Get fucked, advertisers.
Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.
Don’t all the advanced ways rely on JavaScript?
Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.
“Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.
Why not just use ublock medium mode?
Roughly similar to using Adblock Plus with many filter lists + NoScript with 1st-party scripts/frames automatically trusted. Unlike NoScript however, you can easily point-and-click to block/allow scripts on a per-site basis.
https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode
Am I in the wild? I use it.
I like the grid add-on for Firefox. It disables 3rd party pretty much anything by default. And you can control cookies separately from everything else, and I can’t remember any time I’ve needed to enable those cookies to get a site working properly (whereas sometimes you need to enable scripting, media, or iframe for cdn or something).
uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.
They might be fingerprinting me using these two extensions though.
I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.
Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.
The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.
WebGL
I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
Librewolf has Resist Fingerprinting which comes pretty far.
Every Librewolf browser uses the same windows user agent, etc. But there are downsides, like time zones don’t work, and sites don’t use dark mode by default.
And even then, EFF’s Cover Your Tracks site can still uniquely identify me, mainly through window size. That’s one of the reasons why Tor Browser uses letterboxing to make the window size consistent.
Librewolf supports letterboxing as well, though the setting might be disabled by default
Oh neat! I just tried it, and it seems it’s broken on Gnome when using 125% scaling though :/ Still cool to have the feature!
I also just figured out how to expose dark mode and my timezone though with RFP, which is useful.
I don’t know what letterboxing is. But if window size is used to identify me, can’t it be circumvented simply by using the window in restored size, and not maximised?
Your restored window size is even more unique than your maximised window size!
The correct solution is to just not make the window size available to JS or to remotes at all. There’s no reason to ever need specifics on window size other than CSS media-queries, and those can be done via profiles.
But the restored size keeps changing - can’t be profiled, right?
And how do I not make the size available “to JS or to remote”?
Changing the source code of the browser, unfortunately. I don’t know what Tor Browser does or how, but basically you’d have to do about the same as they do.
EU outlaws it
The EU isn’t the only place on the planet, even if its laws have an impact.
Yeah, you need uMatrix. although it can be tricky to use.
There is still plenty of fish for advertisers, sadly.
For those who don’t care to read the full article:
This basically just confines any cookies generated on a page, to just that page.
So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.
Hahahahaha so it doesn’t break anything that still relies on cookies, but neuters the ability to share them.
That’s awesome
Honestly, I thought that’s how it already worked.
Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.
But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.
Someone correct me if I got it wrong.
Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.
They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)
This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.
That’s not what I was thinking of, which was even more fundamental. But that’s good info (and another way to cover stuff in the article).
Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren’t allowed at all. Which was really dumb since of course they are.
No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.
But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.
With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.
Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.
They’ve been doing this with container tabs, so this must be the successor to that idea (I’m going to assume they’ll still have container tabs).
Container tabs are still a thing in FF. This is based on that work, if I remember correctly.
I love container tabs. It’s one of the reasons I went back to FF.
Same, they’re an absolute game changer for me. I have to use multiple different identities in work due to separate active directories and container tabs makes it super easy
Container tabs are still useful, as they let you use multiple Cookie jars for the same site. So, it is very easy to have multiple accounts on s site.
Unless that cookie was somehow important for you to use both sites, but thats incredibly rare.
From my experience, blocking 3rd party cookies in general doesn’t seem to make any difference for site functionality anyways. Though I never log into sites with a Google or FB account other than Google or FB sites (and rarely at all for the latter).
I would love to see an icon of a neutered cookie please 🥺😄.
Basically creates a fake VM like environment for each site.
For those who don’t care to read the full article
Or even the whole title, really
Isn’t this basically Firefox’s version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?
I mean, it’s good news either way but I just want to know if this is somehow different or better.
Sites are much more contained now. Is much more like a profile per site.
I don’t know why this wasn’t the case long ago.
It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$
Disabling cross site cookie is already a thing for decades…
Same with Do Not Track requests.
Do Not Track has never really done anything, it just asks websites politely to not track you. There’s no legal or technical limitation here.
I still much rather have it than not. It also lead to the spiritual successor GPC which does actually have regulatory requirements under the CCPA.
Fair. However, it also provides websites with additional information to fingerprint you, so that’s a thing too.
Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.
Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.
Thank you for your explanation, tbat greatly clears up my confusion.
TBH, if a person’s concern is being tracked by, for example, Facebook; then this just lets Facebook continue tracking them without directly allowing Facebook’s anaylitics customers to track them to another site directly (but indirectly that information can still be provided). But I guess for all the people giving FB and Google those proviledges better to have this than not.
I think this tips it over the edge for me to switch to Firefox
Really? This is what does it for you?
Ur… Yeah?
I prefer waterfox. Hard to trust Mozilla Corpos.
As long as it’s not Chromium, I’m happy people aren’t just handing over the keys to the Internet to Google.
Yeah, Waterfox is just another browser built on top of the Mozilla’s GECKO engine. But without all the AI dickriding.
How terrible to offer client-side translation or webpage description for differently abled people!
Client side incorrect translations*
How incorrect is it?
Sentences are a lot like math problems. An incorrect part changes the entire outcome.
I haven’t seen anything to signal Mozilla is untrustworthy other than from that one right wing guy with a chip on his shoulder.
Most of the revenue of Mozilla Corporation comes from Google (81% in 2022[2]) in exchange of making it the default search engine in Firefox.
Source: wikipedia
Other issues I have with Firefox is the telemetry bits, the way they handle some of their employees (laying one guy off because he has cancer), the lack of meaningful updates and features in the last decade, CEO granting herself a nice pay rise after doing well nothing really. The list goes on and on honestly.
Don’t get me wrong, you should still use Firefox or a Firefox derived browser if you care about a free internet. I myself use firefox (although I just switched to Zen browser on my PC which is based on Firefox). However we shouldn’t be blind ourselves just because we hate anything google based and/or closed sourced. Firefox is still back by a for profit company which is, as I quoted earlier, backed at least by 80% by google.
For the positive side now it seems that in the last 2-3 months firefox has been pumping out meaningful updates (even on mobile). Things seem to be taking a positive turn recently and I’m actually a bit excited to see where firefox is going to go from here.
The Mozilla Corporation is a for profit entity owned by the non-profit Mozilla Foundation, which lets them claim to be a nonprofit, which is a sketchy looking way to set up and promote your business if nothing else. They get most of their money from Google and they’ve been riding AI like all the other unethical companies.
I see absolutely no reason to give them a chance, either. Just use an actual open source build instead of the mainstream one.
Yup. Nobody else gets those cookies.
Does this make containers unnecessary? Or basically built in?
A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can’t see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.
This keeps cookies locked to each page that needs cookies. So a lot stronger.
So what you’re saying is, each site gets its own container?
I think there’s some confusion here. You’re talking about Multi-Account Containers, that person was talking about the Facebook Container. Both Firefox features with confusingly similar names, and honestly that’s on Firefox for naming them.
Facebook Container is similar to this TCP feature, but focused on Facebook. And of course it was a separate extension, so very opt-in. Now, Firefox has rolled it out for ALL sites by default, which is awesome and SHOULD HAVE BEEN HOW COOKIES WORKED IN THE FIRST PLACE!
Isn’t there just a non-extension container feature, I can’t tell what’s the difference between that one and multi-account containers.
Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis
It is making the tracking protection part of containers obsolete, this is basically that functionality but built in and default. The containers still let you have multiple cookie jars for the same site, so they are still useful if you have multiple accounts on a site.
FREEEDOOOOOOOOOOOM
Good to see Firefox still has value to provide
Firefox is awesome.
Is this different from blocking 3rd party cookies?
A little. If a third party cookie is set while you’re visiting a site, only that site will get the third party cookie back. Multiple sites can have embedded content making third party cookies, and with this change firefox will track where it was made and only give it back there.
With this change, it doesn’t matter if it’s first or third or whatever; cookies will only be given back to a site that matches much of what is in your location bar.
Mozilla completes what Google was too afraid to finish.
Is this the reason why I have to “confirm it’s you” every time I sign into a Google service now? I appreciate the fact that Firefox’s protection is so good that Google doesn’t recognize my PC anymore, but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube.
This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.
No. That’s just Google trying to pester you into using Chrome.
I actually had a problem where on Chrome, I would be signed out of my google account every time I restart my computer, while on Firefox, everything works normally. I use Firefox now lol.
This wouldn’t make you have to log in every time you watch YouTube. It means by signing in to google.com, youtube.com can’t tell that you’re signed in. If you sign in on youtube.com, you’ll stay signed in on youtube.com unless you have something else deleting your cookies.
Well have had my cookies set to delete every time I close the browser for several years now but FF only now started doing this verification thing. A week ago all I had to do was enter my email and password.
If you’re already deleting all your cookies every time you close, then this new change should be identical to your first login of the day when your browser has no cookies. If you’re only getting 2fa requests after this change, then maybe you weren’t actually deleting every cookie, and Google was still fingerprinting you somehow.
You may want to just use tab containers for youtube, so that it maintains your session, but also isolates it.
Best way to use such (para)sites.
Article from JUNE 14, 2022
updated August 28th
This is old news, from 2022!!
From the blog post:
“June 14, 2022”
“Updated Aug. 28, 2024”
“And starting in 2024, all our users can look forward to Firefox blocking even more third party cookies.”
ah yes, the other TCP
Maybe they should patent it, to protect their TCP IP.
Or have some higher tier version called Ultimate Cookie Protection {UDP)
Wouldn’t that be Ultimate Dookie Protection?
danvit, yes
Id prefer a security security oriented Secure Cookie Total Protection (SCTP)
LOL
Tasty Consensual Photos
I wonder how long until all the distros have this.
Starting in what versions?
I’m curious how this will affect OAuth (if at all). Does it use an offsite cookie to remember the session, or is that only created after it redirects back to the site that initiated the login?
I was also wondering that
I my experience it generally breaks it. Leveraging cookies on the auth domain is fine, but once you are redirected to another domain, that application needs to take the access and refresh tokens and manage reauthentication as a background process. Simply don’t store those things as cookies though.
Yeah that’s kind of what I was getting at. It’s been a while since I’ve worked with it so I couldn’t remember if it used cookies for the token exchange or some other mechanism.