Because it breaks a lot of things like SSO providers (although I completely agree with you, screw that, make it the default and add exceptions as necessary like Mozilla is doing now).
Could a site fix this by delegating a subdomain or CNAME to the SSO provider like sso-company.example.com so that the cookie is still using the same domain, but pointing the IP to the SSO provider? Assuming the SSO provider supports this, that is. I believe OKTA supports this method.
I regularly use nginx to reverse proxy third-party API calls. I use it to protect API keys.
In my case, I strip all cookies and sensitive headers. One must keep in mind that the browser will treat it as a first-party request and the security implications that has. You may have to filter or modify cookies/headers.
I mean effectively today hardware you or your boss owns is doing most of the work of tracking yourself.
This is making them have to allocate resources to achieve the same effect. Like taking lojack off of your car and phone, and making 'Them' have to tail you and scour security footage like in the old days. It's more expensive. Expensive things do not scale, so you have to prioritize who is worth the cost. People who are under legitimate suspicion of causing harm. Less 'by-catch' to use a commercial fishing concept.
When it's cheap to harass everyone, nobody is 'safe'. But when terrorists can't be tracked at all, nobody is 'safe' either. So we have checks and balances.
well sso providers would still work, if it was made correctly?
sso works without cookies. if I implement google sso I would not login via the google supercookie
there is a state parameter? so If I want to have a cookie that passes stuff, I can just store my stuff inside a cookie and pass the stuff inside the state param, there are so many possibilites via openid (which is super easy), I do not know how saml2 works, which might be different tough.
I know of a token system that some questionable engineers started pushing session state into and since it shipped before anyone noticed, walking that back turned out to be quite a chore. What was supposed to be a couple hundred byte cookie started hitting max cookie length warnings in other parts of the system.
When people need to keep a door open, if they don't see a doorstop in the immediate vicinity after two seconds of looking, some will just use whatever heavy object that is closest and consider the problem 'solved' instead of managed.
I needed data, I didn't know where to put it, this thing can give me data, boom, solved.
Not only does redirect based login work, it's an inherently better model than sharing cookies.
With shared cookies nothing stops site A from taking a copy of your cookie and using it to impersonate you on site B. With redirect based login the identity provider has to authorize each application that is being accessed and each site has its own session cookies.
The main problem is dealing with globally revoking access but that's usually solved with shorter termed session cookies that periodically need to be refreshed from the identity provider.
Site A can’t access 3rd party cookies. Cookies only can be accessed by the domain they are created on. Otherwise any site could toss a 1x1 image pointing to any website and steal the cookies.
Not a huge loss, if you depend on federated logins its just a matter of time until Google or Facebook's algorithms decide to ban your account without explanation or recourse and then how do your users access your site? All you'll be able to do is try to shame the companies on social media and hope enough people are outraged that the company takes notice.
I've had third party cookies completely disabled for years, and first party cookies only allowed by exception. It works fine on everything I use except for whatever it was Atlassian were (are?) doing with their very odd collection of about two dozen domains they round tripped through on authentication.
To be honest though, browser fingerprinting makes this mostly irrelevant unless you carefully use a script blocker with a whitelist too. Any domain that includes trackers that drop third party cookies almost certainly includes scripts that can fingerprint you and send results to a server without using a third party cookie.
(A bit of OT)... which is why I am considering SPAs to be complicit in 'evilness'. All these webpages that require js for no real reason is generally making the web insecure and implicitly hostile and difficulty to navigate. Very few have the mental overhead to evaluate each site, so most just let any page do what ever it wants. Tracking and miners be damned.
Weirdly for me Atlassian doesn't work when I have the spoof referrer enabled in about:config. Like why does referrer, a property that is a header, define whether my login is valid or not?
I had the same problem and tracked it down to uMatrix's quite reasonable spoof-referrer default, which breaks nothing else. Just Atlassian's sign-in, which seems to bounce you around to several domains before it lets you in.
I've worked on (non-Atlassian) SSO projects where the provider used the referrer to send the client to the page-after-logout (and occasionally page-after-login) if they weren't set as parameters in some circumstances.
Here's a reference to a F5 device providing SAML SSO services and having a similar issue:
I actually had a member of Atlassian's "security dev team" tell me in a support ticket I opened about being unable to login with referer headers disabled that:
> since we cannot discount the possibility of malicious users programatically generating tokens and forcing them upon users, we check the referer header to ensure that the request chain was initiated in the one place that we're comfortable with: id.atlassian.com
This is just my hunch as I work in analytics and deal with cookies a lot but both Salesforce and Atlassian appear to intentionally trade off the third party inconvenience because their products are enterprise (you have to log in for work) and they rely on upsell/cross sell across their products which they host on different top level domains. So forcing the third party cookie helps immensely with their sales and retention, and doesn't hurt usage because it's often required for work and if you need to work around it, you usually can find a way if you are so inclined.
If they had used the same domain for their products historically and just separate subdomains they wouldn't have to make this trade off, but it probably also helps with third-party ad networks/segmentation to get folks to turn it on anyways.
What would be the point of localstorage if JS couldn't access it? Cookies can be set and get via http headers, but is localstorage available by other means than JS?
I have trouble with google login (url must be copied into a google tab) and oracle cloud loses my tenancy home region every few minutes (https://i.imgur.com/ZCsepq3.png). Several other examples like LMS's that use O365 to log in must be manually logged in every time
I use both Google and O365 at the educational institutions I work at and both platforms works fine across a wide variety of applications. Strange that you are experiencing these issues.
I guess we use different sites then. I should specify I mean it doesn't keep me logged in. I consider this breaking because if I click a link to that site, it loses the original context once logged in.
It's going to break all 3rd party social layer providers. Most news sites don't have native comments and rely on a 3rd party like a Disqus. Login in state is stored as a cookie. It also going to break all the openID stuff that is heavily used in organizations like Walmart. OpenID is all based around cookies. I remember having to rebuild our provider when Safari released an update that you can't set 3rd party cookies without user interaction.
That type of attitude toward the millions of users that use discus just shows why Firefox is a dying browser with ever decreasing install base. Funding will keep decreasing as it is tied to search engine deals which is based in active users.
Anything that shields me to some extent from the "grab money fast, before anyone notices we're fucking them over" companies out there is a champion, as far as I'm concerned.
there are valid criticisms of firefox but breaking disqus is a bizarre one. when is the last time you used it? my impressions is that these days the literal majority of content produced on it is spam and it's been this way for the better part of the last decade
Mozilla is really fighting the good fight for the users privacy. I've been using Firefox for as long as I can remember, even when there were faster and more fancy alternatives available. Their ideology and service to the user is what makes me loyal to them
> even when there were faster and more fancy alternatives available
This seems to indicates there's not faster alternatives around anymore, but the last time I tried FF (4-6 months ago) I couldn't make the transition because the lag was pretty obvious when coming from Chrome based browsers. Is this not the case anymore?
I think this might be more about perception than anything else.
I've used Firefox since 2006, and Chrome always seemed heavier, laggier and uglier. Maybe it's the snappy iOS-like animation when you scroll to the bottom of the page that makes it seem snappier?
It's not imaginary - for years Firefox drained battery on macbooks really fast. Then there is this pesky issue of randomly freezing whole laptop for a minute or so, usually associated with file uploads or locking screen [1], [2], [3], ... Fixed in one version, then appears again in the next version.
I still used Firefox a lot for various reasons (and still do), but I'm not blind to how it performed.
I find them to be close enough to imperceptible for just normal html and css etc.
The stumbling block for me as FireFox user is I am increasingly bumping into web apps that preform poorly in FF but are fine in Chrome for one reason or another. One instance I bump into a lot is ElasticSearches Kibana runs like trash in FF for some reason.
I am guessing performance differences might be masked by good hardware? Sometimes performance differences don't show up until you use an underpowered machine.
I don't think it's just that. I have a half-dead Chromebook with linux, and I use Firefox on it. Some years back I ran Chrome on it because it worked better, but at some point I started seeing issues with Chrome and tried Firefox again. I've been using Firefox since.
I use Firefox and Chrome at the same time and I don't really notice any difference. Maybe a bit for Google apps (Hangouts, Docs, Meet, etc) but I just see that as a symptom of Google's attempts at using their market dominance to harm competitors, which makes me want to use Firefox even more.
It's unlikely they put any effort into intentionally make them run slower, it's just that they are written to work optimally on Chrome and minor differences in the behavior of things like the V8 vs. SpiderMonkey and Blink vs Gecko. Given that each one is written with different tradeoffs, it's not surprising things perform differently.
Whether or not the Google programmers use specific proprietary knowledge about the behavior of Chrome to optimize performance is different. If they do, that would be similar to the things that got Microsoft in trouble.
Google knows that every time they release a Firefox bug, FF's user percentage goes down a tiny bit. Repeat over dozens of bugs, for years, and you have a strategy.
There's one blog post from another Mozillian that I can't find anywhere that came out within the last year with other examples, I think it was on HN.
Brave and uBO share filter tech and we aim to make uBO unnecessary (this may require setting shields to aggressive). We do much more than any extension can do, and Google has made it clear they will further restrict extension APIs.
My CPU immediately pumps to 100% usage after opening google docs. Granted, it's on my old laptop, but I can use electron apps and they run far better than gdocs.
Firefox is fine and quick as long as you don't need to use any heavy Google apps. Some people might even consider this a plus. For me, between work and personal use I'm effectively married to Gmail, Google Calendar, Google Docs, and Google Hangouts. Unfortunately that makes Firefox a non-starter for me. Not to mention Firefox's privacy settings trigger countless reCAPTCHA gates across most of GSuite. I get that this is not Firefox's "fault" and it's done intentionally by Google, but as a user it becomes my problem.
I really want Firefox to work for me and I'd love to drop Chrome, but last time FF made big noise about performance improvements I tried it out and Gmail was still unusably slow.
FWIW I use all of those apps on a daily basis with Firefox and have not noticed any performance issues. It may be worth giving it another try if you haven't in a while.
Indeed. Hangouts is one I find works better in Firefox even! But I observe it seems to vary. Perhaps Intel Macs has some quirks that makes it more peformant and reliable in Firefox.
I switched to FF when Quantum came out. I use it exclusively. Not because I hate Chrome, but because I don't see any need for chrome. Once in a while I see a website that forces me to use something other than FF. But it happens rarely, and it is mostly some webgl-based under-development demo website.
I even use it on my phone. The mobile version is definitely worse than Chrome, but it has plugins (or it used to! nowadays it only support a few popular ones which is a shame) and also I can send tabs from my phone to my computer (which is a better place to read articles anyways).
I switched back to Firefox last week and I had the same experience -- Google apps and Slack were dog slow. But after a day or so they were working fine, I imagine it's a matter of populating the cache. YMMV.
I use Google Calendar and Google Docs without any issues in Firefox. I agree Gmail is coded terribly and do not use the web site! I stick to using Thunderbird on the computer, and checking email on my phone. Have not been using Hangouts for a couple years, though.
For me, the way Google is keeping Gmail terrible for other browsers is exactly the reason to not use Chrome. No way I'm OK with that.
It also depends upon the operating system among several other variables,
I didn't find noticeable difference between FF and Chrome based browsers(Vivaldi, Edge) on macOS(although Safari runs circles around them) after using them extensively. I used each of them for a separate project with several common websites loaded in them, there were different quirks for each browser(especially reg tab hibernation) but latency was not one of them.
On Linux FF seems definitely faster than Chromium, although there are occasional DNS errors which stops loading the web pages altogether(likely result of my own doing). I've stopped having different browsers for different projects and just use FF for all.
On Android with Chrome, not just Chrome but even WebView using it is astonishingly fast(e.g. DDG browser), I presume it's because of data saver feature. On de-googled android like LineageOS, FF/Fennec seems to be on same level as Chromium and DDG is faster here as well.
On iOS, everything is Safari.
I don't use Windows much, but I've seen others mentioning Edge seems to be faster than Chrome recently.
I switched from Chrome to Firefox about a year and a half ago. Chrome definitely felt more snappy, but the difference wasn't that much.
Except on Facebook. My Facebook tab is incredibly laggy, and gets more and more laggy the longer I leave it open. I'm one of those users that tends to keep 50+ tabs open, and I have to close and reopen the Facebook tab at least once a day to keep it from becoming a nearly frozen mess. Even then, if a video is playing and I click it to make it fill the window, it takes several seconds for it to happen. And with an i9-9900K, 32 GB of RAM, RTX 3080, and a 1 TB NVMe drive, my computer is definitely no slouch.
I have tried regular as well as the developer version of Firefox, but no matter what I use, YouTube videos always skip frames after every 10-15 seconds or so. So I use Brave for YouTube and other WebGL heavy stuff and Firefox developer version for daily browsing.
That sounds very strange. Certainly don't see that in Firefox on Mac (work laptop) and both Linux and Windows (personal laptop). Try adding the h.264 extension. That forces YouTube to provide h.264 videos which is hardware accelerated on pretty much any hardware.
Keep in mind that Firefox opens their website on first run and on every update and that includes Google Analytics.
I find the majority of their privacy claims dubious and dangerously misleading for those that don't know any better. If they were serious about privacy they'd offer uBlock Origin (or equivalent functionality) preinstalled by default.
Their current countermeasures such as containers, tracking protection and this cookie thing is trivial to bypass with browser fingerprinting and IP address tracking if you have a global view of the Internet (which Facebook and Google do have).
"neither Mozilla nor Pocket ever receives a copy of your browser history. When personalization does occur, recommendations rely on a process of story sorting and filtering that happens locally in your personal copy of Firefox."
I modified the settings long ago to come up with a blank tab on startup. I use NoScript and do not allow google analytics through. No facebook domains make it through NoScript as far as javascript is concerned, very few google ones do.
I get you about the updates. It's a risk-reward ratio I accept because firefox + noscript + always starting in a private session is way more helpful than the update problem is harmful. Using a VPN a lot of the time helps, too. There is no solution I know of that is perfect. My threat model is pretty relaxed, though, so what I do is mostly for my peace of mind. You have reminded me that I should start spoofing my user agent again.
I don't disagree that it's possible to configure Firefox to respect your privacy. I myself use it sometimes and have a similar configuration.
But it is extremely misleading for them to be shouting "privacy" at every opportunity while the truth is that their browser leaks personal data like a sieve in the default configuration. This would give a false sense of security to non-technical people who don't have the skills to see through these lies.
And here are the FUD-spreaders yet again, that instead of the tiny “bad” things like some form of harmless analytics (it is not even that) they would run towards the goddamn gate of Hell itself. Like, what do you imagine chrome does? Or do you think brave have eveything removed? It’s the exact same browser with different name and logo and preinstalled adblocker..
Sorry for the somewhat angry comment, but I honestly can’t understand this mentality.
Google Analytics isn't harmless though. It's giving a single party a wide view on the entire Internet (thus the ability to circumvent cookie-based tracking by just using IP addresses and heuristics) and said party makes its money by tracking people online.
I'm not saying Chrome is any better, but at least Chrome doesn't toot the "privacy" horn at every opportunity.
Brave does have some kind of blocker built-in which might actually help even if it's not perfect.
Do you have any good examples of sites that don’t work on Firefox? I hear this a lot, but I don’t seem to experience it. I exclusively use Firefox on the desktop, while I use Safari on mobile.
most of the time the sites "work". Issues are usually in one of two categories: (1) bad/ugly layout, (2) failure to login properly. Occasionally, web apps for smaller organizations will just stop me at the door due to my User Agent string.
I mean, why are all these lengthy intermediate steps necessary? It's only a matter of changing the default value of one damn setting. I've had third-party cookies disabled for more than a year and the only websites I've had problems with were ridiculously poorly-made ones — like AliExpress, that for some reason has a zillion subdomains and relies on third-party cookies for authentication.
because you're fighting the ad industry. The ad industry which also has their own browser and tells grandma whenever she searches about problems with cookies that there's a "better" browser out there.
Precisely. Google is an ad behemoth AND has the majority of the market of browsers. If Firefox (or Safari of Opera or etc) changes to something that breaks Google but Chrome doesn't, they'll just get more of the market. For non chromium browsers to survive, they have to play a long game and show people why these changes are important. People are happy to sacrifice privacy for convienience, unfortunately.
Leads to a prisoner's dilemma situation. A move like that has to be done by everyone in concert (example: killing Flash), or it's harmful to the one browser that blinks first.
This thread contains plenty of examples of legitimate uses for third-party cookies. If FF instantly and immediately broke those, users would be cursing, not praising Firefox, and switching to a browser that doesn't break what they use.
> relies on third-party cookies for authentication
A lot of websites depends on this via auth0, cloud identity, cognito... and the experience becomes subtly broken in a way that you need to be extremely technically savvy (a developer that has a whole lot of auth experience) to understand.
It's funny you note that the only website that had issues was a top 50 website (https://www.alexa.com/siteinfo/aliexpress.com#section_traffi...) that no doubt has a lot of ordinary non-technical folk on it. Breaking sites like these would likely kill an already relatively niche browser.
It breaks non-tracking functionality for embedded things on the web as currently implemented in major browsers, in particular, which is one of the largest use cases.
Signing into a website through an iframe redirects you back to a sign in page inexplicably if the post-signin page requires a cookie.
Another example is you're signed into website A, and while on website B, iframes to website A behave in such a way that you're not signed in, and you cannot sign in.
If you disable third-party cookies, you can't download files or view videos in Google Drive without a workaround.
This is because the download is from googleusercontent.com while your browser remains at drive.google.com the whole time - and to download private files, googleusercontent.com expects you to have a login cookie. If you block third-party cookies the download gets stuck in a redirect loop, sending you to get a cookie over and over again.
I really, really like Firefox, but this is basically what happens when I try to get people to use Firefox (and yes, I do actually try to get people to use Firefox):
E: Hey use Firefox!
O: OK, I'll give it a try!
O: Hey, why doesn't X site work properly with Firefox?
Firefox: Introduces something making it more likely that another site doesn't work
O: Hey, now Y site doesn't work either!
E: Hey, just wait a second you can-
O: Sorry, I don't have time for this, I'm switching back to Chrome.
IMHO - Firefox's #1 priority should be making sure every site in the the first 10,000 of Alexa work equally as well with Firefox as it does with Chrome, period.
What good is amazing privacy stuff if your userbase is rapidly dwindling?
list of sites that don't work (many, if not most of these work on Chrome without issue):
Even GSuite works better for me in Firefox. Slides stays smooth even when scrolling through large presentations and it never locks up (like Chrome does).
Cisco Webex is a repeat offender. The experience is much better in Chromium. If I am using Firefox I have to dial in to a meeting using my phone instead of being able to use my USB headset.
I've been using Firefox as my main browser for a long time and over the past couple of years I noticed an uptick in websites that wouldn't work lest I used Chromium. For instance last week I had to use a crappy HSBC website that wouldn't let me login in Firefox (it would just hang) while it worked in Chromium.
It's still very minor and I can't even come up with a 2nd example off the top of my head but it does definitely happen from time to time.
If anything these few cases only makes me value Firefox even more, I don't want to enable the Chrome monopoly.
Why is this a complaint at Firefox, and not at Google for abusing their monopoly to create new features on a whim regardless of what it does to other browsers?
I suppose because some of them are in the standard and not implemented in other browsers. Or there are some 20 year old bugs (reported) that are not fixed while pocket and robot are featured.
settings that are known to break websites are disabled in the default configuration, and labeled clearly in the settings pane.
firefox doesn't exist to "win" the browser wars. it doesn't even exist to give users the best possible browsing experience, although that's certainly a primary goal and in my experience they're doing well.
the #1 reason that firefox exists is so that mozilla can have a seat at the WHATWG table -- because very important decisions about the fabric of the world wide web happen there, and the other seats all belong to apple, google, and microsoft.
mozilla is the closest thing we (the users -- not just firefox users, but all web users) have to a "representative" in the WHATWG, because mozilla doesn't answer to shareholders.
> What good is amazing privacy stuff if your userbase is rapidly dwindling?
aside from a noticeable dip when the new chromium-edge started shipping with windows, firefox browser usage on desktop has been pretty steady for the past 5 years.
the value in adding privacy features is that it solidifies a certain use of the protocols, making it harder for WHATWG to make spec changes that undermine the provided security.
This site appears to provide a reasonable analysis of all the common browsers. It was mentioned on HN a year ago to zero comments. Chrome is completely indifferent to prevailing privacy compromises. Brave is locked down pretty hard. This one is amusing: "Brave: Add noise to Canvas, WebGL and AudioContext APIs to make fingerprinting more difficult"
Nice, sounds like I can get rid of the extension I use to toggle `privacy.firstparty.isolate`.
> In addition, Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers. Only when Total Cookie Protection detects that you intend to use a provider, will it give that provider permission to use a cross-site cookie specifically for the site you’re currently visiting. Such momentary exceptions allow for strong privacy protection without affecting your browsing experience.
That's exactly why I have to toggle it. Anyone that uses auth0, and many publications sites (follow a link to a PDF, get redirected to `/cookie-absent` instead) fall foul.
Moreover, I've heard loud voices before that controlling 3rd party cookies will break login providers - guess what, it turned out if there is a will, there is a way.
I find this very annoying. An OpenID Connect provider is perfectly capable of working without using third-party cookies. The only reason they need them is to allow OIDC authentication without actually redirecting to the provider (by using a hidden iframe to do the OIDC flow on the same site). But if 3rd-party cookies are disabled it should just fall back to the normal OIDC redirect.
The OIDC front channel signout functionality relies on third party cookies to work properly. This feature has the IDP basically loading your app's end session page in a hidden iframe.
Similarly the OpenID Connect Session Management feature (check_session_iframe) also depends on the ability to use third party cookies.
This functionality is needed to be able to detect if user logged out from front-end code without relying on having any back end code that could receive either a front-channel or back-channel signout notification and send it back.
In the absence of that a pure SPA with no backend could only detect the logout if access tokens are stateful, and they get an error message back that the token refers to an ended session.
Some people get really cranky if a single sign out feature does not actually sign you out of everything.
Sorry you're right. I was just thinking about sign in. But at the same time it seems like the cat is already out of the bag on this one. Safari already blocks all third party cookies by default and it seems like other browsers are moving in the same direction.
"Nice, sounds like I can get rid of the extension I use to toggle `privacy.firstparty.isolate` ..."
Forgive me ... do I understand that there is a true/false setting in Firefox named "privacy.firstparty.isolate" that you like to toggle from time to time ... and you use an extension to do that ?
I don't do much browser customization and use only one extension (uBlock Origin) but ... couldn't I toggle a single Firefox setting with a simple command line ?
Toggling it manually requires going to about:config, and searching for it.
On startup it's enabled (i.e. do isolate) via a config file, so I could change it there with a shell script. I think though that I'd have to restart Firefox for it to take effect.
The extension gives me a handy button in the toolbar that's red (danger) when it's off (i.e. not isolating) that I can just click to toggle.
Yes it's a tiny job for an extension, but do one thing well right? Also, to be honest, it's easier that it's there than switching to or pulling up a new shell.
It depends on your usecase. Containers for me has nothing to do with this.
I use containers for sites like AWS where it doesn't understand the concept that I might want to switch regions or accounts but only in some tabs so that I can work on multiple parts of the network.
There are other use cases for containers besides third party cookie isolation. If you want to have two separate sessions for a site, you'd still need containers.
I have multiple sites like Github, Dropbox etc where I have multiple accounts I'd like to access separately. Typically private account vs work account, but also other scenarios.
Containers makes this a breeze.
In addition, at least Firefox only has a single private session. So if I open a site in one private window and another in a different one, they're in the same session, sharing cookies etc. Not so with different containers.
I find this a horrible usecase for me, I keep my password managers separate from my work provided one and my personal one. Containers don't solve this, and I use profiles, which I have to be thankful for MultiFirefox for fixing it. But only on MacOS.
I don't understand why fixing profiles isn't a priority, I find the usecase for them is completely different to containers which are awesome in a completely different way.
I use Containers to make sites have no stored memories of me. Most sites I open, a new, temporary container (extension required) for that visit, and swiftly deleted afterwards.
All my YouTube views are firmly disassociated from my account, so recommendations will only be impacted based on geographic data. News sites can't remember if I've been there before, other than using IP addresses.
With all of the cookie protections and in app privacy settings, is highly targeted advertising becoming less effective? If targeted advertising is less effective, will the advertising giants need to provide a disclaimer when you try doing it? Will it lower ad prices?
Or will it take regulations to remove targeted ads?
> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers.
Would be great to have some more details about it: in particular, how do I turn it off if I prefer to add any exceptions manually.
Edit 1: Mozilla Hacks blog [1] has a bit more but still doesn't answer the question:
> In order to resolve these compatibility issues of State Partitioning, we allow the state to be unpartitioned in certain cases. When unpartitioning is taking effect, we will stop using double-keying and revert the ordinary (first-party) key.
What are these "certain cases?"
Edit 2: Reading on, there's this bit about storage access grants heuristics [2] linked from the blog. But is that really it, or is there a hardcoded whitelist as well? If so, it'd be great to see it.
This bit in particular is ambiguous in how it's supposed to work exactly (who's "we" here):
> If we discover that an origin is abusing this heuristic to gain tracking access, that origin will have the additional requirement that it must have received user interaction as a first party within the past 30 days.
The question is how to use "Total Cookie Protection" without any hardcoded or heuristics-based exceptions.
Your answer seems to be about how to turn off "Enhanced Tracking Protection"/"Total Cookie Protection" or parts of it (resulting in weaker protection). I want to keep it enabled and disable the exceptions (for stronger protection), i.e. the opposite.
I haven't installed the new version yet, so can't say for sure, but as far as I know there is no setting for this in that menu. [1]
If I misunderstood what you meant, please elaborate.
I agree I wish they had more detail about the exceptions.
I've been a FPI user for years as a best-effort to reign in tracking but there are a common few sites that just break with FPI (50% of the time PayPal checkout doesn't work). Even if "Total Cookie Protection" is only 98% as effective as FPI, I'm making the switch.
Yes, it’s essentially that, FPI with workarounds for common breakage. You should switch from FPI, this is essentially another take on FPI by some of its original developers, so it should have fewer issues overall, not just site breakage.
It will be interesting to see how many sites break with “Total Cookie Protection”. Currently I use what I consider are bare minimum of anti-tracking, that is what I can make Firefox provide on its own, plus the DuckDuckGo browser extention. Those two things alone break an alarming number of sites. The DDG extention is pretty regularly mistaken for an ad-blocker.
Given Firefoxs low adoption, I fear that website owner will just ignore that their excessive tracking breaks their site in Firefox... “Works in Chrome... good enough”
I have strict tracking enabled in Firefox as well as uBlock Origin and I've yet to see a site broken. The only "broken" ones I've seen are badly coded ones that also fail to work in Chrome. Reputable sites tend to be just fine. YMMV.
(I’m one of the developers of this feature and co-author of the blog posts)
This is a great question and I’m glad you found the answer, you probably understand that for many blog posts we avoid going into too much technical detail.
To answer your final question, there is no hardcoded allow-list for State Partitioning. The heuristics as described on MDN are accurate.
Have you considered using something like Expounder (https://skorokithakis.github.io/expounder/) in your posts? (Disclosure, I made it but it's a small open source lib).
I don't see why we can have full-blown web apps but our text needs to be very specifically just text these days.
Awesome. Just a heads up, I've already finished it and just submitted it. HOWEVER, the plugin has to be licensed as GPLv2, but it shouldn't affect your license (since it's just using your code as a library). I'd feel better about it (and it will probably be smoother sailing during the review process) if I could submit your names as authors on the plugin.
I love this, but I'm a bit surprised that you do not include the ability to "unexpound" an "expounded" term. Is that intentional?
If I were reading a technical text, I would definitely end up reading most paragraphs at least twice. It would make no sense to keep the expounded terms in the second time; I'd be tempted to hide them back as soon as I was finished with them the first time.
It's because, once clicked, the new text should become part of the old, and that's it. Presumably you've already read it, and I don't want to make the viewer have to re-collapse the links every time.
Your use case makes sense, though, which is why the feature was included. Maybe I should mention it in the README.
I think collapsing would also be useful when all you need is a quick reminder, not a full explanation. Like "What's that again? [click to expand] Oh that's right [click to collapse]". That's easier than finding the place to skip to.
Not the author, but presumably you're overlooking the fact that the expounded term doesn't necessarily have to be "inside" or even "neighbouring" to the details element.
The author's intent here is to have terms explained in the text explicitly in such a way that it would 'augment' the text with an explanation somewhere further down the line, but not necessarily "in-place".
It is also intended for text specifically, rather than replacing one element with another.
I agree that display/summary are similar in spirit though, I had not come across those before.
Thank you! I used to use footnotes too, but I didn't like how they took you out of the flow of the text. Expounder aims to specifically let users stay in the flow of reading, which is why one of the core instructions is that the text should work in context, as if it were never hidden.
I miss footnotes on the printed page because, in addition to references (where they're probably better as endnotes to be honest) I find they're great to use for parentheticals that bulletproof a point, add some background that's not essential to a point being made, etc. But these latter uses work significantly less well in a blog post or ebook.
It's good to see experiments along these lines. I really like Wikipedia's recent-ish rich tooltips on link mouseover, and the HTML <summary>/<details> elements deserve to be more widely known.
From the demo it look as if Expounder is one-way - once you've expanded something, you can't collapse it again. Is that correct?
What I dislike about footnotes like that is that they pollute the browser history. If you want to leave the page but clicked on a few footnotes and their backlinks, you have to go “back” through all of them.
Thank you so much for posting gwern’s sidenote article! I want to use sidenotes on my site and this was a very valuable resource!
Back button usually come with an unfoldable list of jump points.
I am more ennoyed by how the jump points are turned into a useless feature by so many javascript out there which load new content without impacting the browsing history.
Is there support for an expound-all button on a page? I definitely have days where I just want to also read the details and don’t want to click a dozen times while I’m reading.
Not currently, but it shouldn't be hard to add a button with one line of JS to add the required CSS class to all the elements. This might defeat the purpose, though, as it's kind of intended to save you from reading things you already know.
Hi, can you consider adding some accessibility to the library? Currently, I don't have a way to know that a term could be expanded, because the signal seems to be visual only and not detectable via a screen reader. Adding aria-pressed might be the solution, but I'm not an expert, just an user.
I feel like the inserted text should be highlighted with a light yellow background or some indicator. Just appearing like that inline seems a bit funky or unexpected.
But I see there is a css class which is nice.
Just a simple rgba(x,x,x,0.5) where the x’s are the usual yellow height.
It should animate the text while unfolding, but, other than that, there's no need to know what was unfolded. You just click what you don't know and eventually read the relevant info!
Why use this instead of footnotes? For example in these Feynman lectures below the footnotes and references to formulas and images activate then you hover over it. These footnote can even include graphics and formulas.
To me, footnotes serve a different purpose, e.g. linking to papers, like the Feynman lectures site does. Expounder is more about indicating that you don't know something, so the text itself can change to accommodate you.
This should have always been the only way it worked.
Plus it should be easier to create white lists of allowed websites and all other cookies delete with every broswer restart. I know it is possible with Firefox but you need to add websites to whitelist manually in deep settings. At least there are some extensions that make it easier, like CookieAutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
What I wonder/concern is how can one decide for legit use.
This also sounds like a possibility for discriminating small players with legit use. (similar to Microsoft's SmartScreen)
Would be great to know how are those concerns handled?
I would like something like, each site by default gets a bucket by name.
If cookies from another bucket should be shared with other sites, or might be seen when requested by a cross-site load from another site, ask the user a four choice question.
"Allow (site) to see cookies from (site)?"
Always Allow, Just this time, Ask later, Always Deny
> Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers.
Facebook and Google will be excepted? This makes it a joke, sadly.
This is basically Google (Chrome) paying Mozilla (Firefox) to kill 3rd party cookies because Google has a better way to fingerprint users without 3rd party cookies, because they have SO MUCH data about us.
This move is aimed at killing other AdTech companies which rely on 3rd party cookies to track users.
They painting this as a 'PRIVACY' move, after they have already found other ways of tracking users across websites and devices.
I wish there was something better than cookies for these use cases. But then, designing something that can't be abused for tracking, that empowers all the legitimate use cases is also really hard, maybe even impossible.
Total Cookie Protection ? Great, I wish it will solve my year long problem of Firefox eating my cookies and session when it silently updates itself. /rant
Except if you're setting up SSO for your company's employees. Using a 3rd party login provider is a necessity. You shouldn't trust employees to create unique / strong passwords for every individual service they login to.
If you can enforce that they use the password manager, it solves that one problem.
But SSO centralizes access management. For instance, with one switch I can set password requirements, require 2FA, and grant/revoke access to all of an employee's services when they join the company or leave.
I'm sure there are ways to use 2FA or OTP without externalising access management to Facebook, Google or another SSO provoder, unless you want to pick convenience over privacy and security.
How do you centralized your authn, your 2fa provisioning? How do you ensure that your cloud native apps have access to the auth backend without risking exposing the wrong ports on the wrong vpc?
Just adding a library to application code is not sufficient. What I mean is that organizations should not roll their own SSO provider. At the very least, work with one of the many companies that offer it as a product or service. If your threat model requires it, you can host the product on premises.
How do you enforce it over a bunch of 3rd party software which either doesn't support 2FA or doesn't support enforcing it? If they support SSO which they usually do, its a non issue.
Not only that. As a user it's incredibly frustrating entering a password 5 or more times each morning. This results in users using extremely weak passwords.
The same is true for forcing users to reset their password every 50 days or so, by the way. This outdated password guideline doesn't seem to die. I know way to many cases where people are using a weak base password with a number attached to it because they got sick of trying to remember a new password every month.
> The same is true for forcing users to reset their password every 50 days or so, by the way. This outdated password guideline doesn't seem to die. I know way to many cases where people are using a weak base password with a number attached to it because they got sick of trying to remember a new password every month.
there are people who actually invent a new password every time instead of cycling numbers?
also, change password a few times until history is flushed and switch back to the same password you started with is a thing.
SSO is more than password management. It is instant provisioning and deprovisioning of users. Role management and auditing. Enforcement of security standards like 2FA in a central place.
Not really relevant for the specific topic, but to be more precise, SSO is only the sign on part. Usually the provisioning/de-provisioning is handled by SCIM, which is related but distinct. You have some SaaS products that offer SSO but not SCIM, for example.
Sorry, I should have been more clear. When I typed SaaS products I meant more about a non-IDP product. They might support SSO but not SCIM-based account provisioning, especially if it's in-house auth (not using something like Auth0). I worked on a product that supported SSO but not SCIM for a long time and not all SCIM features were supported.
I've used Okta to provide gateway access to physical devices and AWS roles in the same deployment. Very impressive when every endpoint and SaaS product is behind a single 2FA login.
Or if you're setting up a SaaS application where some of your customers will want integration with their own SSO. We don't have developer time to spare implementing that sort of thing but Auth0 lets us do it as one of its built-in integrations.
It lets us offer SSO with whatever Auth0 supports as a freebie add-on, instead of "well, we could work with your platform but it's gonna cost you."
I don't see how it's a trap, except that we have to pay auth0 a monthly fee to handle our authentications instead of having some number of hours a month spent maintaining and securing our customers' logins and integrations.
i don't think anyone would deny that third party logins are convenient -- either from the user perspective or from the developer perspective. but they are also a huge vector for privacy-invasive ad-profiling, if that's the login provider's business model.
that is true, but that is virtually always because of password re-use. if you use a password manager and randomly-generated passwords unique to each service, this is almost entirely mitigated.
with a single third party login for all services, though, if that third party account gets compromised the results are catastrophic.
> with a single third party login for all services, though, if that third party account gets compromised the results are catastrophic.
The same can be said of the password manager account. It's turtles all the way down.
The fact that we rely on users to not reuse passwords, the fact that using a password manager is all but required to get reasonable security despite being far from convenient, these indicate a major failure to serve the actual needs of users, in my view.
Users have head space for 1-3 strong passwords. They can tolerate carrying maybe 1 security token with them. They can tolerate a little bit of security setup when using a new device for the first time, and they can tolerate a touch or fingerprint scan at authentication time. All authentication systems can and should operate within these parameters.
No web site or app outside of an authentication provider should ever present a user a screen asking them to pick a strong password that they have never used before. That is asking a user to do something that the human brain cannot reasonably do for 99% of the population. At best, a browser or password manager will intervene at that point and pick the password for them. At worst, the user ignores the warning and picks the same password they use for everything else.
> The same can be said of the password manager account. It's turtles all the way down.
What password manager account, what are you talking about? There is never any password manager account, yes, I have heard that some weird people are synchronizing their passwords to some strange 3rd party services but those don't matter. You have one password. Encryption password for login database and that one is local and never transmitted over the internet. If you know a password manager that provides this decryption password to their servers, please open the topic here and they will be bashed to hell for this.
I am a tad more strange, my password manager is synchronized with my sftp server using private key and I am not only randomizing the passwords for each site but also the email address (imagine sha(user+salt) + delimiter + sha(domain + master password)@mydomain.com). And I will never in my life use any SSO as they are mostly spyware designed for tracking users across the sites and certainly not for what they are advertised for. They will break with firefox latest addition? FINE! At least people will stop using them.
One thing are companies self hosted SSOs. Sure, I can trust those for company services. For anything else, like "login with google" or "login with facebook"? Yeah right, my hearth is jumping out of joy and barely waits to use it. It actually works in reverse, if you dont allow me to register using non SSO account (email, password) I wont use your service/webpage/whatever.
It doesn't for corporate usage... having to create accounts for every new employee on every service you use, and then remove those accounts when someone leaves is not scalable. Having SSO is needed.
I use 1Password (and the browser extension) for all my passwords, but I still choose "Sign-in with Google" when that's an option.
The "Sign-in with Google" button is makes it much quicker to create an account and slightly quicker to log in.
Also, I can rely on my Google 2FA rather than setting up and filling in a different TOTP for each site. Something like U2F or WebAuthn would make the filling-in part more convenient, but even sites that offer 2FA usually don't offer those. (And many sites don't even offer 2FA.)
Using 1Password's 2FA feature would make TOTP more convenient, but I'm a little nervous about putting 2FA in 1Password. This might be overly-conservative thinking, though.
I agree it can be super convenient, though 'Sign in with Google' is totally broken for me, because I've accumulated a handful of google accounts.
Every time I log in to a service, I have to guess which account it's associated with (bearing in mind I may have signed up years ago). And if I'm wrong, half the time it immediately attempts to create a new account, and then I'm stuck with a bunch of empty dummy accounts on various services.
> Don't use [third-party login providers], it's a trap.
Pretty hard to avoid in many cases. Logging in to your Microsoft account for Office (Teams, Outlook, et al.) uses a login service, as does Google, and practically all services that span across multiple domains. Which includes all of the major ones, at this point.
Good that Firefox gives us this option, given how the web has evolved!
the most aggravating trend Firefox jumped on was making the option to allow-list cookies a byzantine and infuriating process from what it used to be.
If you want to reject all cookies and allow-list only a handful of sites, youll need to go into privacy settings and choose a "custom" option to reject all cookies. presumably you're knowledgeable if youre here but if not, theres a scary warning that tells you doing this will "cause websites to break." Once thats done, reload your tabs and realize that if you choose "allow all cookies" at a later date, switching back to the "custom" setting doesnt return you to your former "block all cookies," just the watery default of blocking some cookies.
now if you want to allow-list a site, good luck. You cant use add-ons to do it and theres no menu option to quickly accomplish this anymore. open your settings again, under privacy, and custom settings again, and youre faced with a form to enter your new site. once you add the site to the list, you must hit save. Yes, the site is in the list now, but unless you hit save, you didnt add it.
Now arguably firefox cracked down on cookie block/allow capability at the behest of google and advertisers some years ago but to see them doubling back on the cookie issue --not to fix the blocklist feature but to nanny-state your cookie preferences even further-- is a real slap in the face.
stop tip toeing around the issue to appease advertisers. Let us block what we want to quickly and easily.
Other than this is how cookies should have worked from the get-go, I have a question/scenario:
1. User visits site-a.com, which sets a cookie containing 'ThisIsUser9'
2. site-a.com also rewrites every external URL on the page, with a new param '&adtrack=ThisIsUser9'
3. User clicks on external link on site-a.com and goes to site-b.com
4. site-b.com's server sees the adtrack param on the end of the URL and sets a cookie 'ThisIsUser9' and also adds the adtrack param to all external URLs on the returned page.
5. Advertising company works with site-a and site-b (and many many other sites) to build up a persistent profile of your browsing habits.
We can't stop this, even with this new FF cookie isolation. Those of us who care will install an extension to strip known trackers from all URLs, and 90% of all other web users, will still be tracked as usual.
I can at least SEE that siteA passes my information to siteB. Or at least that it passes something (e.g. a huge base64 chunk in the url). That's a big step forward. I can also block the referrer headers so it's not visible in siteA url itself. If I want to navigate from SiteA to SiteB and the url doesn't look "expected", I can choose to not click it. Tracking that only takes place in URLS and only when I click things, isn't nearly as scary or problematic as cookies.
There is a solution, but it's somewhat clumsy compared to just right-click, "Open in new tab / window": Right-click, "Copy URL", paste into a text editor, remove any suspicious bits, copy what's left, go back to the browser, open a new tab / window, paste in your sanitized URL.
No, I don't think anyone does that with every damn link. I sure don't.
I preferred chrome cookie control over Firefox after switching. (I have had to compromise with umatrix to fill this feature gap.) Very granular control for each cookie where a cookie can be allowed, temporary, or blocked.
I went through my entire list of cookies once, 400 at least and started perma blocking all those I didn’t recognize. It was beautiful. I can’t do the same in Firefox.
I’m not feeling very good about this move where third party cookies are isolated by website. There are lots of websites separated across multiple domain names sometimes unrelated. (Sharepoint, office 365) they will have difficulty.
And then there are special login websites and others like dish network telling CNN you have a subscription with them.
This breaks. And creates a predetermined list of who can do what.
> I went through my entire list of cookies once, 400 at least and started perma blocking all those I didn’t recognize. It was beautiful. I can’t do the same in Firefox.
If I understand your description correctly, you can definitely do this in Firefox also. Preferences/Privacy & Security/Cookies and Site Data.
> I went through my entire list of cookies once, 400 at least and started perma blocking all those I didn’t recognize. It was beautiful. I can’t do the same in Firefox.
I did this in Firefox before Chrome was even a thing. This has been supported natively without add-ons since at least 3.5, if not even earlier.
That would be under "Cookies and Site Data". There are two options: Manage cookies (which only give option to remove cookies) and Manage Exception (which require you to manually add domain names. This is not usable for massive cookie block list.
That would be under "Cookies and Site Data". There are two options: Manage cookies (which only give option to remove cookies) and Manage Exception (which require you to manually add domain names. This is not usable for massive cookie block list.
439 comments
[ 4.1 ms ] story [ 315 ms ] threadwhy this is not the default behavior already?
In my case, I strip all cookies and sensitive headers. One must keep in mind that the browser will treat it as a first-party request and the security implications that has. You may have to filter or modify cookies/headers.
https://jeremypoole.ca/posts/protecting_api_keys_on_the_fron...
This is making them have to allocate resources to achieve the same effect. Like taking lojack off of your car and phone, and making 'Them' have to tail you and scour security footage like in the old days. It's more expensive. Expensive things do not scale, so you have to prioritize who is worth the cost. People who are under legitimate suspicion of causing harm. Less 'by-catch' to use a commercial fishing concept.
When it's cheap to harass everyone, nobody is 'safe'. But when terrorists can't be tracked at all, nobody is 'safe' either. So we have checks and balances.
When people need to keep a door open, if they don't see a doorstop in the immediate vicinity after two seconds of looking, some will just use whatever heavy object that is closest and consider the problem 'solved' instead of managed.
I needed data, I didn't know where to put it, this thing can give me data, boom, solved.
SSO via OAuth still works fine, because OAuth uses redirects instead of cookies.
With shared cookies nothing stops site A from taking a copy of your cookie and using it to impersonate you on site B. With redirect based login the identity provider has to authorize each application that is being accessed and each site has its own session cookies.
The main problem is dealing with globally revoking access but that's usually solved with shorter termed session cookies that periodically need to be refreshed from the identity provider.
To be honest though, browser fingerprinting makes this mostly irrelevant unless you carefully use a script blocker with a whitelist too. Any domain that includes trackers that drop third party cookies almost certainly includes scripts that can fingerprint you and send results to a server without using a third party cookie.
Here's a reference to a F5 device providing SAML SSO services and having a similar issue:
https://www.devcentral.f5.com/s/question/0D51T00007npfjw/chr...
> since we cannot discount the possibility of malicious users programatically generating tokens and forcing them upon users, we check the referer header to ensure that the request chain was initiated in the one place that we're comfortable with: id.atlassian.com
Make of that what you will.
If they had used the same domain for their products historically and just separate subdomains they wouldn't have to make this trade off, but it probably also helps with third-party ad networks/segmentation to get folks to turn it on anyways.
Solving a problem isn't irrelevant just because there are other problems; there's definitely more to do, but this still has value.
For one thing it means they're locked to my session.
By that logic, we should turn off our computers to improve security.
Good. Disqus had it too easy.
>> It also going to break [..]
Good. They had it too easy.
I'm absolutely loving the fact that my switch to Firefox is paying off. Finally!
Good. They had it too easy. I'd pay $20 for clean version of FFX on Mac/iOS App Store.
Thank Microsoft, Google and Apple for that.
This seems to indicates there's not faster alternatives around anymore, but the last time I tried FF (4-6 months ago) I couldn't make the transition because the lag was pretty obvious when coming from Chrome based browsers. Is this not the case anymore?
I've used Firefox since 2006, and Chrome always seemed heavier, laggier and uglier. Maybe it's the snappy iOS-like animation when you scroll to the bottom of the page that makes it seem snappier?
I still used Firefox a lot for various reasons (and still do), but I'm not blind to how it performed.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1595998 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1415923 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1489785
The stumbling block for me as FireFox user is I am increasingly bumping into web apps that preform poorly in FF but are fine in Chrome for one reason or another. One instance I bump into a lot is ElasticSearches Kibana runs like trash in FF for some reason.
Whether or not the Google programmers use specific proprietary knowledge about the behavior of Chrome to optimize performance is different. If they do, that would be similar to the things that got Microsoft in trouble.
https://tech.co/news/google-slowed-youtube-firefox-edge-2019...
https://www.techspot.com/news/79672-google-accused-sabotagin...
https://www.zdnet.com/article/former-mozilla-exec-google-has...
Google knows that every time they release a Firefox bug, FF's user percentage goes down a tiny bit. Repeat over dozens of bugs, for years, and you have a strategy.
There's one blog post from another Mozillian that I can't find anywhere that came out within the last year with other examples, I think it was on HN.
You are looking for https://web.archive.org/web/20180728122724if_/https://twitte...
I use Brave + Ublock exclusively.
Brave and uBO share filter tech and we aim to make uBO unnecessary (this may require setting shields to aggressive). We do much more than any extension can do, and Google has made it clear they will further restrict extension APIs.
https://www.theregister.com/2019/05/29/google_webrequest_api...
https://brave.com/privacy-updates-7/ (latest in series)
I feel that most people complaining about slow browsers have no blocker installed.
I really want Firefox to work for me and I'd love to drop Chrome, but last time FF made big noise about performance improvements I tried it out and Gmail was still unusably slow.
I even use it on my phone. The mobile version is definitely worse than Chrome, but it has plugins (or it used to! nowadays it only support a few popular ones which is a shame) and also I can send tabs from my phone to my computer (which is a better place to read articles anyways).
For me, the way Google is keeping Gmail terrible for other browsers is exactly the reason to not use Chrome. No way I'm OK with that.
I didn't find noticeable difference between FF and Chrome based browsers(Vivaldi, Edge) on macOS(although Safari runs circles around them) after using them extensively. I used each of them for a separate project with several common websites loaded in them, there were different quirks for each browser(especially reg tab hibernation) but latency was not one of them.
On Linux FF seems definitely faster than Chromium, although there are occasional DNS errors which stops loading the web pages altogether(likely result of my own doing). I've stopped having different browsers for different projects and just use FF for all.
On Android with Chrome, not just Chrome but even WebView using it is astonishingly fast(e.g. DDG browser), I presume it's because of data saver feature. On de-googled android like LineageOS, FF/Fennec seems to be on same level as Chromium and DDG is faster here as well.
On iOS, everything is Safari.
I don't use Windows much, but I've seen others mentioning Edge seems to be faster than Chrome recently.
Except on Facebook. My Facebook tab is incredibly laggy, and gets more and more laggy the longer I leave it open. I'm one of those users that tends to keep 50+ tabs open, and I have to close and reopen the Facebook tab at least once a day to keep it from becoming a nearly frozen mess. Even then, if a video is playing and I click it to make it fill the window, it takes several seconds for it to happen. And with an i9-9900K, 32 GB of RAM, RTX 3080, and a 1 TB NVMe drive, my computer is definitely no slouch.
In a way I see it as a win, I really really hate opening it on desktop.
One big advantage is that I now have way more addons installed on Firefox that would otherwise make Chrome utterly slow and unusable.
I find the majority of their privacy claims dubious and dangerously misleading for those that don't know any better. If they were serious about privacy they'd offer uBlock Origin (or equivalent functionality) preinstalled by default.
Their current countermeasures such as containers, tracking protection and this cookie thing is trivial to bypass with browser fingerprinting and IP address tracking if you have a global view of the Internet (which Facebook and Google do have).
Are there any other config changes you would recommend to Firefox to harden it?
I haven't experienced this since the rapid release schedule started. They're pretty silent now.
https://discover.buysellads.com/firefox-new-tab
"neither Mozilla nor Pocket ever receives a copy of your browser history. When personalization does occur, recommendations rely on a process of story sorting and filtering that happens locally in your personal copy of Firefox."
https://help.getpocket.com/article/1142-firefox-new-tab-reco...
I get you about the updates. It's a risk-reward ratio I accept because firefox + noscript + always starting in a private session is way more helpful than the update problem is harmful. Using a VPN a lot of the time helps, too. There is no solution I know of that is perfect. My threat model is pretty relaxed, though, so what I do is mostly for my peace of mind. You have reminded me that I should start spoofing my user agent again.
But it is extremely misleading for them to be shouting "privacy" at every opportunity while the truth is that their browser leaks personal data like a sieve in the default configuration. This would give a false sense of security to non-technical people who don't have the skills to see through these lies.
Sorry for the somewhat angry comment, but I honestly can’t understand this mentality.
I'm not saying Chrome is any better, but at least Chrome doesn't toot the "privacy" horn at every opportunity.
Brave does have some kind of blocker built-in which might actually help even if it's not perfect.
My company only officially supports Chrome. Why? Because most users only browse via chrome. Why? Because my company only officially supports chrome…
And what's the migration path for users who have been using that setting previously?
Can I now disable it? Do I have to disable it?
It's google. I'm talking about google.
Not on iOS
1) One of my local banks (who use weird third-party hosted modules for some of their functionality).
2) Verizon.
3) T-Mobile
If I were a normal user, any one of these ("I have to do _what_ to see my FIOS bill?") could be a show-stopper.
Which is what makes it hard to turn this on by default without driving away users.
This thread contains plenty of examples of legitimate uses for third-party cookies. If FF instantly and immediately broke those, users would be cursing, not praising Firefox, and switching to a browser that doesn't break what they use.
Historically getting some browsers on board with that program has been very difficult.
Concretely: a large fraction of website developers would much rather put up "only works in Chrome" notices than fix their crap.
[Disclaimer: I used to work at Mozilla, and have done my share of trying to push for turning off third-party cookies.]
A lot of websites depends on this via auth0, cloud identity, cognito... and the experience becomes subtly broken in a way that you need to be extremely technically savvy (a developer that has a whole lot of auth experience) to understand.
Another example is you're signed into website A, and while on website B, iframes to website A behave in such a way that you're not signed in, and you cannot sign in.
This is because the download is from googleusercontent.com while your browser remains at drive.google.com the whole time - and to download private files, googleusercontent.com expects you to have a login cookie. If you block third-party cookies the download gets stuck in a redirect loop, sending you to get a cookie over and over again.
Google is aware of this but hasn't fixed it.
E: Hey use Firefox!
O: OK, I'll give it a try!
O: Hey, why doesn't X site work properly with Firefox?
Firefox: Introduces something making it more likely that another site doesn't work
O: Hey, now Y site doesn't work either!
E: Hey, just wait a second you can-
O: Sorry, I don't have time for this, I'm switching back to Chrome.
IMHO - Firefox's #1 priority should be making sure every site in the the first 10,000 of Alexa work equally as well with Firefox as it does with Chrome, period.
What good is amazing privacy stuff if your userbase is rapidly dwindling?
list of sites that don't work (many, if not most of these work on Chrome without issue):
https://webcompat.com/issues?page=1&per_page=50&state=open&s...
Even GSuite works better for me in Firefox. Slides stays smooth even when scrolling through large presentations and it never locks up (like Chrome does).
It's still very minor and I can't even come up with a 2nd example off the top of my head but it does definitely happen from time to time.
If anything these few cases only makes me value Firefox even more, I don't want to enable the Chrome monopoly.
firefox doesn't exist to "win" the browser wars. it doesn't even exist to give users the best possible browsing experience, although that's certainly a primary goal and in my experience they're doing well.
the #1 reason that firefox exists is so that mozilla can have a seat at the WHATWG table -- because very important decisions about the fabric of the world wide web happen there, and the other seats all belong to apple, google, and microsoft.
mozilla is the closest thing we (the users -- not just firefox users, but all web users) have to a "representative" in the WHATWG, because mozilla doesn't answer to shareholders.
> What good is amazing privacy stuff if your userbase is rapidly dwindling?
aside from a noticeable dip when the new chromium-edge started shipping with windows, firefox browser usage on desktop has been pretty steady for the past 5 years.
the value in adding privacy features is that it solidifies a certain use of the protocols, making it harder for WHATWG to make spec changes that undermine the provided security.
https://www.cookiestatus.com/
I don't think it's been updated yet for this new Firefox feature.
> In addition, Total Cookie Protection makes a limited exception for cross-site cookies when they are needed for non-tracking purposes, such as those used by popular third-party login providers. Only when Total Cookie Protection detects that you intend to use a provider, will it give that provider permission to use a cross-site cookie specifically for the site you’re currently visiting. Such momentary exceptions allow for strong privacy protection without affecting your browsing experience.
That's exactly why I have to toggle it. Anyone that uses auth0, and many publications sites (follow a link to a PDF, get redirected to `/cookie-absent` instead) fall foul.
Similarly the OpenID Connect Session Management feature (check_session_iframe) also depends on the ability to use third party cookies.
This functionality is needed to be able to detect if user logged out from front-end code without relying on having any back end code that could receive either a front-channel or back-channel signout notification and send it back.
In the absence of that a pure SPA with no backend could only detect the logout if access tokens are stateful, and they get an error message back that the token refers to an ended session.
Some people get really cranky if a single sign out feature does not actually sign you out of everything.
Forgive me ... do I understand that there is a true/false setting in Firefox named "privacy.firstparty.isolate" that you like to toggle from time to time ... and you use an extension to do that ?
I don't do much browser customization and use only one extension (uBlock Origin) but ... couldn't I toggle a single Firefox setting with a simple command line ?
Why would you need an extension to do that ?
Genuinely curious ...
On startup it's enabled (i.e. do isolate) via a config file, so I could change it there with a shell script. I think though that I'd have to restart Firefox for it to take effect.
The extension gives me a handy button in the toolbar that's red (danger) when it's off (i.e. not isolating) that I can just click to toggle.
Yes it's a tiny job for an extension, but do one thing well right? Also, to be honest, it's easier that it's there than switching to or pulling up a new shell.
Afk to confirm, but pretty sure this is the one I use: https://github.com/mozfreddyb/webext-firstpartyisolation
I use containers for sites like AWS where it doesn't understand the concept that I might want to switch regions or accounts but only in some tabs so that I can work on multiple parts of the network.
This obviously does nothing for that.
Containers makes this a breeze.
In addition, at least Firefox only has a single private session. So if I open a site in one private window and another in a different one, they're in the same session, sharing cookies etc. Not so with different containers.
I don't understand why fixing profiles isn't a priority, I find the usecase for them is completely different to containers which are awesome in a completely different way.
All my YouTube views are firmly disassociated from my account, so recommendations will only be impacted based on geographic data. News sites can't remember if I've been there before, other than using IP addresses.
Or will it take regulations to remove targeted ads?
OTOH on-premises ads, like inside Facebook, or on Google's results page, should remain pretty targeted.
At least cookies give you some control. The alternative seems worse.
/j
Would be great to have some more details about it: in particular, how do I turn it off if I prefer to add any exceptions manually.
Edit 1: Mozilla Hacks blog [1] has a bit more but still doesn't answer the question:
> In order to resolve these compatibility issues of State Partitioning, we allow the state to be unpartitioned in certain cases. When unpartitioning is taking effect, we will stop using double-keying and revert the ordinary (first-party) key.
What are these "certain cases?"
Edit 2: Reading on, there's this bit about storage access grants heuristics [2] linked from the blog. But is that really it, or is there a hardcoded whitelist as well? If so, it'd be great to see it.
This bit in particular is ambiguous in how it's supposed to work exactly (who's "we" here):
> If we discover that an origin is abusing this heuristic to gain tracking access, that origin will have the additional requirement that it must have received user interaction as a first party within the past 30 days.
1. https://hacks.mozilla.org/2021/02/introducing-state-partitio...
2. https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Pri...
(on mac) Firefox > Preferences > Privacy & Security > Custom
Your answer seems to be about how to turn off "Enhanced Tracking Protection"/"Total Cookie Protection" or parts of it (resulting in weaker protection). I want to keep it enabled and disable the exceptions (for stronger protection), i.e. the opposite.
I haven't installed the new version yet, so can't say for sure, but as far as I know there is no setting for this in that menu. [1]
If I misunderstood what you meant, please elaborate.
1. https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...
I've been a FPI user for years as a best-effort to reign in tracking but there are a common few sites that just break with FPI (50% of the time PayPal checkout doesn't work). Even if "Total Cookie Protection" is only 98% as effective as FPI, I'm making the switch.
EDIT: FPI = first-party isolation
https://www.ctrl.blog/entry/firefox-fpi.html
Given Firefoxs low adoption, I fear that website owner will just ignore that their excessive tracking breaks their site in Firefox... “Works in Chrome... good enough”
This is a great question and I’m glad you found the answer, you probably understand that for many blog posts we avoid going into too much technical detail.
To answer your final question, there is no hardcoded allow-list for State Partitioning. The heuristics as described on MDN are accurate.
I guess that clears it up.
I don't see why we can have full-blown web apps but our text needs to be very specifically just text these days.
If you want to be listed as an author, just drop over to https://github.com/withinboredom/expounder-wordpress/tree/ma... and let me know your wordpress.org user names in an issue.
Thanks again for your help!
If I were reading a technical text, I would definitely end up reading most paragraphs at least twice. It would make no sense to keep the expounded terms in the second time; I'd be tempted to hide them back as soon as I was finished with them the first time.
https://github.com/skorokithakis/expounder/blob/master/examp...
It's because, once clicked, the new text should become part of the old, and that's it. Presumably you've already read it, and I don't want to make the viewer have to re-collapse the links every time.
Your use case makes sense, though, which is why the feature was included. Maybe I should mention it in the README.
The author's intent here is to have terms explained in the text explicitly in such a way that it would 'augment' the text with an explanation somewhere further down the line, but not necessarily "in-place".
It is also intended for text specifically, rather than replacing one element with another.
I agree that display/summary are similar in spirit though, I had not come across those before.
I've only recently discovered that Markdown has footnotes, and I've gone to down adding footnotes everywhere.
I use Jekyll + markdown on my website, and I now have lots of fun adding footnotes to my writing.
I added a "footnote tutorial" for readers on https://josh.works/turing-backend-prep-01-intro#why-this-rub..., to help them learn how to navigate the footnotes.
I _love_ your library, and I love the problem that you're solving with it.
Along the way, I've looked at Gwern's sidenotes[0] and Nate Berkapec's "footnotes"/sidenotes [1].
I eventually want to do something more "in-line", like what you've down with Expounder, but I've been satiated with markdown footnotes for now.
[0]: https://www.gwern.net/Sidenotes# [1]: https://www.nateberkopec.com/blog/2017/03/10/how-i-made-self...
From the demo it look as if Expounder is one-way - once you've expanded something, you can't collapse it again. Is that correct?
https://news.ycombinator.com/item?id=26238717
Thank you so much for posting gwern’s sidenote article! I want to use sidenotes on my site and this was a very valuable resource!
I am more ennoyed by how the jump points are turned into a useless feature by so many javascript out there which load new content without impacting the browsing history.
But I see there is a css class which is nice.
Just a simple rgba(x,x,x,0.5) where the x’s are the usual yellow height.
Mozilla who? That’s where we are now.
Be it topographic emphasize or coloring, there should be an hint. And clicking the text thus emphasized should collapse it.
That's my opinion, otherwise, nice done.
https://www.feynmanlectures.caltech.edu/III_21.html
Not really... for a highly technical issue like this, at a minimum you should link to the technical details.
There really is no excuse for making every reader of your blog who wants to know the details dig for them independently.
imo, at least.
Would be great to know how are those concerns handled?
If cookies from another bucket should be shared with other sites, or might be seen when requested by a cross-site load from another site, ask the user a four choice question.
"Allow (site) to see cookies from (site)?"
Always Allow, Just this time, Ask later, Always Deny
Facebook and Google will be excepted? This makes it a joke, sadly.
This move is aimed at killing other AdTech companies which rely on 3rd party cookies to track users.
They painting this as a 'PRIVACY' move, after they have already found other ways of tracking users across websites and devices.
It's not particularly fun to implement. It's not hard, but the heuristics are enough of a nudge that it can create weird experiences for users.
"I thought I already signed in, but after I navigate, I have to click sign in again, and a window pops up and then I'm automatically signed in? Why?"
Edit: Yeah, seems so.
https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Pri...
See also: https://webkit.org/blog/8124/introducing-storage-access-api/
This should have always been the only way it worked. Every website should run like if it was opened in a separate browser.
> third-party login providers
Don't use these, it's a trap.
Except if you're setting up SSO for your company's employees. Using a 3rd party login provider is a necessity. You shouldn't trust employees to create unique / strong passwords for every individual service they login to.
But SSO centralizes access management. For instance, with one switch I can set password requirements, require 2FA, and grant/revoke access to all of an employee's services when they join the company or leave.
SSO is a must in any big organisation, there are tens or hundred of applications.
People are incredibly and consistently bad with security. You really need a way to be able to cancel all accesses in one swoop for any individual.
The same is true for forcing users to reset their password every 50 days or so, by the way. This outdated password guideline doesn't seem to die. I know way to many cases where people are using a weak base password with a number attached to it because they got sick of trying to remember a new password every month.
there are people who actually invent a new password every time instead of cycling numbers?
also, change password a few times until history is flushed and switch back to the same password you started with is a thing.
Where can I learn about best SSO practice/implementation?
It lets us offer SSO with whatever Auth0 supports as a freebie add-on, instead of "well, we could work with your platform but it's gonna cost you."
I don't see how it's a trap, except that we have to pay auth0 a monthly fee to handle our authentications instead of having some number of hours a month spent maintaining and securing our customers' logins and integrations.
with a single third party login for all services, though, if that third party account gets compromised the results are catastrophic.
The same can be said of the password manager account. It's turtles all the way down.
The fact that we rely on users to not reuse passwords, the fact that using a password manager is all but required to get reasonable security despite being far from convenient, these indicate a major failure to serve the actual needs of users, in my view.
Users have head space for 1-3 strong passwords. They can tolerate carrying maybe 1 security token with them. They can tolerate a little bit of security setup when using a new device for the first time, and they can tolerate a touch or fingerprint scan at authentication time. All authentication systems can and should operate within these parameters.
No web site or app outside of an authentication provider should ever present a user a screen asking them to pick a strong password that they have never used before. That is asking a user to do something that the human brain cannot reasonably do for 99% of the population. At best, a browser or password manager will intervene at that point and pick the password for them. At worst, the user ignores the warning and picks the same password they use for everything else.
What password manager account, what are you talking about? There is never any password manager account, yes, I have heard that some weird people are synchronizing their passwords to some strange 3rd party services but those don't matter. You have one password. Encryption password for login database and that one is local and never transmitted over the internet. If you know a password manager that provides this decryption password to their servers, please open the topic here and they will be bashed to hell for this.
I am a tad more strange, my password manager is synchronized with my sftp server using private key and I am not only randomizing the passwords for each site but also the email address (imagine sha(user+salt) + delimiter + sha(domain + master password)@mydomain.com). And I will never in my life use any SSO as they are mostly spyware designed for tracking users across the sites and certainly not for what they are advertised for. They will break with firefox latest addition? FINE! At least people will stop using them.
One thing are companies self hosted SSOs. Sure, I can trust those for company services. For anything else, like "login with google" or "login with facebook"? Yeah right, my hearth is jumping out of joy and barely waits to use it. It actually works in reverse, if you dont allow me to register using non SSO account (email, password) I wont use your service/webpage/whatever.
Do they actually do this? Also don't most of the big ones allow you to opt-out of personalized ads.
I like this because it's easier to have strong 2FA with backup codes on a few well protected accounts, than to do it for every tiny site.
The "Sign-in with Google" button is makes it much quicker to create an account and slightly quicker to log in.
Also, I can rely on my Google 2FA rather than setting up and filling in a different TOTP for each site. Something like U2F or WebAuthn would make the filling-in part more convenient, but even sites that offer 2FA usually don't offer those. (And many sites don't even offer 2FA.)
Using 1Password's 2FA feature would make TOTP more convenient, but I'm a little nervous about putting 2FA in 1Password. This might be overly-conservative thinking, though.
Every time I log in to a service, I have to guess which account it's associated with (bearing in mind I may have signed up years ago). And if I'm wrong, half the time it immediately attempts to create a new account, and then I'm stuck with a bunch of empty dummy accounts on various services.
Pretty hard to avoid in many cases. Logging in to your Microsoft account for Office (Teams, Outlook, et al.) uses a login service, as does Google, and practically all services that span across multiple domains. Which includes all of the major ones, at this point.
Good that Firefox gives us this option, given how the web has evolved!
> This should have always been the only way it worked. Every website should run like if it was opened in a separate browser.
FYI: Extension "Temporary Containers" does this: https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
If you want to reject all cookies and allow-list only a handful of sites, youll need to go into privacy settings and choose a "custom" option to reject all cookies. presumably you're knowledgeable if youre here but if not, theres a scary warning that tells you doing this will "cause websites to break." Once thats done, reload your tabs and realize that if you choose "allow all cookies" at a later date, switching back to the "custom" setting doesnt return you to your former "block all cookies," just the watery default of blocking some cookies.
now if you want to allow-list a site, good luck. You cant use add-ons to do it and theres no menu option to quickly accomplish this anymore. open your settings again, under privacy, and custom settings again, and youre faced with a form to enter your new site. once you add the site to the list, you must hit save. Yes, the site is in the list now, but unless you hit save, you didnt add it.
Now arguably firefox cracked down on cookie block/allow capability at the behest of google and advertisers some years ago but to see them doubling back on the cookie issue --not to fix the blocklist feature but to nanny-state your cookie preferences even further-- is a real slap in the face.
stop tip toeing around the issue to appease advertisers. Let us block what we want to quickly and easily.
1. User visits site-a.com, which sets a cookie containing 'ThisIsUser9'
2. site-a.com also rewrites every external URL on the page, with a new param '&adtrack=ThisIsUser9'
3. User clicks on external link on site-a.com and goes to site-b.com
4. site-b.com's server sees the adtrack param on the end of the URL and sets a cookie 'ThisIsUser9' and also adds the adtrack param to all external URLs on the returned page.
5. Advertising company works with site-a and site-b (and many many other sites) to build up a persistent profile of your browsing habits.
We can't stop this, even with this new FF cookie isolation. Those of us who care will install an extension to strip known trackers from all URLs, and 90% of all other web users, will still be tracked as usual.
Face it, the private web is lost. :(
most of the time I go direct to a URL by typing in the address bar
> Face it, the private web is lost.
this reads like marketing for Eric Schmidt https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmid...
I can at least SEE that siteA passes my information to siteB. Or at least that it passes something (e.g. a huge base64 chunk in the url). That's a big step forward. I can also block the referrer headers so it's not visible in siteA url itself. If I want to navigate from SiteA to SiteB and the url doesn't look "expected", I can choose to not click it. Tracking that only takes place in URLS and only when I click things, isn't nearly as scary or problematic as cookies.
No, I don't think anyone does that with every damn link. I sure don't.
I went through my entire list of cookies once, 400 at least and started perma blocking all those I didn’t recognize. It was beautiful. I can’t do the same in Firefox.
I’m not feeling very good about this move where third party cookies are isolated by website. There are lots of websites separated across multiple domain names sometimes unrelated. (Sharepoint, office 365) they will have difficulty.
And then there are special login websites and others like dish network telling CNN you have a subscription with them.
This breaks. And creates a predetermined list of who can do what.
If I understand your description correctly, you can definitely do this in Firefox also. Preferences/Privacy & Security/Cookies and Site Data.
I did this in Firefox before Chrome was even a thing. This has been supported natively without add-ons since at least 3.5, if not even earlier.
http://kb.mozillazine.org/Websites_report_cookies_are_disabl...