6 ms·

So here's something I've noticed that's confused me about Firefox's cookie handling: I have cookies turned off, but a PREF cookie for google.com keeps getting s

So here's something I've noticed that's confused me about Firefox's cookie handling: I have cookies turned off, but a PREF cookie for google.com keeps getting set. I've even tried blocking cookies from google.com, but I still see this cookie. I turned off Do Not Track but haven't tried disabling SafeBrowsing or all my extensions, so maybe it is one of those. Has anyone noticed this, too?

ewang1 12y ago
It's probably related to their Google search partnership.
- nitrogen 12y ago
  It's more likely to be a preemptive cookie set by a privacy extension.
  - deleted 12y ago
    [deleted]
- justcommenting 12y ago
  It's more likely to be associated with built-in malware protection/phishing protection from Google. In Firefox's settings under Security, you can un-check "block reported attack sites" and "block reported web forgeries" and these cookies should disappear after running BleachBit. these types of cookies may seem benign and helpful to users (and maybe they are), but i also wouldn't doubt that Google uses this information for persistent tracking. it's already been disclosed that NSA uses Google PREF cookies to track users: http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10... hence my other dispirited comment about the cookie UI... edit: reworded/clarified
  - xenophonf 12y ago
    At first I was only concerned about web page access tracking via this cookie (which indeed is set because of Safe Browsing---I turned both settings off, cleared my history, and the cookie is gone). If this cookie could be abused for location tracking, maybe it would be a good idea to leave Safe Browsing disabled.
handsomeransoms 12y ago
See https://bugzilla.mozilla.org/show_bug.cgi?id=1008706 https://bugzilla.mozilla.org/show_bug.cgi?id=1008706
mbrubeck 12y ago
See http://blog.sidstamm.com/2012/02/malware-and-phishing-protection-in.html http://blog.sidstamm.com/2012/02/malware-and-phishing-protec... and http://bugzil.la/368255 http://bugzil.la/368255 Google's Safe Browsing API (malware and phishing protection) requires a cookie. But Firefox puts that cookie in a separate bucket than the one used for regular requests. If you have cookies enabled, you'll actually end up with two separate google.com "PREF" cookies - one for regular HTTP requests, and one just for for updating the Safe Browsing lists. Disabling Safe Browsing will prevent that cookie from every being sent, and should allow you to delete it (EDIT: modulo the cookie manager bug below). UPDATE: It looks like http://bugzil.la/1026538 http://bugzil.la/1026538 is why the cookie keeps reappearing.
- xenophonf 12y ago
  Got it, thanks. I've disabled Safe Browsing and the cookie is gone. I'm curious: Does the Safe Browsing API offer any privacy guarantees? I confess that I don't really know how it works, although based on how it works with ClamAV, I assumed that Firefox periodically downloaded something from Google that let Firefox check a given URL against a list of known-bad hashes. If that's the case, I wouldn't mind leaving Safe Browsing enabled.
  - mbrubeck 12y ago
    > I assumed that Firefox periodically downloaded something from Google that let Firefox check a given URL against a list of known-bad hashes. Yes, that's basically how it works. Firefox periodically downloads a database of blocked URLs. Before loading a web page, it checks this database. If the check is negative then Firefox displays the page normally. If the check is positive, Firefox will also send a hashed URL to the Safe Browsing server to double-check whether to block the page or not. This page has more documentation, including a link to the API specification: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
spacefight 12y ago
Haven't verified your claim but according to the linked bug, one has to wonder, what the Mozilla folks have not understand what "no cookies" and DNT means. Oh, and Google should _really_ provide their Safebrowsing API without a cookie, too. Youtube-nocookie.com works fine too....
- cjg_ 12y ago
  DNT only has the effect that the browser sets the Do Not Track header on each request, basically begging the server to not track the user.

ewang1 12y ago

It's probably related to their Google search partnership.

nitrogen 12y ago
It's more likely to be a preemptive cookie set by a privacy extension.
- deleted 12y ago
  [deleted]
justcommenting 12y ago
It's more likely to be associated with built-in malware protection/phishing protection from Google. In Firefox's settings under Security, you can un-check "block reported attack sites" and "block reported web forgeries" and these cookies should disappear after running BleachBit. these types of cookies may seem benign and helpful to users (and maybe they are), but i also wouldn't doubt that Google uses this information for persistent tracking. it's already been disclosed that NSA uses Google PREF cookies to track users: http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10... hence my other dispirited comment about the cookie UI... edit: reworded/clarified
- xenophonf 12y ago
  At first I was only concerned about web page access tracking via this cookie (which indeed is set because of Safe Browsing---I turned both settings off, cleared my history, and the cookie is gone). If this cookie could be abused for location tracking, maybe it would be a good idea to leave Safe Browsing disabled.

handsomeransoms 12y ago

See https://bugzilla.mozilla.org/show_bug.cgi?id=1008706 https://bugzilla.mozilla.org/show_bug.cgi?id=1008706

mbrubeck 12y ago

See http://blog.sidstamm.com/2012/02/malware-and-phishing-protection-in.html http://blog.sidstamm.com/2012/02/malware-and-phishing-protec... and http://bugzil.la/368255 http://bugzil.la/368255 Google's Safe Browsing API (malware and phishing protection) requires a cookie. But Firefox puts that cookie in a separate bucket than the one used for regular requests. If you have cookies enabled, you'll actually end up with two separate google.com "PREF" cookies - one for regular HTTP requests, and one just for for updating the Safe Browsing lists. Disabling Safe Browsing will prevent that cookie from every being sent, and should allow you to delete it (EDIT: modulo the cookie manager bug below). UPDATE: It looks like http://bugzil.la/1026538 http://bugzil.la/1026538 is why the cookie keeps reappearing.

xenophonf 12y ago
Got it, thanks. I've disabled Safe Browsing and the cookie is gone. I'm curious: Does the Safe Browsing API offer any privacy guarantees? I confess that I don't really know how it works, although based on how it works with ClamAV, I assumed that Firefox periodically downloaded something from Google that let Firefox check a given URL against a list of known-bad hashes. If that's the case, I wouldn't mind leaving Safe Browsing enabled.
- mbrubeck 12y ago
  > I assumed that Firefox periodically downloaded something from Google that let Firefox check a given URL against a list of known-bad hashes. Yes, that's basically how it works. Firefox periodically downloads a database of blocked URLs. Before loading a web page, it checks this database. If the check is negative then Firefox displays the page normally. If the check is positive, Firefox will also send a hashed URL to the Safe Browsing server to double-check whether to block the page or not. This page has more documentation, including a link to the API specification: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...

spacefight 12y ago

Haven't verified your claim but according to the linked bug, one has to wonder, what the Mozilla folks have not understand what "no cookies" and DNT means. Oh, and Google should _really_ provide their Safebrowsing API without a cookie, too. Youtube-nocookie.com works fine too....

cjg_ 12y ago
DNT only has the effect that the browser sets the Do Not Track header on each request, basically begging the server to not track the user.