Firefox Rolls Out Total Cookie Protection By Default | The Mozilla Blog
blog.mozilla.org
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
  • ssm@lemmy.sdf.orgEnglish
    0·
    20 days ago

    Very good! Please remove anonym/PPA, DoH to cloudflare, Google search, telemetry, and pocket next, and I’ll make a consideration to stop calling your browser malware!

  • ArchRecord@lemm.eeEnglish
    0·
    20 days ago

    For those who don’t care to read the full article:

    This basically just confines any cookies generated on a page, to just that page.

    So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.

    • Liam Mayfair@lemmy.sdf.orgEnglish
      0·
      20 days ago

      Isn’t this basically Firefox’s version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?

      I mean, it’s good news either way but I just want to know if this is somehow different or better.

    • FiniteBanjo@lemmy.todayEnglish
      0·
      20 days ago

      Disabling cross site cookie is already a thing for decades…

      Same with Do Not Track requests.

      • ArchRecord@lemm.eeEnglish
        0·
        20 days ago

        Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.

        Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.

        • FiniteBanjo@lemmy.todayEnglish
          0·
          20 days ago

          Thank you for your explanation, tbat greatly clears up my confusion.

          TBH, if a person’s concern is being tracked by, for example, Facebook; then this just lets Facebook continue tracking them without directly allowing Facebook’s anaylitics customers to track them to another site directly (but indirectly that information can still be provided). But I guess for all the people giving FB and Google those proviledges better to have this than not.

      • sugar_in_your_tea@sh.itjust.worksEnglish
        0·
        20 days ago

        Do Not Track has never really done anything, it just asks websites politely to not track you. There’s no legal or technical limitation here.

        • FiniteBanjo@lemmy.todayEnglish
          0·
          20 days ago

          I still much rather have it than not. It also lead to the spiritual successor GPC which does actually have regulatory requirements under the CCPA.

      • The Quuuuuill@slrpnk.netEnglish
        0·
        20 days ago

        It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$

    • peopleproblems@lemmy.worldEnglish
      0·
      20 days ago

      Hahahahaha so it doesn’t break anything that still relies on cookies, but neuters the ability to share them.

      That’s awesome

      • FiniteBanjo@lemmy.todayEnglish
        0·
        20 days ago

        Unless that cookie was somehow important for you to use both sites, but thats incredibly rare.

      • ripcord@lemmy.worldEnglish
        0·
        20 days ago

        Honestly, I thought that’s how it already worked.

        Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.

        But some asshole sites like Facebook are making them world-readable for tracking, and this breaks that.

        • ArchRecord@lemm.eeEnglish
          0·
          20 days ago

          Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.

          They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)

          This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.

          • ripcord@lemmy.worldEnglish
            0·
            20 days ago

            That’s not what I was thinking of, which was even more fundamental. But that’s good info (and another way to cover stuff in the article).

            Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren’t allowed at all. Which was really dumb since of course they are.

            • catloaf@lemm.eeEnglish
              0·
              20 days ago

              No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.

              But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.

              With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.

              Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.

        • Telorand@reddthat.comEnglish
          0·
          20 days ago

          They’ve been doing this with container tabs, so this must be the successor to that idea (I’m going to assume they’ll still have container tabs).

          • jollyrogue@lemmy.mlEnglish
            0·
            20 days ago

            Container tabs are still a thing in FF. This is based on that work, if I remember correctly.

              • Kushan@lemmy.worldEnglish
                0·
                20 days ago

                Same, they’re an absolute game changer for me. I have to use multiple different identities in work due to separate active directories and container tabs makes it super easy

          • snaggen@programming.devEnglish
            0·
            20 days ago

            Container tabs are still useful, as they let you use multiple Cookie jars for the same site. So, it is very easy to have multiple accounts on s site.

      • Buddahriffic@lemmy.worldEnglish
        0·
        19 days ago

        From my experience, blocking 3rd party cookies in general doesn’t seem to make any difference for site functionality anyways. Though I never log into sites with a Google or FB account other than Google or FB sites (and rarely at all for the latter).

  • Kairos@lemmy.todayEnglish
    0·
    20 days ago

    Let me guess, itll still let websites see a list connected microphones and cameras with zero user interaction?

    • Blackmist@feddit.ukEnglish
      0·
      20 days ago

      Trying

      navigator.mediaDevices.enumerateDevices()
.then(function(devices) {
  devices.forEach(function(device) {
    console.log(device.kind + ": " + device.label +
            " id = " + device.deviceId);
  });
})

      it appears to have no label and the ids are randomly generated per site.

    • Billegh@lemmy.worldEnglish
      0·
      20 days ago

      A little. If a third party cookie is set while you’re visiting a site, only that site will get the third party cookie back. Multiple sites can have embedded content making third party cookies, and with this change firefox will track where it was made and only give it back there.

      With this change, it doesn’t matter if it’s first or third or whatever; cookies will only be given back to a site that matches much of what is in your location bar.

  • Cosmicomical@lemmy.worldEnglish
    0·
    20 days ago

    Does this stop me from adding to my website an iframe to facebook where facebook can keep its cookies for my user? That would be great but I doubt it.

    • Dran@lemmy.worldEnglish
      0·
      20 days ago

      Oracle, SAP, Redhat, all of their customer portals require it for SSO. I’m not saying it should be that way, but it is.

  • TCB13@lemmy.worldEnglish
    0·
    19 days ago

    making Firefox the most private and secure major browser

    If calling home and to selected 3rd party analytics aren’t part of the metric then yes, Firefox might be the most private.

    Just move to LibreWolf.

    • Doug7070@lemmy.worldEnglish
      0·
      19 days ago

      You’re aware that LibreWolf is a Firefox fork, right? The quote is literally “major browser”, which obviously precludes fairly niche forks.

      • TCB13@lemmy.worldEnglish
        0·
        19 days ago

        Of course I am… and that’s the point. Librewolf is Firefox without the spyware.

        • Doug7070@lemmy.worldEnglish
          0·
          17 days ago

          But it’s not a “major browser.” It’s a niche fork that has valuable adjustments for power users, but would be unusable for your average non-technically inclined user. I use Librewolf myself and appreciate it, but it’s not something you can just drop on an older relative’s machine and expect to work fine. Firefox has plenty of issues out of the box with sneaking in ads and telemetry, but at the same time you still have to understand that it’s an important player in the market despite its flaws because it’s the only real mainstream competitor to an entirely Chromium-based ecosystem, and despite the issues it does have, it’s still lightyears ahead of Chrome.

  • calcopiritus@lemmy.worldEnglish
    0·
    19 days ago

    Does making it the default also set it on my already-downloaded Firefox or only to new downloads? Just to know if I’ll have to manually set it.

    • FiskFisk33@startrek.websiteEnglish
      0·
      19 days ago

      It very probably wont change your settings for you. That would be super annoying if it changed things you set on purpose.

      • calcopiritus@lemmy.worldEnglish
        0·
        19 days ago

        What if I never changed it in the first place. So before I had it on “default” and now it would still be on “default”.

        Good to know anyway

  • bitjunkie@lemmy.worldEnglish
    0·
    19 days ago

    I’m curious how this will affect OAuth (if at all). Does it use an offsite cookie to remember the session, or is that only created after it redirects back to the site that initiated the login?

    • version_unsorted@lemm.eeEnglish
      0·
      18 days ago

      I my experience it generally breaks it. Leveraging cookies on the auth domain is fine, but once you are redirected to another domain, that application needs to take the access and refresh tokens and manage reauthentication as a background process. Simply don’t store those things as cookies though.