they're getting asked. That's a huge improvement over what was there before. I still prefer the lynx UI: prompt yes/no/always for accepting any cookie.
- ancarda 6y ago
  It's a shame that "always" will whitelist a whole site though. It'd be nice if Lynx whitelisted a cookie name (per site). That way I could permit "PHPSESSID", but not "_ga". I never found a Firefox plugin that let me whitelist specific cookies. I might try to write one when I have time.
  - nerdponx 6y ago
    +1 to both of these. That'd be a killer feature for me in both Lynx and Firefox.
marcosdumay 6y ago
> So lay users will get used to just clicking through and blindly granting the permission. Does it break anything else besides cookie based SSO? Because for those, people will probably just login into the site, and ignore the permission. Firefox is also adopting the policy of not showing those permission windows at most cases, just showing a small notification. It's not clear on that page if this is one of those cases. Anyway, I agree that limiting the permissions to 30 days is bad. The users should be entitled to make permanent changes, and revert them themselves when they want. Firefox should at least give them the option, even if it's not the default one.

undecisive 6y ago

I commend Firefox for trying to do this... but it worries me. 3 obvious holes: - Proliferation of dialogs. When you don't know whether a site will suddenly break or not, standard users will be implicitly trained to say yes to all dialogs. - Domain "homogenizing" (spoofing) services will win. Trackers that offer a widget you can install on your server will win. Facebook et all will still know where they sent you, and will be able to track you server side. If mozilla provide a centralized whitelist, then SSO providers who also provide trackers will win. Essentially, the big players will find a way, the little players (who users weren't worried about anyway) will still lose. - The web will break. SSO will be broken for a good couple of months on over 50% of websites using it - possibly more. "This only works in Google Chrome" will become more and more popular. Potentially, Firefox doesn't have the market share to make this work. Those of us who will stick with Firefox regardless are in for a world of pain, and not a lot of gain. I guess it's necessary to move the web on, but the pessimist in me doesn't see that happening any time soon.

sdeframond 6y ago
> Firefox doesn't have the market share to make this work. Potentially indeed. On the other hand it will give FF evangelists one more selling point. "Why should I switch to Firefox?" - "Because it lets you chose who is tracking you and who is not."
- laurent92 6y ago
  It’s a difficult argument, depleted of its true meaning by its overuse in VPN ads (which make it... easier to track you at the VPN level). But Firefox has a good enough corporate image to tell that _they_ are the ones who really do it.
kuu 6y ago
> Facebook et all will still know where they sent you, and will be able to track you server side This is not a problem a browser can fix
ThePhysicist 6y ago
SSO really doesn't need cookies to function, you can e.g. pass short-lived authentication tokens via URL hash fragments, that is already supported by OAuth 2.0 via the implicit grant flow (and for API-based flows it's not a problem).

timwis 6y ago

This seems brilliant! But the solution for SSO concerns me, given most SSO providers (Google, Facebook) are among the main ones partitioning aims to stop from tracking you. By giving Google SSO unpartitioned access, doesn’t that also let google track you anywhere?

ambentzen 6y ago
My understanding is that if you use Google SSO from xyz.com Google can track you only there and not abc.com. So the partition is only lifted for a single domain.

ThePhysicist 6y ago

I think what you want is essentially an entirely fresh browser session for every website you visit. Pretty mind-boggling to what lengths we need to go in order to prevent companies from tracking us. That said most tracking companies seem to have devised strategies to construct fingerprints from data like IP addresses, user-agent strings and any other meta-data they can get their hands on, so the next step will probably be to restrict what kind of information can be learned about the browser environment via JS (e.g. getting exact screen resolution). Also, data exfiltration via browser extensions is still not a solved problem, there are very popular extensions (Ghostery for example) that are highly privileged in the browser and often collect a ridiculous amount of data. Really can't get my head around why browser vendors still allow that while being so strict on all other forms of tracking.

TedDoesntTalk 6y ago
> Ghostery for example What data is Ghostery collecting?
- ThePhysicist 6y ago
  https://www.ghostery.com/about-ghostery/ghostery-plans-and-products-privacy-policy/ https://www.ghostery.com/about-ghostery/ghostery-plans-and-p...
iainmerrick 6y ago
I use “private tabs” exclusively on my phone now, and it works great with not too many downsides. On HN, I can browse just fine; when I want to vote or comment, logging in only takes a few seconds. News sites either just work, work with some nagging that you have to click through, or hit paywalls and other dead ends. I’m happy to stick with the sites that work and spend less time on the more annoying ones. Edit to add: I realise I’m still being tracked, but at least I’m making a best effort to limit it. So the idea of a completely siloed browsing session per site sounds great to me.
mckirk 6y ago
There's the awesome 'Containerise'[1] add-on for Firefox that lets you define containers for specific sites based on URL filter expressions. Pretty handy to e.g. keep Google cookies in their own Google container. (The only downside I've found is that, if you navigate from Google directly to a site belonging to a different container, the tab will forget its history and you won't be able to go back to the Google results using the Back button. You just need to remember to open results in a new tab instead.) Using 'Cookie Quick Manager'[2] you can also move your existing cookies for some domain to their new container, so you don't have to re-login everywhere after creating your new custom containers. [1]: https://addons.mozilla.org/en-US/firefox/addon/containerise/ https://addons.mozilla.org/en-US/firefox/addon/containerise/ [2]: https://addons.mozilla.org/en-US/firefox/addon/cookie-quick-manager/ https://addons.mozilla.org/en-US/firefox/addon/cookie-quick-...

the8472 6y ago

How long until someone will do side-channel attacks on cookie stores for tracking purposes?

Ayesh 6y ago
You can't. The permission is granted per embedded domain per top domain.

eMGm4D0zgUAVXc7 6y ago

Can the heuristics which do allow cross-site state access be disabled so cross-site access is never possible unless I explicitly allow it?

cameronh90 6y ago

I understand from the article is they're saying the future way of doing SSO is through an iframe with the Storage Access API? How does this work with being able to verify the HTTPS URL? How do I know I'm typing my credentials into my legit SSO provider and not a phishing site?

pyentropy 6y ago
You don't need a shared storage if you do SSO the right way. Just redirect with a session token. And if the SSO server wants to share state with the other services, like forcing a logout on a specific app, it can always do it on the server side (app backend <-> SSO backend with user token).
- cameronh90 6y ago
  Sure and that is how we do SSO (though SameSite=Strict can interfere with that method too). But if that's the recommended approach, why are they providing a standard route to do SSO via an iframe with the Storage Access API? Does that API have any other valid uses that aren't tracking or SSO related?
  - deleted 6y ago
    [deleted]
  - pyentropy 6y ago
    If the SSO system is legacy and must use cookies, then to request access for cookies you need to call requestStorageAccess() in a frame hosted on the origin, which will open a prompt asking the user to allow such cookie access.

boshomi 6y ago

Is co.uk a registrable domain?

dstick 6y ago
Yes? https://www.namecheap.com/domains/registration/cctld/co-uk/ https://www.namecheap.com/domains/registration/cctld/co-uk/ Has been for as long as I can remember. It's the UK's ccTLD.
- GavinMcG 6y ago
  Whether something is a TLD isn't equivalent to whether it is a domain. The comment taken literally asked about the latter.
jefftk 6y ago
No. It's a public suffix. Subdomains of public suffixes (example.co.uk) are registrable domains. The list of public suffixes is: https://publicsuffix.org/ https://publicsuffix.org/

intrasight 6y ago

From the title, I thought perhaps the article was about FINALLY partitioning California into two states ;)

sambe 6y ago

Looking at the proposed permission UI, I would - as a programmer and heavy web user - have no real clue what to click/what the implications were. If it were Google - do I know and trust them? Well, sort of. I know them; I trust them in the same sense I don't trust a scammer. Also: 30 day timeout? I'm getting pretty fed up of re-logging into websites already over the last couple of years. Add on re-allowing various permissions for access to various things (sometimes every single time), trying to figure out why websites are broken (ad-blocker vs browser blocker vs not cross-browser tested vs temporary problem vs just totally broken) and it's rather a big productivity drain.

onion2k 6y ago
30 day timeout? I'm getting pretty fed up of re-logging into websites already over the last couple of years. Users having to log in to a website 12 times a year, or 13 times in a bad year, is a price worth paying to improve privacy and security across the internet.
- kevincox 6y ago
  I disagree. This is making a significant UX downgrade to a core workflow while making the tiniest blip on tracking. (Oh no! You lose cookies every 30 days)
- mFixman 6y ago
  According to Firefox I have 217 saved logins in different websites. Even if I only used a fifth of them once a month, I wouldn't want to re-login 521 times every year. This is a big UX decline for pretty much zero privacy gain.
- sambe 6y ago
  I'm not sure why you'd think you should make a statement on behalf of everyone. If you are happy with this trade-off, you are free to make it. The 30-day timeout is for Storage Access API - cookies expire much more often already. As I said, there is an accumulation of productivity harms. My claim is that the pro-privacy solutions are not good enough relative to the problems they cause (and their effect on improving privacy is also debatable).

kome 6y ago

Isn't blocking all third party cookies still better after all?

foolinaround 6y ago

Can privacy focussed browsers that extend Chrome ( Brave, Vivaldi, etc) provide something similar to this, or is it baked deep within Chrome internals, and cannot be overriden?

miedpo 6y ago
Brave already does this as far as I know (cross-site cookies are blocked by default). Don't know about Vivaldi, but I would not be surprised if they do.

GiftCard2021 6y ago

7 Most Common Birds That You Can Find In Singapore http://bit.ly/3shBg7U http://bit.ly/3shBg7U

eevilspock 6y ago

California should split into at least 4 states ;)

stickfigure 6y ago

I like this. After it rolls out, can we quit with those silly GPDR cookie messages? That always seemed like "a social solution for a technical problem", with all the jurisdictional and enforcement problems you would expect from one political body trying to legislate behavior worldwide. Don't want to be tracked? It's your browser after all, just stop handing the trackers data!

coldpie 6y ago
NoScript mostly fixes those, and there's also this[1] if you want to try something less drastic. [1] https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- chrisan 6y ago
  Thanks for this! I'm at a point where I am way more annoyed by cookie banners all over the place than whatever tracking is being done on me that I almost wanted to go back in time before GDPR, now I don't have to :)
  - coldpie 6y ago
    NoScript also blocks those fucking "give us your email address!!!!!!!!" popups and other similar trash. It's a hassle to use, and it sucks that it's required, but that's the web we built.
tomjen3 6y ago
I would happily set my browser to only accept cookies for a few sites but if you do that, those cookie popups are even worse.
jefftk 6y ago
> After it rolls out, can we quit with those silly GPDR cookie messages? Cookie banners also include notification around first party cookies. For example, first-party cookies used to implement analytics are included. See https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002 https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...

ComodoHacker 6y ago

Can you imagine the next step adtech will take in this arms race? I can imagine adtech giants like Google offering free web hosting and cloud resources to gather most of the Web under a few TLDs. They did it with e-mail, they can do it again with Web.

deostroll 6y ago

Found a concise video explaining the concept: https://www.youtube.com/watch?v=ETYmvjxc1h4 https://www.youtube.com/watch?v=ETYmvjxc1h4

warent 6y ago

I'm unconvinced. It's not even possible to whitelist websites for their current "Enhanced Tracking Protection" feature[1]. This smells like another case of over engineering stuff that people never asked for while ignoring what your users ask for. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1432644 https://bugzilla.mozilla.org/show_bug.cgi?id=1432644

artjomb 6y ago

Link moved here: https://hacks.mozilla.org/introducing-state-partitioning/ https://hacks.mozilla.org/introducing-state-partitioning/