Firefox rolls out Total Cookie Protection by default to more users

https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/

by elashri • 3 years ago

217 92 3 years ago

blog.mozilla.org

choeger• 3 years ago

In what sense is TCP tomorrow different from disallowing 3rd party cookies today?

On a side note: Isn't it odd, how the composition of different technologies (here HTTP and DNS) make it unintuitively complex to implement a so intuitively natural policy as "every website gets to read only its own cookies"?

red_trumpet3• 3 years ago

every website gets to read only its own cookies

That's already the case, isn't it? It's just that embedded parts by a 3rd party can set their own cookies, which can be read by the 3rd party whenever it is embedded in any other page.

aidenn0• 3 years ago

It's not already the case, but it is expected to be the case in all major browsers sometime next-year[1]

1: https://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie

taeric• 3 years ago

Of course... knowing that this is all by well behaving browsers is a bit of a troubling point. Such that I find it equally odd that we have placed so much power and general trust into software that we keep expanding the capabilities of. It is a small step to "managed devices" that we don't even trust users to keep up to date being required for access.

arthuredelstein2• 3 years ago

Total Cookie Protection partitions all cookie-like data ("state") between the websites you visit, not just cookies. For a technical discussion, see https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...

You can see which browsers partition state (and which don't) in the State Partitioning section of https://privacytests.org. Firefox passes nearly all of those tests because Total Cookie Protection is enabled by default.

olliej5• 3 years ago

I have a problem with them including the "GPC" flag as a privacy feature. We know directly from "Do Not Track" that it was widely ignored, and frequently actually used to perform tracking because it was meant to be opt in, and so was rare. When it got turned on by default a bunch of companies said "DNT is not a user choice now so doesn't mean anything".

I'm not sure what document.referrer blocking is meant to accomplish - if the intent is for the referrer to pass information to the loaded site then they can just include that in the url. If the intent is "don't let people know where you saw the link", then sadly there are plenty of sites that gate access on the referrer and they get broken. The fact that no one is filtering that kind of indicates the cost/reward balance.

Calling "media queries" a privacy issue is absurd: literally the purpose of these is to allow sites to tailor to the view format. More over you can directly measure these from JS, it's just less efficient and more annoying.

The "known tracker" blocking is more curious as I'm unsure how that's expected to scale, nor what happens if a browser ever misclassifies one (be it a resource or a query parameter). Certainly query strings can be trivially changed to make anything a major browser does just break instantly, and similarly trivially changed to not be statically identifiable.

I also wonder how those are tested because browsers that do automatic "learned" identification of trackers do take time to identify what they consider trackers and start blocking them. e.g. that site says google analytics is not blocked by safari, yet I can look at Safari's tracker stats and see that it has identified and is blocking google analytics.

tinus_hn• 3 years ago

I’m impressed because as far as I could tell Safari is equal or better than Firefox on all of these tests.

renewiltord2• 3 years ago

It appears 3rd party cookies will still be placed but they will be partitioned by 1st party domain. That's interesting.

xg15• 3 years ago

every website gets to read only its own cookies

My understanding is, it's a simplified explanation for a somewhat more complex policy.

The obvious thing - every site gets its own cookies - has always been the case: Those are first-party cookies.

The question is what happens when one site embeds content from a different site. Traditionally, there was no special behaviour for that case: If site A embeds an iframe from site B, the top-level document gets to see the cookies for A while the embedded document gets to see the cookies for site B. B's cookies here are 3rd-party cookies.

The problem is that the two documents can communicate, so if site B is embedded into many other sites, B and the other sites can cooperate to track the user across them using B's cookies as a sort of shared identifier. (Or more commonly, B will do the tracking and pay/otherwise incentivise the other sites to embed itself and pass the necessary information to the embedded document)

To avoid this, TCP introduces another level of partitioning: Cookies are not just partitioned by which site has access to it but also by the top-level site.

So site B now doesn't get a single cookie jar as before, it will get several jars "B, embedded by A", "B embedded by C", "B top-level" etc with separate sets of cookies. Hence it becomes impossible to pass a common identifier from one top-level site to another one and (this particular way of) cross-site tracking won't work anymore.

kevin_thibedeau• 3 years ago

allowing those [third party] cookies to fulfill their less invasive use cases (e.g. to provide accurate analytics

Separate cookie jars don't prevent data brokers from correlating cookies from a common IP + user agent pair. The only solution is to block third parties altogether.

seizethegdgap• 3 years ago

Obviously doesn't help when using an app, but what about an extension that changes your user agent every single time you send a request to a website? Does such an extension even work, or exist?

Nextgrid• 3 years ago

Even if it did, it will be useless because fingerprinting (of various kinds - whether TCP or TLS stack, doesn't even have to be JS-based) will still tell which browser you're running on.

Worse, it may actually make you more identifiable because a Chrome on Linux user agent with the TCP fingerprint of Windows and TLS fingerprint of Firefox is going to stick out like a sore thumb, even more than a rare-but-at-least-consistent fingerprint with no trickery.

the_pwner2243• 3 years ago

The long term workaround for data brokers is to become a first party... have the main website serve your 3rd party JS from their own server under their own domain. That makes it much harder to block.

For your IP+UA hypothetical, the easy fix is to make everyone look the same. IP should be the only personally identifiable factor. Tor and desktop Firefox w/ privacy.resistFingerprinting turned on both do this. Open window not-maximized at 1000x1000 size, use the same UA regardless of what platform & browser version you're actually on, and a bunch of other stuff. That said, I don't know how effective it actually is against modern comprehensive fingerprinting libraries.

OkayPhysicist3• 3 years ago

User-Agent strings are now net-negative in the web world. Their uses are slim, and their abuses are plentiful. They should probably be removed altogether, but in the meantime non-Chrome browsers should universally adopt Chrome's UA.

MrRadar• 3 years ago

User-Agent strings are still useful for identifying non-browser user agents but I agree that given the privacy issues they present all browsers should adopt a single standard UA string (one each for desktop and mobile). (Did you know that Chrome on Android puts your device model in the UA string? One of the many reasons to use Firefox for Android...)

clumsysmurf• 3 years ago

A couple of days ago there was a story on HN about fingerprinting

https://news.ycombinator.com/item?id=35243355

The take-away I got from this article is that, companies found a way to uniquely identify you anyhow, without cookies.

Is this too little too late?

focusedone• 3 years ago

Firefox user but relatively ignorant on how tracking works.

FF does some good things to work around fingerprinting, although simply using FF puts us in a pretty small (marketable) group in the first place.

OkayPhysicist3• 3 years ago

Frankly, Firefox should take the nuclear option, and just start emulating Chrome with regard to website identifiable information.

In particular, User-Agent strings are now a net-negative. I've never run into a website that doesn't work on Firefox. I do occasionally run into websites that claim to not work on Firefox. We software developers have shown that we can't be trusted with information pertaining to what browser someone is using, and as such should have the privilege taken away. If you're reading this, and you have access to a codebase that reads User-Agent strings for anything more than idle curiosity, just delete it and push to master.

teh_boulder• 3 years ago

The same article mentions that you can prevent fingerprinting in Firefox with privacy.resistFingerprinting = true

https://www.bitestring.com/posts/2023-03-19-web-fingerprinti...

But you are right, it's likely that there are other ways other than cookies and fingerprinting that companies can track you.

jszymborski• 3 years ago

Resist is a better word than prevent here.

Also, there are some major drawbacks, like your browser setting UTC as the default timezone. That one has caused some mix ups when filling out Doodles.

red_trumpet3• 3 years ago

t's likely that there are other ways other than cookies and fingerprinting that companies can track you.

Any idea how they would do that?

thebrain• 3 years ago

I tried enabling this recently and I immediately noticed that websites started appearing in light mode instead of copying my system settings and displaying in dark mode. It seems like in it's efforts to make my fingerprint the same as everyone else's Firefox stops telling websites about my display settings. The issue immediately went away when I changed the setting back to privacy.resistFingerprinting = false.

rascul• 3 years ago

Enabling this did weird things to web sites. But it didn't seem to help. Before I enabled it, according to https://amiunique.org I was unique among the 1646592 fingerprints in their entire dataset. After enabling it, I was unique among the 1646593 fingerprints in their entire dataset.

Riverheart• 3 years ago

Yes. Cookieless tracking is a thing.

brutusurp• 3 years ago

Brave has had this "new feature" as a default setting (i.e., block cross-site cookies). Glad Firefox has finally implemented a basic privacy feature such as this, though like you mention perhaps it's a little late.

As far as fingerprinting issue, Brave again does a better job than most, again as a default:

"If you need to use Chromium, then Brave browser is a good choice. It also randomizes fingerprint for each session, making it harder to link your browsing sessions."[1]

[1]https://www.bitestring.com/posts/2023-03-19-web-fingerprinti...

Makes me wonder how much of this is real improvement vs. publicity.

Animats2• 3 years ago

Are they blocking Google Tag Manager?

flangola7• 3 years ago

What does tag manager even do?

cj• 3 years ago

1) Developer installs Google Tag Manager at the request of someone in marketing

2) Marketing department has free reign (via Google Tag Manager) to add arbitrary javascript on any page with Google Tag Manager installed. Namely tracking scripts, adwords conversions, retargeting pixels, or really any arbitrary javascript without limitation.

Edit: Google Tag Manager can also be used to inject scripts that aren't inherently bad, like a 3rd party support/chat widget (Zendesk, Intercom, etc)

arealaccount• 3 years ago

Its basically a tool that lets you manage all of the js tracking scripts (tags) that advertisers, affiliates, etc have you paste into a website.

So instead of having a million js snippets on your page, you have one google tag manager snippet and then your marketing team can inject 400mb of javascript into the site without bothering dev.

the_pwner2243• 3 years ago

Has Chrome already been doing this for a while? (I'm not sure, but I think I've heard that it has).

Disclaimer: I'm a FF user, not trying to say FF is bad, I just want to know how much of this is actually new cutting edge privacy protection vs. marketing fluff.

privacyonsec• 3 years ago

no but brave browser does

the_pwner2243• 3 years ago

Thanks.

billiam• 3 years ago

This is nice to see, but it worth pointing out that it is years overdue. Mozilla dragged its feet for years about Tracking Protection and cookies in general, coming up with halfway measures while continuing to serve the needs of advertisers that had a lot of influence on the company. The end state of Total Cookie Protection was clear from the beginning. It is of course not easy to change the advertising based model, but it's not like Firefox is really more than an influencer of Google and Apple, its market share has all but disappeared. No, the motivation to take seven years to get to TCP was all about money, including big salaries and bonuses for Mozilla executives.

Tagbert• 3 years ago

So when did Chrome start doing this?

dandongus• 3 years ago

Why is there any concept of "some users worldwide" with respect to default cookie settings in a browser application?

wnevets• 3 years ago

to avoid breaking changes for every single user?

xuhu• 3 years ago

Will bitbucket.org sending me to oauth.atlassian.com fail with Total Cookie Protection enabled ?

Will someonlineshop.com redirecting me to payments.mybank.com fail with Total Cookie Protection enabled because the payments site uses cookies to store the return url for the online shop ?

dizhn• 3 years ago

I believe they maintain a whitelist for the big guys.

Spivak2• 3 years ago

With oauth probably not since the state doesn't transfer with cookies. You send the user to the IdP with a postback in the URL then when the user logs it it sends them back to the original site with some data that depends on the flow you chose.

Your login cookie as far as the IdP is concerned lives on oauth.thirdparty.net and on a successful login the app issues you your own session token that lives on myapp.com.

_V_• 3 years ago

I don't want to be a killjoy here. Don't get me wrong, this is certainly a good thing but to me it seems like most major trackers are moving/has already moved to things like canvas fingerprinting, WebAssembly fingerprinting etc.

This seems to be like a typical cat-and-mouse game. And browsers will not get more privacy friendly as long as there will be a trend that moves applications and basically every aspect of our lives into the browser thus making it unbelieveably complex.

I suspect that we will soon have to choose to either live as a "digital hermit" (links/neomutt and other lightweight apps that do only the one thing) or give up and join everyone with Youtube/Facebook/Twitter.

zx8080• 3 years ago

to me it seems like most major trackers are moving/has already moved to things like canvas fingerprinting, WebAssembly fingerprinting etc.

Also the upcoming WebGPU enabling by default in chrome will probably make it very simple to fingerprint almost anyone.

WeylandYutani• 3 years ago

I'm blocking pretty much all website advertising. I'm sure I'm being tracked but I can't see their personalised ads so whatever. Out of sight out of mind.

stereoradonc• 3 years ago

Firefox does everything about privacy that Vivaldi should do (and more).

Firefox rolls out Total Cookie Protection by default to more users

Related Stories