10 ms·

Firefox rolls out Total Cookie Protection by default to more users

217 points by bluish29 4y ago

Animats 4y ago
Are they blocking Google Tag Manager?
- flangola7 4y ago
  What does tag manager even do?
  - cj 4y ago
    1) Developer installs Google Tag Manager at the request of someone in marketing 2) Marketing department has free reign (via Google Tag Manager) to add arbitrary javascript on any page with Google Tag Manager installed. Namely tracking scripts, adwords conversions, retargeting pixels, or really any arbitrary javascript without limitation. Edit: Google Tag Manager can also be used to inject scripts that aren't inherently bad, like a 3rd party support/chat widget (Zendesk, Intercom, etc)
    - nashashmi 4y ago
      I have it blocked all the time. Now I understand why some websites don’t work until I put it on. This is nefarious.
    - TheNewsIsHere 4y ago
      What I hate is that because it can be used for shady and benign purposes, you can never tell what will break without it. I’d love to wholesale block or at the edge or host but sometimes you need it.
    - Animats 4y ago
      It's worse than that. Attackers can add arbitrary Javascript to your pages. It takes another vulnerability to use this as a large scale exploit, but it's been done. [1][2] Blocking "googletagmanager.com" does break a few sites, but not enough that it matters. [1] https://support.google.com/tagmanager/answer/6328489?hl=en https://support.google.com/tagmanager/answer/6328489?hl=en [2] https://www.akamai.com/blog/security/magecart-attack-disguised-as-google-tag-manager https://www.akamai.com/blog/security/magecart-attack-disguis...
  - arealaccount 4y ago
    Its basically a tool that lets you manage all of the js tracking scripts (tags) that advertisers, affiliates, etc have you paste into a website. So instead of having a million js snippets on your page, you have one google tag manager snippet and then your marketing team can inject 400mb of javascript into the site without bothering dev.
choeger 4y ago
In what sense is TCP tomorrow different from disallowing 3rd party cookies today? On a side note: Isn't it odd, how the composition of different technologies (here HTTP and DNS) make it unintuitively complex to implement a so intuitively natural policy as "every website gets to read only its own cookies"?
- red_trumpet 4y ago
  > every website gets to read only its own cookies That's already the case, isn't it? It's just that embedded parts by a 3rd party can set their own cookies, which can be read by the 3rd party whenever it is embedded in any other page.
  - aidenn0 4y ago
    It's not already the case, but it is expected to be the case in all major browsers sometime next-year[1] 1: https://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie https://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie
    - cortesoft 4y ago
      You aren’t disagreeing with the person you are responding to, you just have slightly different ideas what it means when someone says “website” You are calling all of the assets loaded, no matter from where, as one “website”. The person you are replying to considers each domain for each asset on the single page as being different “websites”
      - TylerE 4y ago
        Then they should say server/domain/subdomain and not “website”.
- taeric 4y ago
  Of course... knowing that this is all by well behaving browsers is a bit of a troubling point. Such that I find it equally odd that we have placed so much power and general trust into software that we keep expanding the capabilities of. It is a small step to "managed devices" that we don't even trust users to keep up to date being required for access.
kevin_thibedeau 4y ago
> allowing those [third party] cookies to fulfill their less invasive use cases (e.g. to provide accurate analytics Separate cookie jars don't prevent data brokers from correlating cookies from a common IP + user agent pair. The only solution is to block third parties altogether.
- seizethegdgap 4y ago
  Obviously doesn't help when using an app, but what about an extension that changes your user agent every single time you send a request to a website? Does such an extension even work, or exist?
  - Nextgrid 4y ago
    Even if it did, it will be useless because fingerprinting (of various kinds - whether TCP or TLS stack, doesn't even have to be JS-based) will still tell which browser you're running on. Worse, it may actually make you more identifiable because a Chrome on Linux user agent with the TCP fingerprint of Windows and TLS fingerprint of Firefox is going to stick out like a sore thumb, even more than a rare-but-at-least-consistent fingerprint with no trickery.
    - jhoechtl 4y ago
      What if I browse using tor?
    - benmmurphy 4y ago
      I'm not sure TCP fingerprints are very reliable because a lot of ISPs and Mobile Carriers are doing proxying at the application level for HTTP/HTTPS ports so even if you are on an iPhone you might end up having a linux TCP fingerprint. This site allows you test your TCP fingerprint: http://witch.valdikss.org.ru http://witch.valdikss.org.ru
- the_pwner224 4y ago
  The long term workaround for data brokers is to become a first party... have the main website serve your 3rd party JS from their own server under their own domain. That makes it much harder to block. For your IP+UA hypothetical, the easy fix is to make everyone look the same. IP should be the only personally identifiable factor. Tor and desktop Firefox w/ privacy.resistFingerprinting turned on both do this. Open window not-maximized at 1000x1000 size, use the same UA regardless of what platform & browser version you're actually on, and a bunch of other stuff. That said, I don't know how effective it actually is against modern comprehensive fingerprinting libraries.
clumsysmurf 4y ago
A couple of days ago there was a story on HN about fingerprinting https://news.ycombinator.com/item?id=35243355 https://news.ycombinator.com/item?id=35243355 The take-away I got from this article is that, companies found a way to uniquely identify you anyhow, without cookies. Is this too little too late?
- focusedone 4y ago
  Firefox user but relatively ignorant on how tracking works. FF does some good things to work around fingerprinting, although simply using FF puts us in a pretty small (marketable) group in the first place.
  - OkayPhysicist 4y ago
    Frankly, Firefox should take the nuclear option, and just start emulating Chrome with regard to website identifiable information. In particular, User-Agent strings are now a net-negative. I've never run into a website that doesn't work on Firefox. I do occasionally run into websites that claim to not work on Firefox. We software developers have shown that we can't be trusted with information pertaining to what browser someone is using, and as such should have the privilege taken away. If you're reading this, and you have access to a codebase that reads User-Agent strings for anything more than idle curiosity, just delete it and push to master.
    - MrJohz 4y ago
      I actually ran into a case for using UA strings yesterday, if you know of a better solution let me know! I have a canvas element where the user needs to be able to both scroll and zoom with the mouse wheel. Generally, zooming involves scrolling while also holding the ctrl button down - except on MacOS, where it's cmd. I obviously want to use the operating system conventions that my users will be expecting, but the best way of determining that, that I've found, is searching for the string 'Mac' in the user agent string. Like I say, if you know of a better way to detect whether I should be binding on ctrl or cmd, let me know! This is the first time I've used the user agent in a long time, and it feels like there should be a better system...
Nextgrid 4y ago
[flagged]
- sevg 4y ago
  Because no software is perfect from the first release :) This is what software developers do, iterate to improve software.
- dmix 4y ago
  There were plenty of legitimate use cases for 3rd party cookies. The negative ones just started to trump the legitimate ones over time and browsers lag behind these trends (or have different incentives).
the_pwner224 4y ago
Has Chrome already been doing this for a while? (I'm not sure, but I think I've heard that it has). Disclaimer: I'm a FF user, not trying to say FF is bad, I just want to know how much of this is actually new cutting edge privacy protection vs. marketing fluff.
- privacyonsec 4y ago
  no but brave browser does
  - the_pwner224 4y ago
    Thanks.
billiam 4y ago
This is nice to see, but it worth pointing out that it is years overdue. Mozilla dragged its feet for years about Tracking Protection and cookies in general, coming up with halfway measures while continuing to serve the needs of advertisers that had a lot of influence on the company. The end state of Total Cookie Protection was clear from the beginning. It is of course not easy to change the advertising based model, but it's not like Firefox is really more than an influencer of Google and Apple, its market share has all but disappeared. No, the motivation to take seven years to get to TCP was all about money, including big salaries and bonuses for Mozilla executives.
- Tagbert 4y ago
  So when did Chrome start doing this?
dandongus 4y ago
Why is there any concept of "some users worldwide" with respect to default cookie settings in a browser application?
- wnevets 4y ago
  to avoid breaking changes for every single user?
INeedMoreRam 4y ago
[dead]
xuhu 4y ago
Will bitbucket.org sending me to oauth.atlassian.com fail with Total Cookie Protection enabled ? Will someonlineshop.com redirecting me to payments.mybank.com fail with Total Cookie Protection enabled because the payments site uses cookies to store the return url for the online shop ?
- dizhn 4y ago
  I believe they maintain a whitelist for the big guys.
- Spivak 4y ago
  With oauth probably not since the state doesn't transfer with cookies. You send the user to the IdP with a postback in the URL then when the user logs it it sends them back to the original site with some data that depends on the flow you chose. Your login cookie as far as the IdP is concerned lives on oauth.thirdparty.net and on a successful login the app issues you your own session token that lives on myapp.com.
_V_ 4y ago
I don't want to be a killjoy here. Don't get me wrong, this is certainly a good thing but to me it seems like most major trackers are moving/has already moved to things like canvas fingerprinting, WebAssembly fingerprinting etc. This seems to be like a typical cat-and-mouse game. And browsers will not get more privacy friendly as long as there will be a trend that moves applications and basically every aspect of our lives into the browser thus making it unbelieveably complex. I suspect that we will soon have to choose to either live as a "digital hermit" (links/neomutt and other lightweight apps that do only the one thing) or give up and join everyone with Youtube/Facebook/Twitter.
- zx8080 4y ago
  > to me it seems like most major trackers are moving/has already moved to things like canvas fingerprinting, WebAssembly fingerprinting etc. Also the upcoming WebGPU enabling by default in chrome will probably make it very simple to fingerprint almost anyone.
- WeylandYutani 4y ago
  I'm blocking pretty much all website advertising. I'm sure I'm being tracked but I can't see their personalised ads so whatever. Out of sight out of mind.
stereoradonc 4y ago
Firefox does everything about privacy that Vivaldi should do (and more).

217 points by bluish29 4y ago

Animats 4y ago

Are they blocking Google Tag Manager?

flangola7 4y ago
What does tag manager even do?
- cj 4y ago
  1) Developer installs Google Tag Manager at the request of someone in marketing 2) Marketing department has free reign (via Google Tag Manager) to add arbitrary javascript on any page with Google Tag Manager installed. Namely tracking scripts, adwords conversions, retargeting pixels, or really any arbitrary javascript without limitation. Edit: Google Tag Manager can also be used to inject scripts that aren't inherently bad, like a 3rd party support/chat widget (Zendesk, Intercom, etc)
  - nashashmi 4y ago
    I have it blocked all the time. Now I understand why some websites don’t work until I put it on. This is nefarious.
  - TheNewsIsHere 4y ago
    What I hate is that because it can be used for shady and benign purposes, you can never tell what will break without it. I’d love to wholesale block or at the edge or host but sometimes you need it.
  - Animats 4y ago
    It's worse than that. Attackers can add arbitrary Javascript to your pages. It takes another vulnerability to use this as a large scale exploit, but it's been done. [1][2] Blocking "googletagmanager.com" does break a few sites, but not enough that it matters. [1] https://support.google.com/tagmanager/answer/6328489?hl=en https://support.google.com/tagmanager/answer/6328489?hl=en [2] https://www.akamai.com/blog/security/magecart-attack-disguised-as-google-tag-manager https://www.akamai.com/blog/security/magecart-attack-disguis...
- arealaccount 4y ago
  Its basically a tool that lets you manage all of the js tracking scripts (tags) that advertisers, affiliates, etc have you paste into a website. So instead of having a million js snippets on your page, you have one google tag manager snippet and then your marketing team can inject 400mb of javascript into the site without bothering dev.

choeger 4y ago

In what sense is TCP tomorrow different from disallowing 3rd party cookies today? On a side note: Isn't it odd, how the composition of different technologies (here HTTP and DNS) make it unintuitively complex to implement a so intuitively natural policy as "every website gets to read only its own cookies"?

red_trumpet 4y ago
> every website gets to read only its own cookies That's already the case, isn't it? It's just that embedded parts by a 3rd party can set their own cookies, which can be read by the 3rd party whenever it is embedded in any other page.
- aidenn0 4y ago
  It's not already the case, but it is expected to be the case in all major browsers sometime next-year[1] 1: https://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie https://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie
  - cortesoft 4y ago
    You aren’t disagreeing with the person you are responding to, you just have slightly different ideas what it means when someone says “website” You are calling all of the assets loaded, no matter from where, as one “website”. The person you are replying to considers each domain for each asset on the single page as being different “websites”
    - TylerE 4y ago
      Then they should say server/domain/subdomain and not “website”.
taeric 4y ago
Of course... knowing that this is all by well behaving browsers is a bit of a troubling point. Such that I find it equally odd that we have placed so much power and general trust into software that we keep expanding the capabilities of. It is a small step to "managed devices" that we don't even trust users to keep up to date being required for access.

kevin_thibedeau 4y ago

> allowing those [third party] cookies to fulfill their less invasive use cases (e.g. to provide accurate analytics Separate cookie jars don't prevent data brokers from correlating cookies from a common IP + user agent pair. The only solution is to block third parties altogether.

seizethegdgap 4y ago
Obviously doesn't help when using an app, but what about an extension that changes your user agent every single time you send a request to a website? Does such an extension even work, or exist?
- Nextgrid 4y ago
  Even if it did, it will be useless because fingerprinting (of various kinds - whether TCP or TLS stack, doesn't even have to be JS-based) will still tell which browser you're running on. Worse, it may actually make you more identifiable because a Chrome on Linux user agent with the TCP fingerprint of Windows and TLS fingerprint of Firefox is going to stick out like a sore thumb, even more than a rare-but-at-least-consistent fingerprint with no trickery.
  - jhoechtl 4y ago
    What if I browse using tor?
  - benmmurphy 4y ago
    I'm not sure TCP fingerprints are very reliable because a lot of ISPs and Mobile Carriers are doing proxying at the application level for HTTP/HTTPS ports so even if you are on an iPhone you might end up having a linux TCP fingerprint. This site allows you test your TCP fingerprint: http://witch.valdikss.org.ru http://witch.valdikss.org.ru
the_pwner224 4y ago
The long term workaround for data brokers is to become a first party... have the main website serve your 3rd party JS from their own server under their own domain. That makes it much harder to block. For your IP+UA hypothetical, the easy fix is to make everyone look the same. IP should be the only personally identifiable factor. Tor and desktop Firefox w/ privacy.resistFingerprinting turned on both do this. Open window not-maximized at 1000x1000 size, use the same UA regardless of what platform & browser version you're actually on, and a bunch of other stuff. That said, I don't know how effective it actually is against modern comprehensive fingerprinting libraries.

clumsysmurf 4y ago

A couple of days ago there was a story on HN about fingerprinting https://news.ycombinator.com/item?id=35243355 https://news.ycombinator.com/item?id=35243355 The take-away I got from this article is that, companies found a way to uniquely identify you anyhow, without cookies. Is this too little too late?

focusedone 4y ago
Firefox user but relatively ignorant on how tracking works. FF does some good things to work around fingerprinting, although simply using FF puts us in a pretty small (marketable) group in the first place.
- OkayPhysicist 4y ago
  Frankly, Firefox should take the nuclear option, and just start emulating Chrome with regard to website identifiable information. In particular, User-Agent strings are now a net-negative. I've never run into a website that doesn't work on Firefox. I do occasionally run into websites that claim to not work on Firefox. We software developers have shown that we can't be trusted with information pertaining to what browser someone is using, and as such should have the privilege taken away. If you're reading this, and you have access to a codebase that reads User-Agent strings for anything more than idle curiosity, just delete it and push to master.
  - MrJohz 4y ago
    I actually ran into a case for using UA strings yesterday, if you know of a better solution let me know! I have a canvas element where the user needs to be able to both scroll and zoom with the mouse wheel. Generally, zooming involves scrolling while also holding the ctrl button down - except on MacOS, where it's cmd. I obviously want to use the operating system conventions that my users will be expecting, but the best way of determining that, that I've found, is searching for the string 'Mac' in the user agent string. Like I say, if you know of a better way to detect whether I should be binding on ctrl or cmd, let me know! This is the first time I've used the user agent in a long time, and it feels like there should be a better system...

Nextgrid 4y ago

[flagged]

sevg 4y ago
Because no software is perfect from the first release :) This is what software developers do, iterate to improve software.
dmix 4y ago
There were plenty of legitimate use cases for 3rd party cookies. The negative ones just started to trump the legitimate ones over time and browsers lag behind these trends (or have different incentives).

the_pwner224 4y ago

Has Chrome already been doing this for a while? (I'm not sure, but I think I've heard that it has). Disclaimer: I'm a FF user, not trying to say FF is bad, I just want to know how much of this is actually new cutting edge privacy protection vs. marketing fluff.

privacyonsec 4y ago
no but brave browser does
- the_pwner224 4y ago
  Thanks.

billiam 4y ago

This is nice to see, but it worth pointing out that it is years overdue. Mozilla dragged its feet for years about Tracking Protection and cookies in general, coming up with halfway measures while continuing to serve the needs of advertisers that had a lot of influence on the company. The end state of Total Cookie Protection was clear from the beginning. It is of course not easy to change the advertising based model, but it's not like Firefox is really more than an influencer of Google and Apple, its market share has all but disappeared. No, the motivation to take seven years to get to TCP was all about money, including big salaries and bonuses for Mozilla executives.

Tagbert 4y ago
So when did Chrome start doing this?

dandongus 4y ago

Why is there any concept of "some users worldwide" with respect to default cookie settings in a browser application?

wnevets 4y ago
to avoid breaking changes for every single user?

INeedMoreRam 4y ago

[dead]

xuhu 4y ago

Will bitbucket.org sending me to oauth.atlassian.com fail with Total Cookie Protection enabled ? Will someonlineshop.com redirecting me to payments.mybank.com fail with Total Cookie Protection enabled because the payments site uses cookies to store the return url for the online shop ?

dizhn 4y ago
I believe they maintain a whitelist for the big guys.
Spivak 4y ago
With oauth probably not since the state doesn't transfer with cookies. You send the user to the IdP with a postback in the URL then when the user logs it it sends them back to the original site with some data that depends on the flow you chose. Your login cookie as far as the IdP is concerned lives on oauth.thirdparty.net and on a successful login the app issues you your own session token that lives on myapp.com.

_V_ 4y ago

I don't want to be a killjoy here. Don't get me wrong, this is certainly a good thing but to me it seems like most major trackers are moving/has already moved to things like canvas fingerprinting, WebAssembly fingerprinting etc. This seems to be like a typical cat-and-mouse game. And browsers will not get more privacy friendly as long as there will be a trend that moves applications and basically every aspect of our lives into the browser thus making it unbelieveably complex. I suspect that we will soon have to choose to either live as a "digital hermit" (links/neomutt and other lightweight apps that do only the one thing) or give up and join everyone with Youtube/Facebook/Twitter.

zx8080 4y ago
> to me it seems like most major trackers are moving/has already moved to things like canvas fingerprinting, WebAssembly fingerprinting etc. Also the upcoming WebGPU enabling by default in chrome will probably make it very simple to fingerprint almost anyone.
WeylandYutani 4y ago
I'm blocking pretty much all website advertising. I'm sure I'm being tracked but I can't see their personalised ads so whatever. Out of sight out of mind.

stereoradonc 4y ago

Firefox does everything about privacy that Vivaldi should do (and more).