5 ms·
> Why weren’t separate cookie jars the default in the first place? Tracking today is an interaction between cookies and pages, not really because cookies were
by dahart 4y ago
> Why weren’t separate cookie jars the default in the first place?
Tracking today is an interaction between cookies and pages, not really because cookies were designed to be shared between domains. Because of that, ads on web pages are a reason that information gets shared across sites. Any ad or other iFramed content that’s served on a site can get the domain name of where it’s be served from and then access the iFrame domain’s cookies, which enables tracking.
The cookie jar language might be a tiny bit oversimplifying/confusing in the sense that cookies are already separated from each other according to the cookie’s domain - they’re already in separate jars in a way, and this feature is changing how they partition the jars. Assuming even the most strict privacy settings, tracking cookies and scripts are often in iFrames and may not have the ability to directly read other cookies from the web site in your URL bar, and the web site might not be able read the tracking cookies. It’s not that cookies themselves are being shared per se. It’s that (say) Facebook is allowed to put an iFramed tracker on some site, and Facebook can then get a tracking blip when you visit that site and add it to a Facebook-only cookie. Total Cookie Protection is going to put cookies that only Facebook can see in a different jar for each separate site you visit, making it so that Facebook can’t read it’s own cookies across different sites.
- Agamus 4y agoThe solution still seems to be to: 1. Use Firefox, block .js by default, and selectively allow. 2. Set browser to block cross-site cookies, and to purge all cookies when closing browser. 3. Avoid tabbed browsing, and restart browser after using a website. I've been doing this since about 2006. It's inconvenient, but gives some peace of mind.
- dahart 4y agoThat’d certainly prevent most tracking, yeah. This new Firefox feature should make #2 and #3 unnecessary. I think this feature by Firefox is great, and privacy options are getting objectively better, if slowly. But the cynic in me guessing that server side tracking methods are going to start getting secretly better, if they haven’t already.
- madacol 4y agoI'm not sure about #3. there's still sessions, localstorage, indexDB, etc
- Agamus 4y agoI didn't mention #4 of also purging all that other stuff when the browser closes. Honestly, try it with me - it's not so bad. 1, 2, 3, everybody now!
- madacol 4y agoI don't really need to. With the extensions I use, every new tab I open is like a private windows, it has its own isolated environment. And I can still keep sessions opened where I really need to
- KatrKat 4y agoThe solution is political action. You're describing a workaround that only a few of the most concerned people will be willing to use.
- Agamus 4y agoAgreed, the solution is to work with others toward a solution. In my defense, I don't see it as a workaround - I wouldn't use it any other way. There was a time when one didn't need to do this, but the internet has become more cumbersome to use. Easy-breezy... just make it muscle memory, and don't look back!
- kevin_thibedeau 4y agoI'd replace 3 with self-destructing cookies.
- madacol 4y agoTo reduce the burden use extension Temporary containers, so each tab opens into a clean environment. And use Firefox container to auto-open domains on specific containers where you want to keep sessions or have a shared profile among various domains
- MauranKilom 4y ago2 and 3 are "browse in private mode", to make thing simple.
- galaxyLogic 4y agoHow about just using the "Delete Cookies" -feature of the browser? And maybe there's a plugin that would make that one-click process?
- matt-attack 4y agoI just by default use private mode. Pretty sure in Safari that helps.
- nybble41 4y ago> Total Cookie Protection is going to put cookies that only Facebook can see in a different jar for each separate site you visit, making it so that Facebook can’t read it’s own cookies across different sites. Won't this break some basic features like being logged in to Facebook (or similar services, e.g. Disqus) for the purpose of embedded comment sections on other sites? They don't use cookies only for tracking buttons after all. It would be… annoying… for every site to require a separate login.
- dahart 4y agoYes, it might break embedded features like comments unless you whitelist the allowed uses. I would assume Firefox handles this thoughtfully, but I haven’t tried the new cookie jars yet, so I don’t know what the UI looks like or allows.
- nybble41 4y agoElsewhere they mentioned that there are exceptions for "popular" SSO systems, but I have a hard time imagining any exception that would allow a shared login for Facebook comments while blocking Facebook tracking across sites. These are essentially the same mechanism.
- datavirtue 4y agoWhy can't the browser can handle the login?
- eli 4y agoThey tried https://en.m.wikipedia.org/wiki/Mozilla_Persona https://en.m.wikipedia.org/wiki/Mozilla_Persona
- worik 4y agoYes. Hope so. What a bad idea that is.
- s3p 4y agoThey handle it gracefully. As per their write-up[1]: > In addition, Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers. Only when Total Cookie Protection detects that you intend to use a provider, will it give that provider permission to use a cross-site cookie specifically for the site you’re currently visiting. Such momentary exceptions allow for strong privacy protection without affecting your browsing experience. [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ https://blog.mozilla.org/security/2021/02/23/total-cookie-pr...
- datavirtue 4y agoThe site owners place the Facebook crap on their site...therefore enabling Facebook to track you across any and all sites that embed the tracker. Facebook and other tracking companies are so ubiquitous (most sites have multiple trackers) that they end up getting a feed of Sally's activity across the web...via the cookie loophole. Cookies need restricted to the URL in the address bar. Anything else is like a side effect or unintended and woefully non-transparent consequence of sneaky fucks harvesting your information (clicks, keystrokes, and metadata) via JavaScript and cookies.