5 ms·

I set firefox to clear cookies, also using cookies to "strict" This somehow causes a huge pain to connect to mozilla's matrix instance, and I never understood

by jokoon 2y ago

I set firefox to clear cookies, also using cookies to "strict" This somehow causes a huge pain to connect to mozilla's matrix instance, and I never understood why. This is a bit ironic since firefox has that feature to clear cookies. I had to reset password, and do other weird things, I can't remember what exactly. I hope this MAS thing fixes it.

apples_oranges 2y ago
So unusable for people like me who only surf in private mode
anon7000 2y ago
I mean, yeah, tracking prevention features basically completely break cross-domain authentication. There are a surprising number of valid use cases that need cross-domain auth (or make the user experience a lot easier). While there are workarounds these days, sometimes it does require deep changes in how auth works
- jokoon 2y ago
  > There are a surprising number of valid use cases that need cross-domain auth I am not a web developer, but I would disagree with that. Either web standards respect privacy or they don't, but I would not sacrifice privacy for anything. Firefox was right to prevent tracking, it highlights how webstandards are just not good. I something doesn't work properly in a firefox private window, to me it should not exist.
  - kibwen 2y ago
    The status quo appears to involve handing over your account password to your chosen client. That's worse than this.
    - wkat4242 2y ago
      If you don't trust your matrix client, why use it at all? It's also a bit disheartening to see Matrix putting all that "Log in with Google", Apple, Facebook etc so prominently on their login page. The whole idea of decentralised services was getting out of those walled gardens.
      - radlad 2y ago
        Yeah, I would argue it's less about removing trust from the client (which will ultimately get an auth token in addition to secrets and plaintext messages) and more about allowing for centralized authentication and authorization policies.
    - cvwright 2y ago
      But you already trust your client with all the private keys and message plaintexts for your account. I struggle to see why I should trust it with those things but not the account password.
      - lucyjojo 2y ago
        my google account has way more power over me than whatever i ever wrote in matrix in my life (ever, ever)
      - tcfhgj 2y ago
        Not necessarily, you could give restricted access to a client
  - dwattttt 2y ago
    Authentication requires the opposite of privacy. If you don't want to be identified, you can't restrict anything to your identity.
    - kevin_thibedeau 2y ago
      If I'm authenticating with server A. I shouldn't have to carry ephemera from server B. A can interact with B on its own if necessary. Bubbling up these architectural details to the front end is a symptom of the webdev cargo cult coming up with broken ideas that get fossilized as the status quo.
      - radlad 2y ago
        With OIDC, both occur: the client is redirected to the authentication server where they directly authenticate, then carries a token cross-domain back to the service. Finally, the service validates the token against the auth server. The alternative would be something where I enter my Google username/password on random websites, and trust that they will forward it to Google and not do anything nefarious. This is less secure and less private.
    - radlad 2y ago
      It kind of depends. See Kagi Privacy Pass ("Allows you to use Kagi Search with Privacy Pass, which cryptographically ensures that Kagi cannot tie that request to an account and allows for further privacy and anonymity."): https://help.kagi.com/kagi/privacy/privacy-pass.html https://help.kagi.com/kagi/privacy/privacy-pass.html
      - jeroenhd 2y ago
        ... which requires an addon to the browser, or for it to be built in specifically for that company. That's not something companies like Matrix can use. If you're installing software already, why not skip the browser engine and install a full Matrix client instead?
        2y ago
nurettin 2y ago
How do you prevent them from collecting "Interaction Data"? https://www.mozilla.org/en-US/privacy/firefox/#bookmark-how-we-use-data https://www.mozilla.org/en-US/privacy/firefox/#bookmark-how-...
jeroenhd 2y ago
Putting tracking protection to strict essentially makes Firefox violate certain web standards. Developers aren't going to test against that, and if they are they're probably not going to be able to do much about the problems strict tracking protection causes. If MAS fixes this, it'll be by accident and it'll probably break in the future. Firefox warns against this kind of breakage if you enable strict tracking protection in the settings. You can't have strict tracking protection + websites doing cross-domain authentication working.

by jokoon 2y ago

apples_oranges 2y ago

So unusable for people like me who only surf in private mode

anon7000 2y ago

I mean, yeah, tracking prevention features basically completely break cross-domain authentication. There are a surprising number of valid use cases that need cross-domain auth (or make the user experience a lot easier). While there are workarounds these days, sometimes it does require deep changes in how auth works

jokoon 2y ago
> There are a surprising number of valid use cases that need cross-domain auth I am not a web developer, but I would disagree with that. Either web standards respect privacy or they don't, but I would not sacrifice privacy for anything. Firefox was right to prevent tracking, it highlights how webstandards are just not good. I something doesn't work properly in a firefox private window, to me it should not exist.
- kibwen 2y ago
  The status quo appears to involve handing over your account password to your chosen client. That's worse than this.
  - wkat4242 2y ago
    If you don't trust your matrix client, why use it at all? It's also a bit disheartening to see Matrix putting all that "Log in with Google", Apple, Facebook etc so prominently on their login page. The whole idea of decentralised services was getting out of those walled gardens.
    - radlad 2y ago
      Yeah, I would argue it's less about removing trust from the client (which will ultimately get an auth token in addition to secrets and plaintext messages) and more about allowing for centralized authentication and authorization policies.
  - cvwright 2y ago
    But you already trust your client with all the private keys and message plaintexts for your account. I struggle to see why I should trust it with those things but not the account password.
    - lucyjojo 2y ago
      my google account has way more power over me than whatever i ever wrote in matrix in my life (ever, ever)
    - tcfhgj 2y ago
      Not necessarily, you could give restricted access to a client
- dwattttt 2y ago
  Authentication requires the opposite of privacy. If you don't want to be identified, you can't restrict anything to your identity.
  - kevin_thibedeau 2y ago
    If I'm authenticating with server A. I shouldn't have to carry ephemera from server B. A can interact with B on its own if necessary. Bubbling up these architectural details to the front end is a symptom of the webdev cargo cult coming up with broken ideas that get fossilized as the status quo.
    - radlad 2y ago
      With OIDC, both occur: the client is redirected to the authentication server where they directly authenticate, then carries a token cross-domain back to the service. Finally, the service validates the token against the auth server. The alternative would be something where I enter my Google username/password on random websites, and trust that they will forward it to Google and not do anything nefarious. This is less secure and less private.
  - radlad 2y ago
    It kind of depends. See Kagi Privacy Pass ("Allows you to use Kagi Search with Privacy Pass, which cryptographically ensures that Kagi cannot tie that request to an account and allows for further privacy and anonymity."): https://help.kagi.com/kagi/privacy/privacy-pass.html https://help.kagi.com/kagi/privacy/privacy-pass.html
    - jeroenhd 2y ago
      ... which requires an addon to the browser, or for it to be built in specifically for that company. That's not something companies like Matrix can use. If you're installing software already, why not skip the browser engine and install a full Matrix client instead?
      - 2y ago

nurettin 2y ago

How do you prevent them from collecting "Interaction Data"? https://www.mozilla.org/en-US/privacy/firefox/#bookmark-how-we-use-data https://www.mozilla.org/en-US/privacy/firefox/#bookmark-how-...

jeroenhd 2y ago

Putting tracking protection to strict essentially makes Firefox violate certain web standards. Developers aren't going to test against that, and if they are they're probably not going to be able to do much about the problems strict tracking protection causes. If MAS fixes this, it'll be by accident and it'll probably break in the future. Firefox warns against this kind of breakage if you enable strict tracking protection in the settings. You can't have strict tracking protection + websites doing cross-domain authentication working.