4 ms·

How does this relate to the existing tracking protection settings - should I turn off "block all third party cookies"? That setting breaks a few things, but mo

How does this relate to the existing tracking protection settings - should I turn off "block all third party cookies"? That setting breaks a few things, but mostly works OK. I'm confused which protection level this new capability corellates to.

asicsp 4y ago
This might help: >Total Cookie Protection offers additional privacy protections beyond those provided by our existing anti-tracking features. Enhanced Tracking Protection (ETP), which we launched in 2018, works by blocking trackers based on a maintained list. If a party is on that list, they lose the ability to use third-party cookies. ETP was a huge privacy win for Firefox users, but we’ve known this approach has some shortcomings. If a tracker for some reason isn’t on that list, they can still track users and violate their privacy. And if an attacker wants to thwart ETP, they can set up a new tracking domain that isn’t on the list. Total Cookie Protection avoids these problems by restricting the functionality for all cookies, not just for those on a defined list.
lmkg 4y ago
This is strictly in-between allowing third-party cookies and blocking them. They are allowed, but isolated to prevent data sharing. Previously: Site A has a facebook Like button, which iframes in facebook.com and sets a third-party cookie for facebook.com. Site B does the same. Site B can see that you previously visited Site A, and if you have a Facebook account, then Facebook can connect your browsing activity on both A and B to that account. New feature: Site A's Facebook Like button iframes in Facebook, and sets a cookie on facebook.com. This is a different cookie than the one Site B sets for facebook.com. The cookies cannot tell that you're the same person. If you have a Facebook account, your browsing activity on A and B is not connected to your Facebook account.
ziddoap 4y ago
This seems to be a middle-ground. You can more confidently allow third-party cookies, which means that certain features that broke with the blocking of all third-party cookies will now be able to work, but you maintain most of the protections that you gained when you used to block them.
- lucasyvas 4y ago
  So.. Standard? or Off? Ever since this has been announced, I understand how it works, but the browser does not communicate at all which setting level it maps to, or if I even need ETP on at all and it's just always on.
  - ajvs 4y ago
    ETP Strict
  - ziddoap 4y ago
    It appears that cookie isolation is always on. If you want to further mitigate risk, you adjust your settings block all third-party cookies.
  - wisniewskit 4y ago
    Total Cookie Protection is already on by default in private browsing mode, or strict ETP. Also Firefox Focus on Android. It's being rolled out to everyone in the standard ETP mode now. It's currently controlled by setting `network.cookie.cookieBehavior` to `5`. (There is also a similar setting for private browsing mode which is already 5 by default).
ajvs 4y ago
Total Cookie Protection is the same as the Tor Browser's first-party isolation sandboxing - third-party cookies can't be used to track you across sites because they're only accessible within the domain they were created on. So you don't have to block 3rd-party cookies anymore, since they'll be sandboxed and unable to be used for tracking.
- wisniewskit 4y ago
  To be precise, it's third party cookie/storage partitioning, with web compatibility fixes to keep sites working.

asicsp 4y ago

This might help: >Total Cookie Protection offers additional privacy protections beyond those provided by our existing anti-tracking features. Enhanced Tracking Protection (ETP), which we launched in 2018, works by blocking trackers based on a maintained list. If a party is on that list, they lose the ability to use third-party cookies. ETP was a huge privacy win for Firefox users, but we’ve known this approach has some shortcomings. If a tracker for some reason isn’t on that list, they can still track users and violate their privacy. And if an attacker wants to thwart ETP, they can set up a new tracking domain that isn’t on the list. Total Cookie Protection avoids these problems by restricting the functionality for all cookies, not just for those on a defined list.

lmkg 4y ago

This is strictly in-between allowing third-party cookies and blocking them. They are allowed, but isolated to prevent data sharing. Previously: Site A has a facebook Like button, which iframes in facebook.com and sets a third-party cookie for facebook.com. Site B does the same. Site B can see that you previously visited Site A, and if you have a Facebook account, then Facebook can connect your browsing activity on both A and B to that account. New feature: Site A's Facebook Like button iframes in Facebook, and sets a cookie on facebook.com. This is a different cookie than the one Site B sets for facebook.com. The cookies cannot tell that you're the same person. If you have a Facebook account, your browsing activity on A and B is not connected to your Facebook account.

ziddoap 4y ago

This seems to be a middle-ground. You can more confidently allow third-party cookies, which means that certain features that broke with the blocking of all third-party cookies will now be able to work, but you maintain most of the protections that you gained when you used to block them.

lucasyvas 4y ago
So.. Standard? or Off? Ever since this has been announced, I understand how it works, but the browser does not communicate at all which setting level it maps to, or if I even need ETP on at all and it's just always on.
- ajvs 4y ago
  ETP Strict
- ziddoap 4y ago
  It appears that cookie isolation is always on. If you want to further mitigate risk, you adjust your settings block all third-party cookies.
- wisniewskit 4y ago
  Total Cookie Protection is already on by default in private browsing mode, or strict ETP. Also Firefox Focus on Android. It's being rolled out to everyone in the standard ETP mode now. It's currently controlled by setting `network.cookie.cookieBehavior` to `5`. (There is also a similar setting for private browsing mode which is already 5 by default).

ajvs 4y ago

Total Cookie Protection is the same as the Tor Browser's first-party isolation sandboxing - third-party cookies can't be used to track you across sites because they're only accessible within the domain they were created on. So you don't have to block 3rd-party cookies anymore, since they'll be sandboxed and unable to be used for tracking.

wisniewskit 4y ago
To be precise, it's third party cookie/storage partitioning, with web compatibility fixes to keep sites working.