So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.
Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.
But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.
Same, they’re an absolute game changer for me. I have to use multiple different identities in work due to separate active directories and container tabs makes it super easy
Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.
They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)
This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.
No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.
But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.
With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.
Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.
From my experience, blocking 3rd party cookies in general doesn’t seem to make any difference for site functionality anyways. Though I never log into sites with a Google or FB account other than Google or FB sites (and rarely at all for the latter).
Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.
Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.
Thank you for your explanation, tbat greatly clears up my confusion.
TBH, if a person’s concern is being tracked by, for example, Facebook; then this just lets Facebook continue tracking them without directly allowing Facebook’s anaylitics customers to track them to another site directly (but indirectly that information can still be provided). But I guess for all the people giving FB and Google those proviledges better to have this than not.
Forgive me if this is an overly simplistic view but if the ads with cookies are all served on Google’s platform say then would all those ads have access to the Google cookie jar?
If they don’t now then you can bet they are working on just that.
The way I’m reading it, they allow the third party cookies to be used within the actual site you’re on for analytics, but prevent them from being accessed by that third party on other sites.
But I just looked at the linked article’s explanation, and not a technical deep dive.
I can’t entirely tell if that means they will be put in the facebook cookie jar or if it will be put in the TentaclePorn Dot Org (don’t go there, it is probably a real site and probably horrifying) cookie jar. If the former? Then only facebook themselves have that which… is still a lot better I guess? If the latter then that is basically exactly what we all want but a lot of sites are gonna break (par for the course with Firefox but…).
The cookie would go to the Facebook or tentacleporn cookie jar depending on which site the user has actually visited. Whatever the domain in the address bar says.
They are usually separate things. Cookies are produced/saved locally, to be read in the next visit (by the same website or maany websites basically forever unless you use firefox containers or at least clear them once in a while). There’s also local storage which is different but can also be used to identify you across the web. Ads, trackers, all of these categories are often made of many small components: you read a single article on a “modern” newspaper website, hundreds of connection are being made, different tiny scripts or icons or images are being downloaded (usually from different subdomains for different purposes but there’s no hard rule). It’s possible to block one thing and not another. For example I can block Google Analytics (googletagmanager) which is a tracker, but accept all of Google’s cookies.
So that’s what third party cookies are. What this does is make it so that when you go to example.com and you get a Google cookie, that cookie is only associated with example.com, and your random.org Google cookie will be specific to that site.
A site will be able to use Google to track how you use their site, which is a fine and valid thing, but they or Google don’t get to see how you use a different site. (Google doesn’t actually share specifics, but they can see stuff like “behavior on one site led to sale on the other”)
Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.
Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.
“Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.
Roughly similar to using Adblock Plus with many filter lists + NoScript with 1st-party scripts/frames automatically trusted. Unlike NoScript however, you can easily point-and-click to block/allow scripts on a per-site basis.
I like the grid add-on for Firefox. It disables 3rd party pretty much anything by default. And you can control cookies separately from everything else, and I can’t remember any time I’ve needed to enable those cookies to get a site working properly (whereas sometimes you need to enable scripting, media, or iframe for cdn or something).
I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.
uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.
They might be fingerprinting me using these two extensions though.
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.
Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.
The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.
I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.
The big one was security (or lack thereof) as attackers would abuse plug-ins through NPAPI. I remember a time when every month had new 0-days exploiting a vulnerability in Flash.
The second one in my opinion, is the desire to standardize features in the browser. For example, reading DRM-protected content required Silverlight, which wasn’t supported on Linux. Most interactive games and some websites required Flash which had terrible performance issues. So it felt natural to provide these features directly in the browser without lock-in.
Which leads to your second question: I don’t think we will ever see the return to NPAPI or something similar. The browser ecosystem is vibrant and the W3C is keen to standardize newly needed features. The first example that comes to mind is WebAuthn: it has been integrated directly in the browsers when 10 years ago it would have been supported through NPAPI.
This is almost ten years old, and NPAPI plugins have been desupported by pretty much everything except Pale Moon, which forked from Firefox so long ago that it also still supports XUL.
If I remember correctly, the issue was they were moving to sandboxing and NPAPI plugins had a lot of issues with security at the time. There was a new flash vulnerability almost every week, and usually it meant getting a lot of control over the browser.
i kind of miss it, because there was an tribute game called aot tribute game it was very fun, i used to play it alot back in 2015, and i remember it only ran on firefox after chrome booted out NPAPI
AI as in machine learning? No I dont think that’s bad. It’s a very useful technology that we’ve already been using for decades in a bunch of different fields. But I’m assuming you’re referring to LLMs which are what’s being integrated into Firefox.
I would argue that LLMs ARE bad. For multiple reasons. At least the big ones run by these giant tech companies.
If you’re locally running one with training data provided by you then I don’t see an issue with that really. (except maybe energy consumption issues. Though I don’t imagine a personal use LLM run locally would draw anywhere near the energy that something like Chat Gpt is drawing.)
I’m very much on the side that believes that what these LLM models do essentially boils down to theft/plagiarism though. So if you disagree with that you may disagree that LLMs are bad.
I did. I’m not needing to switch. At least not right now. (hence the ‘may’ in my original comment) But given the Laura Chambers interim CEO thing and now this LLM integration. Mozilla seems to be making moves that I don’t agree with. But as long as they stay true to their key tennents I won’t need to switch. Which would be good. Because I really don’t want to. But I’ve seen a enough good companies become bad companies that I’m weary for the future of the app. So being aware of what alternatives may be out there would be helpful.
I highly recommend everyone making the switch to LibreWolf. It’s a custom version of Firefox that focuses on the things that matter like privacy and security, while cutting out the annoyances that Mozilla loves to add to their browsers.
The new CEO of Mozilla, Laura Chambers, has a background working at all sorts of evil companies like AirBnB and PayPal. Its absolutely no surprise that the company immediately dropped plans to diversify in ethical, unique and privacy friendly ways as soon as she joined.
CEOs getting paid primarily in stock means grifters like this will drop their USP for whatever trend makes the line go up, if it is crypto, NFTs, or AI.
Not going to lie, AI can be a very powerfull tool but the “we want your browsing experience to be divine, but don’t worry we have your back” scares me shitless. Firefox has always had our backs, why do they feel the need to mention it now? Maybe I’m being paranoid but I feel like a browser shoulf just be a browser.
It’s been going in a less friendly direction for a while. Embedding of mandatory useless extensions, aggressive advertising, deals to display more and more content to more users, disregard for user settings on multiple updates, opt-out telemetry, and now telling you that you’re using it wrong.
Sure, you can navigate through various settings to disable most of these, and check back on updates for settings that toggles back, or are simply renamed and mysteriously got back to their default, intrusive value. But we should not have to do that.
And that’s not even touching the issue with the Mozilla Corporation itself.
Firefox is the alternative browser, but it certainly isn’t there to “have your back”.
Our initial offering will include ChatGPT, Google Gemini, HuggingChat, and Le Chat Mistral, but we will continue adding AI services that meet our standards for quality and user experience.
Is that the same Mozilla that started the Joint Statement on AI Safety and Openness?
What in living hell do proprietary and predatory AI services even doing here?
Mozilla just offered users to feed into the very abomination they claim to fight.
Also, for all things “AI”, local is the only way to go if you ever want to have a chance at privacy.
Whether it’s a local or a cloud-based model, if you want to use AI, we think you should have the freedom to use (or not use) the tools that best suit your needs.
Ok it doesnt say it directly but you can see where i got it from
The way I see AI being implemented into Firefox, regardless of whether it’s gonna be opt-in or out in the future is that they need to keep up with the latest browser trends in the future. If they don’t, they will definitely lose more of whatever probably small amount of remaining normies who don’t use edge or chrome but instead opt for Firefox. They’re not tech literate enough to see a conveniently placed ad telling them that xyz browser now uses AI security features and Firefox doesn’t and discern the fact that it’s a ploy to get them to switch. We need more normies if we really want a chance to keep Firefox more than just treadingn water, and the best way is to offer more random bullshit of the week to keep them from switching to a competitor.
Honestly, the worst part of the AI craze is that so many people hear AI now and immediately hate it even though it can really do some amazing stuff, e.g. in medicine. AI as a blanket term just has so much variance, there’s a ton of trash and a ton of great stuff.
“AI” today mostly refers to LLMs, and whichever LLM you’re using, you’ll likely face the same issues (wrong answers creeping in, tending towards mediocrity in its answers, etc.) - those seem to be things you have to live with if you want to use LLMs. if you know you can’t deal with it, another rebrand won’t help anything
blog.mozilla.org
Newest