There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

9tr6gyp3 ,

Get fucked, advertisers.

ngwoo ,

Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.

MrPoopbutt ,

Don’t all the advanced ways rely on JavaScript?

hoot ,

Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.

pixelscript ,

“Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.

I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.

deranger ,

Why not just use ublock medium mode?

Roughly similar to using Adblock Plus with many filter lists + NoScript with 1st-party scripts/frames automatically trusted. Unlike NoScript however, you can easily point-and-click to block/allow scripts on a per-site basis.

github.com/gorhill/…/Blocking-mode:-medium-mode

zero_spelled_with_an_ecks ,

Am I in the wild? I use it.

pmc ,

I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.

MigratingtoLemmy ,

uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.

They might be fingerprinting me using these two extensions though.

Septimaeus ,

Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.

Regardless, unless the extent of a page’s analytics is a “you are the visitor” counter, all countermeasures must remain active.

KairuByte ,
@KairuByte@lemmy.dbzer0.com avatar

Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.

unconfirmedsourcesDOTgov ,

It’s not much but they try a whole lot more than most.

ngwoo ,

It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.

Mubelotix ,
@Mubelotix@jlai.lu avatar

EU outlaws it

TheGalacticVoid ,

The EU isn’t the only place on the planet, even if its laws have an impact.

rdri ,

There is still plenty of fish for advertisers, sadly.

ArchRecord ,

For those who don’t care to read the full article:

This basically just confines any cookies generated on a page, to just that page.

https://lemm.ee/pictrs/image/c89d41f1-fec9-4f35-8695-fa6d75d047b8.jpeg

So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.

unexposedhazard ,

Basically creates a fake VM like environment for each site.

peopleproblems ,

Hahahahaha so it doesn’t break anything that still relies on cookies, but neuters the ability to share them.

That’s awesome

ripcord ,
@ripcord@lemmy.world avatar

Honestly, I thought that’s how it already worked.

Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.

But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.

Someone correct me if I got it wrong.

Telorand ,

They’ve been doing this with container tabs, so this must be the successor to that idea (I’m going to assume they’ll still have container tabs).

jollyrogue ,

Container tabs are still a thing in FF. This is based on that work, if I remember correctly.

Telorand ,

I love container tabs. It’s one of the reasons I went back to FF.

snaggen ,
@snaggen@programming.dev avatar

Container tabs are still useful, as they let you use multiple Cookie jars for the same site. So, it is very easy to have multiple accounts on s site.

ArchRecord ,

Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.

They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)

This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.

ripcord ,
@ripcord@lemmy.world avatar

That’s not what I was thinking of, which was even more fundamental. But that’s good info (and another way to cover stuff in the article).

Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren’t allowed at all. Which was really dumb since of course they are.

catloaf ,

No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.

But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.

With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.

Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.

werefreeatlast ,

I would love to see an icon of a neutered cookie please 🥺😄.

FiniteBanjo ,

Unless that cookie was somehow important for you to use both sites, but thats incredibly rare.

extremeboredom ,

For those who don’t care to read the full article

Or even the whole title, really

CileTheSane ,
@CileTheSane@lemmy.ca avatar

I don’t know why this wasn’t the case long ago.

Quill7513 ,

It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$

LiamMayfair ,

Isn’t this basically Firefox’s version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?

I mean, it’s good news either way but I just want to know if this is somehow different or better.

jollyrogue ,

Sites are much more contained now. Is much more like a profile per site.

FiniteBanjo ,

Disabling cross site cookie is already a thing for decades…

Same with Do Not Track requests.

sugar_in_your_tea ,

Do Not Track has never really done anything, it just asks websites politely to not track you. There’s no legal or technical limitation here.

ArchRecord ,

Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.

Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.

tlou3please ,

I think this tips it over the edge for me to switch to Firefox

TrickDacy ,
@TrickDacy@lemmy.world avatar

I hope so! It’s a wonderful side of the Internet to be on

FiniteBanjo ,

I prefer waterfox. Hard to trust Mozilla Corpos.

ours ,

As long as it’s not Chromium, I’m happy people aren’t just handing over the keys to the Internet to Google.

corsicanguppy ,

I miss Mozilla the product.

phoneymouse ,

Does this make containers unnecessary? Or basically built in?

MediaSensationalism ,
@MediaSensationalism@lemmy.world avatar

FREEEDOOOOOOOOOOOM

altima_neo ,
@altima_neo@lemmy.zip avatar

A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can’t see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.

This keeps cookies locked to each page that needs cookies. So a lot stronger.

phoneymouse ,

So what you’re saying is, each site gets its own container?

PeachMan ,
@PeachMan@lemmy.world avatar

I think there’s some confusion here. You’re talking about Multi-Account Containers, that person was talking about the Facebook Container. Both Firefox features with confusingly similar names, and honestly that’s on Firefox for naming them.

Facebook Container is similar to this TCP feature, but focused on Facebook. And of course it was a separate extension, so very opt-in. Now, Firefox has rolled it out for ALL sites by default, which is awesome and SHOULD HAVE BEEN HOW COOKIES WORKED IN THE FIRST PLACE!

Jessica ,

Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis

snaggen ,
@snaggen@programming.dev avatar

It is making the tracking protection part of containers obsolete, this is basically that functionality but built in and default. The containers still let you have multiple cookie jars for the same site, so they are still useful if you have multiple accounts on a site.

roguetrick ,

https://lemmy.world/pictrs/image/6b930c45-2e73-41e8-a15c-0d23ed7c673f.gif

Beaver ,
@Beaver@lemmy.ca avatar

Good to see Firefox still has value to provide

ripcord ,
@ripcord@lemmy.world avatar

Firefox is awesome.

TrickDacy ,
@TrickDacy@lemmy.world avatar

Why are we posting 2 year old articles as though they are new?

troybot ,

Looks like the article was updated today. I’m guessing this was originally covering an announcement for a future rollout and now it’s finally happening?

TrickDacy ,
@TrickDacy@lemmy.world avatar

Maybe. Confusing decision on the part of Mozilla though, if so. I was checking to see if they mentioned which version this update happened in, but couldn’t find it. Then I noticed the original post date. Weird.

AdrianTheFrog ,
@AdrianTheFrog@lemmy.world avatar

this article has not been edited, is from 2022, and says the feature was rolled out in June.

unemployedclaquer ,

I guess it says updated, but hey. PR for Firefox is cool, until the imminent enshittification.

joyjoy ,

Mozilla completes what Google was too afraid to finish.

Psythik ,

Is this the reason why I have to “confirm it’s you” every time I sign into a Google service now? I appreciate the fact that Firefox’s protection is so good that Google doesn’t recognize my PC anymore, but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube.

This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.

xthexder ,
@xthexder@l.sw0.com avatar

This wouldn’t make you have to log in every time you watch YouTube. It means by signing in to google.com, youtube.com can’t tell that you’re signed in. If you sign in on youtube.com, you’ll stay signed in on youtube.com unless you have something else deleting your cookies.

Psythik ,

Well have had my cookies set to delete every time I close the browser for several years now but FF only now started doing this verification thing. A week ago all I had to do was enter my email and password.

xthexder ,
@xthexder@l.sw0.com avatar

If you’re already deleting all your cookies every time you close, then this new change should be identical to your first login of the day when your browser has no cookies. If you’re only getting 2fa requests after this change, then maybe you weren’t actually deleting every cookie, and Google was still fingerprinting you somehow.

catloaf ,

You may want to just use tab containers for youtube, so that it maintains your session, but also isolates it.

mitrosus ,

Best way to use such (para)sites.

TrickDacy ,
@TrickDacy@lemmy.world avatar

This article is from 2022

viking ,
@viking@infosec.pub avatar

It was updated today. 2 years ago it was just an announcement of a beta function in private browsing, the full rollout happened with 129.0.2 which was released a few days back.

TrickDacy ,
@TrickDacy@lemmy.world avatar

Cool, thanks. How’d you find the version number? I was looking on the linked post but didn’t find it. Maybe just me being tired.

viking ,
@viking@infosec.pub avatar

I don’t think it was in the article, but I updated to 192.0.2 yesterday and checked the enhanced tracking protection settings, and block cross-site cookies is now in the default profile, so that was my assumption since it wasn’t there previously.

chiliedogg ,

No. That’s just Google trying to pester you into using Chrome.

AdrianTheFrog ,
@AdrianTheFrog@lemmy.world avatar

I actually had a problem where on Chrome, I would be signed out of my google account every time I restart my computer, while on Firefox, everything works normally. I use Firefox now lol.

intensely_human ,

Aren’t cookies already limited to the site at which they were created??

What the fuck? You mean to tell me sites have been sharing cookies?

I thought all browsers only delivered cookies back to the same site.

Dave ,
@Dave@lemmy.nz avatar

The problem is that a website is generally not served from one domain.

Put a Facebook like button on your website, it’s loaded directly from Facebook servers. Now they can put a cookie on your computer with an identifier.

Now every site you visit with a Facebook like button, they know it was you. They can watch you as you move around the web.

Google does this at a larger scale. Every site with Google ads on it. Every site using Google analytics. Every site that embeds a Google map. They can stick a cookie in and know you were there.

intensely_human ,

Is that because the like button is an iframe?

Dave ,
@Dave@lemmy.nz avatar

It doesn’t have to be. Your browser sends the cookies for a domain with every request to that domain. So you have a website example.com, that embeds a Facebook like button from Facebook.com.

When your browser downloads the page, it requests the different pieces of the page. It requests the main page from example.com, your browser sends any example.com cookies with the request.

Your browser needs the javascript, it sends the cookie in the request to get the JavaScript file. It needs the like button, it sends a request off to Facebook.com and sends the Facebook.com cookies with it.

Note that the request to example.com doesn’t send the cookies for Facebook.com, and the request to Facebook.com doesn’t send the cookie for example.com to Facebook. However, it does tell Facebook.com that the request for the like button came from example.com.

Facebook puts an identifier in the cookie, and any request to Facebook sends that cookie and the site it was loaded on.

So you log in to Facebook, it puts an identifier in your cookies. Now whenever you go to other sites with a Facebook like button (or the Facebook analytics stuff), Facebook links that with your profile.

Not logged in? Facebook sets an identifier to track you anyway, and links it up when you make an account or log in.

Nightsoul ,

Thank you for the explanation!

unemployedclaquer ,

NO.

en.m.wikipedia.org/wiki/Third-party_cookies

Maybe it’s not allowed in your local jurisdiction? But it’s been a problem since forever.

haywire7 ,
@haywire7@lemmy.world avatar

Forgive me if this is an overly simplistic view but if the ads with cookies are all served on Google’s platform say then would all those ads have access to the Google cookie jar?

If they don’t now then you can bet they are working on just that.

conciselyverbose ,

The way I’m reading it, they allow the third party cookies to be used within the actual site you’re on for analytics, but prevent them from being accessed by that third party on other sites.

But I just looked at the linked article’s explanation, and not a technical deep dive.

NuXCOM_90Percent ,

We’ll have to see what happens but what you are talking about is what Mozilla calls Third-Party Cookies and… they are aware of it.

…mozilla.org/…/third-party-cookies-firefox-tracki….

I can’t entirely tell if that means they will be put in the facebook cookie jar or if it will be put in the TentaclePorn Dot Org (don’t go there, it is probably a real site and probably horrifying) cookie jar. If the former? Then only facebook themselves have that which… is still a lot better I guess? If the latter then that is basically exactly what we all want but a lot of sites are gonna break (par for the course with Firefox but…).

Lost_My_Mind ,

InB4 the guy who replies to defend tenticle porn…

ripcord ,
@ripcord@lemmy.world avatar

The cookie would go to the Facebook or tentacleporn cookie jar depending on which site the user has actually visited. Whatever the domain in the address bar says.

catloaf ,

TentaclePorn Dot Org (don’t go there, it is probably a real site and probably horrifying)

It’s registered through namecheap and points to cloudflare, but there’s nothing behind cloudflare. It just times out. That was disappointing.

pipes ,
@pipes@sh.itjust.works avatar

They are usually separate things. Cookies are produced/saved locally, to be read in the next visit (by the same website or maany websites basically forever unless you use firefox containers or at least clear them once in a while). There’s also local storage which is different but can also be used to identify you across the web. Ads, trackers, all of these categories are often made of many small components: you read a single article on a “modern” newspaper website, hundreds of connection are being made, different tiny scripts or icons or images are being downloaded (usually from different subdomains for different purposes but there’s no hard rule). It’s possible to block one thing and not another. For example I can block Google Analytics (googletagmanager) which is a tracker, but accept all of Google’s cookies.

ricecake ,

So that’s what third party cookies are. What this does is make it so that when you go to example.com and you get a Google cookie, that cookie is only associated with example.com, and your random.org Google cookie will be specific to that site.

A site will be able to use Google to track how you use their site, which is a fine and valid thing, but they or Google don’t get to see how you use a different site. (Google doesn’t actually share specifics, but they can see stuff like “behavior on one site led to sale on the other”)

True ,
@True@lemy.lol avatar

What about depreciating third party cookies?

I had never in the previous year visited a single site that required third party cookies.

I never found anyone who have a use case for it, I even disable it at every PC I setup or administer with zero problems.

Dran_Arcana ,

Oracle, SAP, Redhat, all of their customer portals require it for SSO. I’m not saying it should be that way, but it is.

01189998819991197253 ,
@01189998819991197253@infosec.pub avatar

They call it TCP. All we need now is IP, and we’ll be set lol

unemployedclaquer ,

Nah math is bad for internet.

Bonesince1997 ,

Take that, cookie monsters!

MinusPi ,

It baffles me that this was ever not the case.

mbirth ,

It was - in the ancient times. Then, there were 3rd party cookies which you had to manually approve upon the initial creation. And then it went all down south and got abused via CDNs and ad networks.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •