10 ms·

Firefox getting smarter about third-party cookies

217 points by gulbrandr 14y ago

abcd_f 14y ago
Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.
- Achshar 14y ago
  But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.
  - abcd_f 14y ago
    Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as simple as this.
    - deleted 14y ago
      [deleted]
    - Retric 14y ago
      How about newspapers that show articles when a user comes from Google but not otherwise?
      - epmatsw 14y ago
        How is that a better experience? This is a legitimate question, I don't think I understand what you're referring to.
        anonymoushn 14y ago
        I think he means that showing you an article is a better experience than not showing you an article.
        Achshar 14y ago
        Maybe he means cases where newspaper sites let users skip paywall if they are coming from google x times a month.
    - cbr 14y ago
      Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. This is short sighted. Sites can respond to referrers by improving themselves and better adapting to what users are looking for.
      - huhtenberg 14y ago
        Sure, in theory.
    - icebraining 14y ago
      Anti-hot-linking may be dumb to protect the content, but it's very useful to protect others from abusing sites as if they were free image hosters. I run a small site, and we would occasionally get hotlinked by random people searching for images on Google, which would kill our bandwidth caps. If it weren't for referer filters, we'd have to hide any image for unregistered users. That said, keep just first-party referers would be fine - we'd just block any image request without referer.
    - lftl 14y ago
      I don't think the referer info is ever really essential but here are some possibilities: 1) If you came from a social media site, maybe I'd highlight that particular social sharing option in a share bar, or hide others. 2) In an e-commerce store, maybe Google sent you to some page on my site that isn't really the best for your search term (product discontinued, other better matching product), I can give you a link to that other page. Google isn't necessarily magical in its ability to pick the best page on a site for a specific term. Maybe if you come from a competitor I can highlight some content that compares my product to the competitor's. 3) I've never derived a ton of benefit from it, but some sites will highlight your search term for you on a page. It could possibly also automatically scroll you to a relevant section if it's a long page and what you searched for is an exact match for some subsection. In general it can be a valuable data point sites can use to improve the end-user experience. That being said, I can't think of anything where the value really outweighs the potential for abuse, but I think saying that it has no value to the user is short-sighted.
    - bsimpson 14y ago
      Isn't the Referrer header what Google Analytics et. al. use to tell you how people are finding pages on your site? Seems like that could be quite useful for a webmaster to learn more about his audience, tailoring his content to better fit the traffic coming from those sources and identifying other sites that might be abusive (e.g. scraping his content).
    - potch 14y ago
      The ability to highlight search terms in a page. You may disagree that is a better experience for you, but you may not make blanket statements that "there are no such cases, period".
- socillion 14y ago
  You can use an addon like Smart Referer[1] (removes cross domain referer headers) but it does unpredictably break sites that depend on it. Considering it requires whitelisting to avoid weird and hard to diagnose issues, it seems unlikely to be added to Firefox. 1. https://addons.mozilla.org/en-US/firefox/addon/smart-referer/ https://addons.mozilla.org/en-US/firefox/addon/smart-referer...
- briansmith 14y ago
  First, there are already multiple Firefox extensions that will let you totally control the Referer header. (In general, if there's something that you want to change about Firefox, you should search https://addons.mozilla.org https://addons.mozilla.org to find a solution, because somebody's probably already created an extension that does what you want.) I think one such extension is called "RefControl." I also brought up the issue on Mozilla's dev.privacy mailing list [1] recently. See: https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdzIU8/Vrugn8XquL4J https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdz... In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. My proposal is to strip the Referer header down to just the origin + '/', e.g. http://example.org/ http://example.org/ instead of http://example.org/foo?search=whatever+you+searched+for http://example.org/foo?search=whatever+you+searched+for. I think it will be difficult for us to go further than that in the default configuration any time soon (and, as you can see in that thread, there's even some pushback to my extremely reasonable proposal). Also, I know there is active work happening to bring extra control over the Referer header to Firefox's built-in prefs. This seems to be a little bit in conflict with our "Checkboxes that kill" project so I'm not sure how it will turn out. [1] https://lists.mozilla.org/listinfo/dev-privacy https://lists.mozilla.org/listinfo/dev-privacy
  - Silhouette 14y ago
    FWIW, I just followed your advice, searching Firefox Addons for "Referer". The results were not helpful at all for the goal abcd_f mentioned of blocking cross-site referrers. [Edit: Sorry, it looks like I mistyped "Referer". There is at least one promising addon on the first page.] Also FWIW, I agree that this is indeed becoming a significant privacy issue. I too don't see why Google or Typekit or some widely used CDN should be gifted a convenient history of my web browsing just because they host popular JavaScript libraries or web fonts. I'm intrigued by this comment: In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. Is this because some of the third party resources are only authorised for use by certain sites and rely on Referer to establish whether a given request qualifies? Given that there is no security or verification for Referer headers, that seems like a rather broken model to start with. I can't help thinking that if one of the big browsers forced the issue then those services would have to reconsider and do things a smarter way. That seems likely to inherently reduce the amount of unnecessary information being passed across to those third party services in the first place.
- copypasteweb 14y ago
  RefControl is a nice addon for that, with ability to set default behaviour and override it for specific domains. https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ https://addons.mozilla.org/en-US/firefox/addon/refcontrol/
- tquai 14y ago
  Any ETA for allowing to block Referer header from being included in cross-origin requests? This feature has been supported in Firefox for a long time, but you have to set it in about:config via the "network.http.sendRefererHeader" integer. 2 = always send 1 = send only to same FQDN (what you seem to want) 0 = never send IMO this is one of the best bang-for-your-buck privacy configurations. I would love it if Mozilla changed the default from 2 to 1, and at the least, it SHOULD be an option under the Preferences -> Privacy tab.
don_draper 14y ago
Google is in the ad business making it tougher for them to go in this direction. Go Firefox
- uulbiy 14y ago
  > Users of this build of Firefox must directly interact with a site or company for a cookie to be installed on their machine. There are not many users that don't interact with google. While I don't expect the chrome team to add this to their feature list (even as optional), if they did, it would not really hurt google. It would actually hurt all the other "smaller" players.
  - mfenniak 14y ago
    Chrome will probably never make this the default, unfortunately. But, this is an option in Chrome. Settings > Show Advanced > Privacy > Content settings... > Block third-party cookies and site data. It's not exactly obvious, of course. :-)
    - Spittie 14y ago
      This isn't exactly the same as blocking third-party cookies, and Firefox was capable of that since forever. Firefox is going to accept third-party cookies only from sites that you already browsed before, kinda like Safari does it now.
  - mccr8 14y ago
    It is my understanding that Google uses separate domains like doubleclick.net for serving ads, not google.com, so they won't gain any particular advantage there. Of course, that could change.
    - brandnewlow 14y ago
      As I understand it, they serve those assets from the Google.com domain for safari and could do so for this.
  - 14y ago
snowmaker 14y ago
Does anyone know what Chrome does for 1st party vs. 3rd party cookies? Are they doing this too yet?
- brandnewlow 14y ago
  We're following the issue closely and so far there's no indication Chrome will follow suit.
silverlight 14y ago
We have an app that runs in an iFrame on another site (in a Google+ Hangout). Are the cookies in the iFrame going to be considered 3rd party cookies by this if they match the domain of the iFrame source?
- Nursie 14y ago
  I would expect so. From the sounds of it you may have to direct users to visit your site directly before this works.
  - brianr 14y ago
    The same issue will likely apply for Facebook apps that run inside of iframes... and I think these days that's all of them.
hiddenfeatures 14y ago
Does this affect Google Analytics (or any analytics software for that matter)? if so: How would a webmaster deal with that?
- cbr 14y ago
  Google Analytics javascript runs on your domain and the cookies it uses are on your domain. So it should count as "first party" here.
  - hiddenfeatures 14y ago
    Interesting. Isn't the website just telling to load the script from a Google server (which could count as 3rd party) and execute it?
    - mjn 14y ago
      It's loading from a 3rd party (with a 3rd-party HTTP request), but the script itself is run by the first party: scripts are owned by whichever page executes them, regardless of how that page conjured them up. That's why you can load jquery from a CDN without breaking lots of things, because jquery still "runs from" your domain, same as if it were hosted locally. Also a reason that you really need to trust the third-party host, because if you load malicious third-party JS, it runs from your domain.
      - Nursie 14y ago
        Thanks, that's a neat little explanation and cleared a couple of things up for me :)
      - hiddenfeatures 14y ago
        thanks for the cool explanation. That really filled in a few blanks in my understanding of the web.
  - baby 14y ago
    There is no creation of cookies in the snippet you have to copy/paste on your website. So if some cookies are created they are not first party.
ferongr 14y ago
Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509 https://bugzilla.mozilla.org/show_bug.cgi?id=536509
- derefr 14y ago
  It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Combining this with a "forgiveness is better than permission" principle (which seems to be sorely lacking in web browsers, other than a few just-plain-strange places like alert() dialogs), the best UX might just be a warning bar stating "Example.com has reserved 1KB/5MB of your disk so it can remember its place. [Disallow]" Disallowing would make the site think it still has a permanent store, but internally replace it with an ephemeral one (FS::TEMPORARY, session cookie, etc.) This also might make browser makers get off their lazy butts and make ephemeral versions of the rest of these mechanisms, to make this work ;)
  - ihsw 14y ago
    What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"
    - derefr 14y ago
      Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever. Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify you've given them the persistence they want before they let you through, and so forth. And even if they didn't, the request would still become one of those things naive users think you just "have to click OK to if you want the computer to keep doing the thing"--like Windows UAC elevation. On the other hand, giving users an equivalent option to a "hellban" on a website--the ability to make the website think it's persisting, but then it turns out not to be--has far fewer incentives. It only ends up being something you click for a reason, rather than a "mother may I" you have to just click all the time, and since getting off the blacklist wouldn't be exposed directly through the browser chrome, there'd be nowhere for a malicious site to "point an arrow."
zzzeek 14y ago
I'm really enjoying the self-destructing cookies addon: https://addons.mozilla.org/en-us/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/en-us/firefox/addon/self-destruct... . It's really great to go to Facebook and see it have absolutely no idea who I am every time I go there. Plugin works very well.
- baby 14y ago
  Never heard of this one, and it looks really good. I'll try it right now. But will it still be useful with the new Firefox updates?
  - zzzeek 14y ago
    it should, it blacklists all sites by default to not persist cookies at all beyond having the window open.
  - ove 14y ago
    Hi, I'm the author of this add-on. You might want to read the FAQ entry "Q: How is this different from disabling 3rd party cookies and installing Adblock?". Firefox's new 3rd party cookie policy is actually weaker than disabling them outright, so this will not change anything.
    - cpeterso 14y ago
      Back in the day, Firefox experimented with making third-party cookies session-only, but I believe this option was disabled because some websites using third-party login cookies required users to login every session. Have you run into any problem websites with self-destructing cookies?
      - ove 14y ago
        Disabling 3rd party cookies has never broken a single site for me. I've heard that some banks require them, though. As for Self-Destructing Cookies: it's a pretty drastic measure. Considering this, it's surprisingly compatible. Among the sites that I frequent, not a single one stopped working. Inter-domain transaction - e.g. a shop forwarding you to Paypal and back - used to be a problem, but the latest version has a heuristic for that. Still, I'm pretty sure that some people will experience fallout. You can work around that; SDC has numerous functions that can help in such cases (pause, undelete, whitelist for session).
Too 14y ago
Finally. Third party cookies provide almost zero value for users. Only use case is for log in on iframe-embedded apps such as Discus comment boards, but the ones you use yourself can be counted on one hand so adding exceptions isn't such a big issue. Adding some UI that shows that you are logged in to Discus on a particular web page would just good imo. I think the "From visited" option is an excellent trade off as a transition period until a better option for embedded authentication is available.
- chez17 14y ago
  > Third party cookies provide almost zero value for users. I don't like third party cookies either, but this is false. Your information is worth something to the right people. The websites you visit, mostly free, can make money off that information. The value to the user are free websites that provide you entertainment/content/etc... and are able to stay free because they are utilizing this as a revenue stream. We all know there are other ways, perhaps more moral ways, but to say it provides nothing to the user is false. It funds the websites you're visiting.
  - troymc 14y ago
    While that's often true, many (most?) users have no idea that they're making this deal (i.e. "I let you store your cookies on my computer and in return I get free stuff."). The European "cookie law" has caused many websites to give better notice that they're planting cookies, but it's rarely clear how those cookies are being used. There is a better way. What if I purposefully signaled my intent to potential sellers, rather than having them guess what I want (based on their data about me)? Amazon wish lists are an example (although they'd be better if I stored the list in a place of my choice, where I control who sees what, and I'm told who looks). For more on this idea, see: http://en.wikipedia.org/wiki/Vendor_relationship_management http://en.wikipedia.org/wiki/Vendor_relationship_management
  - belorn 14y ago
    Let ad companies and ad supported SaS do what they are good at - Targeted ads. Target people who want the ads. Give those people the services of easy access to new products, and leave people who do not click on ads alone. There is a simple answer to all this. Its called opt-in. If you need to harass and track users who do not want ads, then either the targeted ads are not targeted enough, or its a failed business model. Time to show which one it is.
Apocryphon 14y ago
When it first came out, Chrome's killer app (to me) was performance and the lack of bloat that had infected Firefox at the time. However, FF can more than redeem itself by making privacy and allowing users to easily "go off the grid" its killer app.
mortenlarsen 14y ago
I have been thinking about cookie sandboxing for a while: The idea is to have a separate cookie store for each 2nd level domain I am visiting. So the Facebook cookie on some site I am visiting that has a Facebook "Like" button on it is different from the actual Facebook cookie I would get from visiting Facebook. This would make cookie tracking across sites unusable, since each site would have it's own version of a cookie.
JonnieCache 14y ago
Sounds like a superb idea. One thing though: surely this will leak my browsing history, albeit very slowly? On balance it seems a net gain all the same.
chick 14y ago
Firefox is getting better and better now. Great!
adorton 14y ago
This is good news for sites like Facebook that track users across multiple, unrelated sites. Individual sites can still track you with third-party analytics tools by creating a CNAME (DNS alias) to a third-party tracking domain.
cromwellian 14y ago
There are lots of cases where third party cookies are used as auth tokens, not tracking tokens. Seems to me that the browser vendors should get together and come up with a better solution for browsers to store and manage auth tokens. Right now it is done piecemeal by websites, but is confusing to end users. Having a direct, first-class API and UI in the browser that can show the user exactly what third party sites they are "logged into" and have a "Logout/Deauthorize" button next to them would be worthwhile, and have less of a chance of "breaking the web", or imposing workarounds that might hurt user experience. BTW, how does Firefox treat a CORS XHR response? Does it allow a cookie to be set? Seems to be ad trackers could then just run a server that permits CORS, have a bit of JS that makes the request to opt it back in.
- fpgeek 14y ago
  Isn't improved browser-level authentication handling (including not letting information leak via authentication) one of the things BrowserID is about?
runamok 14y ago
So this would essentially break all conversion tracking and the like done by advertisers, right?
charlieok 14y ago
How is this going to interact with plugins that cover similar ground (e.g. DoNotTrackMe, Ghostery)?
suhail 14y ago
Curious for people that actively write way more JavaScript and deal with cookies more than I do: Outside of Local Storage, is there still a loop-hole (though it defies user expectation) for ad retargeters (they must rely on third party cookies)? I feel, if not, that this will totally kill those businesses. I am neutral and just wondering if I am missing something. Google was sued for using iframes to get around this so defying user expectation no matter the loop hole is quite dangerous.
- pixelmonkey 14y ago
  HTTP ETags are probably the most widely used workaround for 3rd-party cookie blocking. http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags Not sure whether the Firefox folks have figured out a way to patch this workaround up or not. I do think that retargeting businesses are in for a bit of pain given the headwinds re: third-party tracking across the US and world.
ck2 14y ago
What's great is the mobile version of firefox also can turn off third-party cookies while the Chrome mobile has no such option.
jmomo 14y ago
I have been blocking 3rd party cookies for years. The only site that has ever had a problem was my local power company (aps.com). However, it was easy to get around because even though their site warned that 3rd party cookies were required, you could just click around it to pay your electrical bill. I've never had a problem on any other sites that I use in at least five years, though I suspect it's been more than that.
Kiro 14y ago
So this will be the end of remarketing? IMO remarketing is the best thing that has happened to advertisement online. It's a win-win-win situation for visitors, advertisers and publishers.
- Nursie 14y ago
  A win for me is not seeing advertising, at all, ever. Targeted ads are not a win-win, they're creepy.

217 points by gulbrandr 14y ago

Excellent. I know you, Mozilla guys, are on HN, so a question. Any ETA for allowing to block Referer header from being included in cross-origin requests? If I'm on the page that pulls down something from Google Fonts, I see no reason why I should be sharing with Google the URL of the page I'm visiting.

Achshar 14y ago
But a request is still a request. It might not make sense to include referer data in the case you mentioned but that does not mean every cros request will fit that description.
- abcd_f 14y ago
  Give me an example where sending a Referer is essential to providing me as a user with a better experience. There are no such cases, period. Also, with an exception of dumb content protection schemes (anti-hot-linking), Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. If Mozilla is in fact "passionate about putting its users first", these headers must go. It is as simple as this.
  - deleted 14y ago
    [deleted]
  - Retric 14y ago
    How about newspapers that show articles when a user comes from Google but not otherwise?
    - epmatsw 14y ago
      How is that a better experience? This is a legitimate question, I don't think I understand what you're referring to.
      - anonymoushn 14y ago
        I think he means that showing you an article is a better experience than not showing you an article.
      - Achshar 14y ago
        Maybe he means cases where newspaper sites let users skip paywall if they are coming from google x times a month.
  - cbr 14y ago
    Referrers are used exclusively for tracking purposes and carry zero positive benefits for the users. This is short sighted. Sites can respond to referrers by improving themselves and better adapting to what users are looking for.
    - huhtenberg 14y ago
      Sure, in theory.
  - icebraining 14y ago
    Anti-hot-linking may be dumb to protect the content, but it's very useful to protect others from abusing sites as if they were free image hosters. I run a small site, and we would occasionally get hotlinked by random people searching for images on Google, which would kill our bandwidth caps. If it weren't for referer filters, we'd have to hide any image for unregistered users. That said, keep just first-party referers would be fine - we'd just block any image request without referer.
  - lftl 14y ago
    I don't think the referer info is ever really essential but here are some possibilities: 1) If you came from a social media site, maybe I'd highlight that particular social sharing option in a share bar, or hide others. 2) In an e-commerce store, maybe Google sent you to some page on my site that isn't really the best for your search term (product discontinued, other better matching product), I can give you a link to that other page. Google isn't necessarily magical in its ability to pick the best page on a site for a specific term. Maybe if you come from a competitor I can highlight some content that compares my product to the competitor's. 3) I've never derived a ton of benefit from it, but some sites will highlight your search term for you on a page. It could possibly also automatically scroll you to a relevant section if it's a long page and what you searched for is an exact match for some subsection. In general it can be a valuable data point sites can use to improve the end-user experience. That being said, I can't think of anything where the value really outweighs the potential for abuse, but I think saying that it has no value to the user is short-sighted.
  - bsimpson 14y ago
    Isn't the Referrer header what Google Analytics et. al. use to tell you how people are finding pages on your site? Seems like that could be quite useful for a webmaster to learn more about his audience, tailoring his content to better fit the traffic coming from those sources and identifying other sites that might be abusive (e.g. scraping his content).
  - potch 14y ago
    The ability to highlight search terms in a page. You may disagree that is a better experience for you, but you may not make blanket statements that "there are no such cases, period".
socillion 14y ago
You can use an addon like Smart Referer[1] (removes cross domain referer headers) but it does unpredictably break sites that depend on it. Considering it requires whitelisting to avoid weird and hard to diagnose issues, it seems unlikely to be added to Firefox. 1. https://addons.mozilla.org/en-US/firefox/addon/smart-referer/ https://addons.mozilla.org/en-US/firefox/addon/smart-referer...
briansmith 14y ago
First, there are already multiple Firefox extensions that will let you totally control the Referer header. (In general, if there's something that you want to change about Firefox, you should search https://addons.mozilla.org https://addons.mozilla.org to find a solution, because somebody's probably already created an extension that does what you want.) I think one such extension is called "RefControl." I also brought up the issue on Mozilla's dev.privacy mailing list [1] recently. See: https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdzIU8/Vrugn8XquL4J https://groups.google.com/d/msg/mozilla.dev.privacy/wmPzPCdz... In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. My proposal is to strip the Referer header down to just the origin + '/', e.g. http://example.org/ http://example.org/ instead of http://example.org/foo?search=whatever+you+searched+for http://example.org/foo?search=whatever+you+searched+for. I think it will be difficult for us to go further than that in the default configuration any time soon (and, as you can see in that thread, there's even some pushback to my extremely reasonable proposal). Also, I know there is active work happening to bring extra control over the Referer header to Firefox's built-in prefs. This seems to be a little bit in conflict with our "Checkboxes that kill" project so I'm not sure how it will turn out. [1] https://lists.mozilla.org/listinfo/dev-privacy https://lists.mozilla.org/listinfo/dev-privacy
- Silhouette 14y ago
  FWIW, I just followed your advice, searching Firefox Addons for "Referer". The results were not helpful at all for the goal abcd_f mentioned of blocking cross-site referrers. [Edit: Sorry, it looks like I mistyped "Referer". There is at least one promising addon on the first page.] Also FWIW, I agree that this is indeed becoming a significant privacy issue. I too don't see why Google or Typekit or some widely used CDN should be gifted a convenient history of my web browsing just because they host popular JavaScript libraries or web fonts. I'm intrigued by this comment: In general, we cannot block the Referer header by default on cross-origin requests because we know that would break too many websites. Is this because some of the third party resources are only authorised for use by certain sites and rely on Referer to establish whether a given request qualifies? Given that there is no security or verification for Referer headers, that seems like a rather broken model to start with. I can't help thinking that if one of the big browsers forced the issue then those services would have to reconsider and do things a smarter way. That seems likely to inherently reduce the amount of unnecessary information being passed across to those third party services in the first place.
copypasteweb 14y ago
RefControl is a nice addon for that, with ability to set default behaviour and override it for specific domains. https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ https://addons.mozilla.org/en-US/firefox/addon/refcontrol/
tquai 14y ago
Any ETA for allowing to block Referer header from being included in cross-origin requests? This feature has been supported in Firefox for a long time, but you have to set it in about:config via the "network.http.sendRefererHeader" integer. 2 = always send 1 = send only to same FQDN (what you seem to want) 0 = never send IMO this is one of the best bang-for-your-buck privacy configurations. I would love it if Mozilla changed the default from 2 to 1, and at the least, it SHOULD be an option under the Preferences -> Privacy tab.

don_draper 14y ago

Google is in the ad business making it tougher for them to go in this direction. Go Firefox

uulbiy 14y ago
> Users of this build of Firefox must directly interact with a site or company for a cookie to be installed on their machine. There are not many users that don't interact with google. While I don't expect the chrome team to add this to their feature list (even as optional), if they did, it would not really hurt google. It would actually hurt all the other "smaller" players.
- mfenniak 14y ago
  Chrome will probably never make this the default, unfortunately. But, this is an option in Chrome. Settings > Show Advanced > Privacy > Content settings... > Block third-party cookies and site data. It's not exactly obvious, of course. :-)
  - Spittie 14y ago
    This isn't exactly the same as blocking third-party cookies, and Firefox was capable of that since forever. Firefox is going to accept third-party cookies only from sites that you already browsed before, kinda like Safari does it now.
- mccr8 14y ago
  It is my understanding that Google uses separate domains like doubleclick.net for serving ads, not google.com, so they won't gain any particular advantage there. Of course, that could change.
  - brandnewlow 14y ago
    As I understand it, they serve those assets from the Google.com domain for safari and could do so for this.
- 14y ago

snowmaker 14y ago

Does anyone know what Chrome does for 1st party vs. 3rd party cookies? Are they doing this too yet?

brandnewlow 14y ago
We're following the issue closely and so far there's no indication Chrome will follow suit.

silverlight 14y ago

We have an app that runs in an iFrame on another site (in a Google+ Hangout). Are the cookies in the iFrame going to be considered 3rd party cookies by this if they match the domain of the iFrame source?

Nursie 14y ago
I would expect so. From the sounds of it you may have to direct users to visit your site directly before this works.
- brianr 14y ago
  The same issue will likely apply for Facebook apps that run inside of iframes... and I think these days that's all of them.

hiddenfeatures 14y ago

Does this affect Google Analytics (or any analytics software for that matter)? if so: How would a webmaster deal with that?

cbr 14y ago
Google Analytics javascript runs on your domain and the cookies it uses are on your domain. So it should count as "first party" here.
- hiddenfeatures 14y ago
  Interesting. Isn't the website just telling to load the script from a Google server (which could count as 3rd party) and execute it?
  - mjn 14y ago
    It's loading from a 3rd party (with a 3rd-party HTTP request), but the script itself is run by the first party: scripts are owned by whichever page executes them, regardless of how that page conjured them up. That's why you can load jquery from a CDN without breaking lots of things, because jquery still "runs from" your domain, same as if it were hosted locally. Also a reason that you really need to trust the third-party host, because if you load malicious third-party JS, it runs from your domain.
    - Nursie 14y ago
      Thanks, that's a neat little explanation and cleared a couple of things up for me :)
    - hiddenfeatures 14y ago
      thanks for the cool explanation. That really filled in a few blanks in my understanding of the web.
- baby 14y ago
  There is no creation of cookies in the snippet you have to copy/paste on your website. So if some cookies are created they are not first party.

ferongr 14y ago

Well, trackers will just switch to using localstorage instead since the preference doesn't affect it [1] and it pops up no permission dialog. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=536509 https://bugzilla.mozilla.org/show_bug.cgi?id=536509

derefr 14y ago
It really seems like all the things browsers do to allow sites to persist data on your computer (cookies, client certificates, localStorage, WebSQL/IndexedDB, the FileSystem storage API, HTML5 Application Caching...) should all be controlled by a single set of preferences/request dialogs. They wouldn't even need to break down the requests by type; it's pretty irrelevant to a user which kind of storage is going on. Combining this with a "forgiveness is better than permission" principle (which seems to be sorely lacking in web browsers, other than a few just-plain-strange places like alert() dialogs), the best UX might just be a warning bar stating "Example.com has reserved 1KB/5MB of your disk so it can remember its place. [Disallow]" Disallowing would make the site think it still has a permanent store, but internally replace it with an ephemeral one (FS::TEMPORARY, session cookie, etc.) This also might make browser makers get off their lazy butts and make ephemeral versions of the rest of these mechanisms, to make this work ;)
- ihsw 14y ago
  What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"
  - derefr 14y ago
    Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever. Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify you've given them the persistence they want before they let you through, and so forth. And even if they didn't, the request would still become one of those things naive users think you just "have to click OK to if you want the computer to keep doing the thing"--like Windows UAC elevation. On the other hand, giving users an equivalent option to a "hellban" on a website--the ability to make the website think it's persisting, but then it turns out not to be--has far fewer incentives. It only ends up being something you click for a reason, rather than a "mother may I" you have to just click all the time, and since getting off the blacklist wouldn't be exposed directly through the browser chrome, there'd be nowhere for a malicious site to "point an arrow."

zzzeek 14y ago

I'm really enjoying the self-destructing cookies addon: https://addons.mozilla.org/en-us/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/en-us/firefox/addon/self-destruct... . It's really great to go to Facebook and see it have absolutely no idea who I am every time I go there. Plugin works very well.

baby 14y ago
Never heard of this one, and it looks really good. I'll try it right now. But will it still be useful with the new Firefox updates?
- zzzeek 14y ago
  it should, it blacklists all sites by default to not persist cookies at all beyond having the window open.
- ove 14y ago
  Hi, I'm the author of this add-on. You might want to read the FAQ entry "Q: How is this different from disabling 3rd party cookies and installing Adblock?". Firefox's new 3rd party cookie policy is actually weaker than disabling them outright, so this will not change anything.
  - cpeterso 14y ago
    Back in the day, Firefox experimented with making third-party cookies session-only, but I believe this option was disabled because some websites using third-party login cookies required users to login every session. Have you run into any problem websites with self-destructing cookies?
    - ove 14y ago
      Disabling 3rd party cookies has never broken a single site for me. I've heard that some banks require them, though. As for Self-Destructing Cookies: it's a pretty drastic measure. Considering this, it's surprisingly compatible. Among the sites that I frequent, not a single one stopped working. Inter-domain transaction - e.g. a shop forwarding you to Paypal and back - used to be a problem, but the latest version has a heuristic for that. Still, I'm pretty sure that some people will experience fallout. You can work around that; SDC has numerous functions that can help in such cases (pause, undelete, whitelist for session).

Too 14y ago

Finally. Third party cookies provide almost zero value for users. Only use case is for log in on iframe-embedded apps such as Discus comment boards, but the ones you use yourself can be counted on one hand so adding exceptions isn't such a big issue. Adding some UI that shows that you are logged in to Discus on a particular web page would just good imo. I think the "From visited" option is an excellent trade off as a transition period until a better option for embedded authentication is available.

chez17 14y ago
> Third party cookies provide almost zero value for users. I don't like third party cookies either, but this is false. Your information is worth something to the right people. The websites you visit, mostly free, can make money off that information. The value to the user are free websites that provide you entertainment/content/etc... and are able to stay free because they are utilizing this as a revenue stream. We all know there are other ways, perhaps more moral ways, but to say it provides nothing to the user is false. It funds the websites you're visiting.
- troymc 14y ago
  While that's often true, many (most?) users have no idea that they're making this deal (i.e. "I let you store your cookies on my computer and in return I get free stuff."). The European "cookie law" has caused many websites to give better notice that they're planting cookies, but it's rarely clear how those cookies are being used. There is a better way. What if I purposefully signaled my intent to potential sellers, rather than having them guess what I want (based on their data about me)? Amazon wish lists are an example (although they'd be better if I stored the list in a place of my choice, where I control who sees what, and I'm told who looks). For more on this idea, see: http://en.wikipedia.org/wiki/Vendor_relationship_management http://en.wikipedia.org/wiki/Vendor_relationship_management
- belorn 14y ago
  Let ad companies and ad supported SaS do what they are good at - Targeted ads. Target people who want the ads. Give those people the services of easy access to new products, and leave people who do not click on ads alone. There is a simple answer to all this. Its called opt-in. If you need to harass and track users who do not want ads, then either the targeted ads are not targeted enough, or its a failed business model. Time to show which one it is.

Apocryphon 14y ago

When it first came out, Chrome's killer app (to me) was performance and the lack of bloat that had infected Firefox at the time. However, FF can more than redeem itself by making privacy and allowing users to easily "go off the grid" its killer app.

mortenlarsen 14y ago

I have been thinking about cookie sandboxing for a while: The idea is to have a separate cookie store for each 2nd level domain I am visiting. So the Facebook cookie on some site I am visiting that has a Facebook "Like" button on it is different from the actual Facebook cookie I would get from visiting Facebook. This would make cookie tracking across sites unusable, since each site would have it's own version of a cookie.

JonnieCache 14y ago

Sounds like a superb idea. One thing though: surely this will leak my browsing history, albeit very slowly? On balance it seems a net gain all the same.

chick 14y ago

Firefox is getting better and better now. Great!

adorton 14y ago

This is good news for sites like Facebook that track users across multiple, unrelated sites. Individual sites can still track you with third-party analytics tools by creating a CNAME (DNS alias) to a third-party tracking domain.

cromwellian 14y ago

There are lots of cases where third party cookies are used as auth tokens, not tracking tokens. Seems to me that the browser vendors should get together and come up with a better solution for browsers to store and manage auth tokens. Right now it is done piecemeal by websites, but is confusing to end users. Having a direct, first-class API and UI in the browser that can show the user exactly what third party sites they are "logged into" and have a "Logout/Deauthorize" button next to them would be worthwhile, and have less of a chance of "breaking the web", or imposing workarounds that might hurt user experience. BTW, how does Firefox treat a CORS XHR response? Does it allow a cookie to be set? Seems to be ad trackers could then just run a server that permits CORS, have a bit of JS that makes the request to opt it back in.

fpgeek 14y ago
Isn't improved browser-level authentication handling (including not letting information leak via authentication) one of the things BrowserID is about?

runamok 14y ago

So this would essentially break all conversion tracking and the like done by advertisers, right?

charlieok 14y ago

How is this going to interact with plugins that cover similar ground (e.g. DoNotTrackMe, Ghostery)?

suhail 14y ago

Curious for people that actively write way more JavaScript and deal with cookies more than I do: Outside of Local Storage, is there still a loop-hole (though it defies user expectation) for ad retargeters (they must rely on third party cookies)? I feel, if not, that this will totally kill those businesses. I am neutral and just wondering if I am missing something. Google was sued for using iframes to get around this so defying user expectation no matter the loop hole is quite dangerous.

pixelmonkey 14y ago
HTTP ETags are probably the most widely used workaround for 3rd-party cookie blocking. http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags Not sure whether the Firefox folks have figured out a way to patch this workaround up or not. I do think that retargeting businesses are in for a bit of pain given the headwinds re: third-party tracking across the US and world.

ck2 14y ago

What's great is the mobile version of firefox also can turn off third-party cookies while the Chrome mobile has no such option.

jmomo 14y ago

I have been blocking 3rd party cookies for years. The only site that has ever had a problem was my local power company (aps.com). However, it was easy to get around because even though their site warned that 3rd party cookies were required, you could just click around it to pay your electrical bill. I've never had a problem on any other sites that I use in at least five years, though I suspect it's been more than that.

Kiro 14y ago

So this will be the end of remarketing? IMO remarketing is the best thing that has happened to advertisement online. It's a win-win-win situation for visitors, advertisers and publishers.

Nursie 14y ago
A win for me is not seeing advertising, at all, ever. Targeted ads are not a win-win, they're creepy.