So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.
Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.
But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.
Same, they’re an absolute game changer for me. I have to use multiple different identities in work due to separate active directories and container tabs makes it super easy
Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.
They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)
This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.
No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.
But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.
With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.
Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.
From my experience, blocking 3rd party cookies in general doesn’t seem to make any difference for site functionality anyways. Though I never log into sites with a Google or FB account other than Google or FB sites (and rarely at all for the latter).
Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.
Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.
Thank you for your explanation, tbat greatly clears up my confusion.
TBH, if a person’s concern is being tracked by, for example, Facebook; then this just lets Facebook continue tracking them without directly allowing Facebook’s anaylitics customers to track them to another site directly (but indirectly that information can still be provided). But I guess for all the people giving FB and Google those proviledges better to have this than not.
Very good! Please remove anonym/PPA, DoH to cloudflare, Google search, telemetry, and pocket next, and I’ll make a consideration to stop calling your browser malware!
Sure, but the separate window can be on a different domain. Now you have a way to share cookies across multiple websites on different domains if all of them include an iframe to this external domain. And you can use in-browser messages (see window.postMessage()) to communicate between iframes and main window.
I haven’t worked with HTML since 1999; I hate that I’m just now finding out that iframes are somehow still a thing in the modern world. What the actual fuck. Why? Don’t we have some fancy HTML5 or Ajax or something that can replace them?
HTML5 can store HTML files inside of HTML files, allowing you to do what an iframe does but with a static (or updated when the page refreshes or whatever) html page
AJAX also has something that can replace iframes
But iframes continue to exist likely for legacy and how easy it is to get a basic page running using them for home projects
Yeah i don’t know why, probably exactly because is such a neglected feature that it offers workarounds for some limitations, like in the case of cookie-related patterns.
A little. If a third party cookie is set while you’re visiting a site, only that site will get the third party cookie back. Multiple sites can have embedded content making third party cookies, and with this change firefox will track where it was made and only give it back there.
With this change, it doesn’t matter if it’s first or third or whatever; cookies will only be given back to a site that matches much of what is in your location bar.
Is this the reason why I have to “confirm it’s you” every time I sign into a Google service now? I appreciate the fact that Firefox’s protection is so good that Google doesn’t recognize my PC anymore, but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube.
This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.
This wouldn’t make you have to log in every time you watch YouTube. It means by signing in to google.com, youtube.com can’t tell that you’re signed in. If you sign in on youtube.com, you’ll stay signed in on youtube.com unless you have something else deleting your cookies.
Well have had my cookies set to delete every time I close the browser for several years now but FF only now started doing this verification thing. A week ago all I had to do was enter my email and password.
If you’re already deleting all your cookies every time you close, then this new change should be identical to your first login of the day when your browser has no cookies. If you’re only getting 2fa requests after this change, then maybe you weren’t actually deleting every cookie, and Google was still fingerprinting you somehow.
It was updated today. 2 years ago it was just an announcement of a beta function in private browsing, the full rollout happened with 129.0.2 which was released a few days back.
I don’t think it was in the article, but I updated to 192.0.2 yesterday and checked the enhanced tracking protection settings, and block cross-site cookies is now in the default profile, so that was my assumption since it wasn’t there previously.
I actually had a problem where on Chrome, I would be signed out of my google account every time I restart my computer, while on Firefox, everything works normally. I use Firefox now lol.
It was - in the ancient times. Then, there were 3rd party cookies which you had to manually approve upon the initial creation. And then it went all down south and got abused via CDNs and ad networks.
Forgive me if this is an overly simplistic view but if the ads with cookies are all served on Google’s platform say then would all those ads have access to the Google cookie jar?
If they don’t now then you can bet they are working on just that.
The way I’m reading it, they allow the third party cookies to be used within the actual site you’re on for analytics, but prevent them from being accessed by that third party on other sites.
But I just looked at the linked article’s explanation, and not a technical deep dive.
I can’t entirely tell if that means they will be put in the facebook cookie jar or if it will be put in the TentaclePorn Dot Org (don’t go there, it is probably a real site and probably horrifying) cookie jar. If the former? Then only facebook themselves have that which… is still a lot better I guess? If the latter then that is basically exactly what we all want but a lot of sites are gonna break (par for the course with Firefox but…).
The cookie would go to the Facebook or tentacleporn cookie jar depending on which site the user has actually visited. Whatever the domain in the address bar says.
They are usually separate things. Cookies are produced/saved locally, to be read in the next visit (by the same website or maany websites basically forever unless you use firefox containers or at least clear them once in a while). There’s also local storage which is different but can also be used to identify you across the web. Ads, trackers, all of these categories are often made of many small components: you read a single article on a “modern” newspaper website, hundreds of connection are being made, different tiny scripts or icons or images are being downloaded (usually from different subdomains for different purposes but there’s no hard rule). It’s possible to block one thing and not another. For example I can block Google Analytics (googletagmanager) which is a tracker, but accept all of Google’s cookies.
So that’s what third party cookies are. What this does is make it so that when you go to example.com and you get a Google cookie, that cookie is only associated with example.com, and your random.org Google cookie will be specific to that site.
A site will be able to use Google to track how you use their site, which is a fine and valid thing, but they or Google don’t get to see how you use a different site. (Google doesn’t actually share specifics, but they can see stuff like “behavior on one site led to sale on the other”)
blog.mozilla.org
Active