- cross-posted to:
- privacy@lemmy.ml
- privacy@lemmy.ml
- cross-posted to:
- privacy@lemmy.ml
- privacy@lemmy.ml
You must log in or # to comment.
Does this make containers unnecessary? Or basically built in?
A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can’t see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.
This keeps cookies locked to each page that needs cookies. So a lot stronger.
So what you’re saying is, each site gets its own container?
I think there’s some confusion here. You’re talking about Multi-Account Containers, that person was talking about the Facebook Container. Both Firefox features with confusingly similar names, and honestly that’s on Firefox for naming them.
Facebook Container is similar to this TCP feature, but focused on Facebook. And of course it was a separate extension, so very opt-in. Now, Firefox has rolled it out for ALL sites by default, which is awesome and SHOULD HAVE BEEN HOW COOKIES WORKED IN THE FIRST PLACE!
Isn’t there just a non-extension container feature, I can’t tell what’s the difference between that one and multi-account containers.
Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis
Containers also handle other cached content besides cookies.
FREEEDOOOOOOOOOOOM
It is making the tracking protection part of containers obsolete, this is basically that functionality but built in and default. The containers still let you have multiple cookie jars for the same site, so they are still useful if you have multiple accounts on a site.
Yup. Nobody else gets those cookies.
Alright fine ill switch browsers AGAIN
Why are we posting 2 year old articles as though they are new?
Looks like the article was updated today. I’m guessing this was originally covering an announcement for a future rollout and now it’s finally happening?
Maybe. Confusing decision on the part of Mozilla though, if so. I was checking to see if they mentioned which version this update happened in, but couldn’t find it. Then I noticed the original post date. Weird.
this article has not been edited, is from 2022, and says the feature was rolled out in June.
I guess it says updated, but hey. PR for Firefox is cool, until the imminent enshittification.
The moment that Firefox goes too far, it’ll immediately be forked and 75% of the user base would leave within a few months. Their user base is almost entirely privacy-conscious, technologically savvy people.
I agree, but something will have to change because chrome will swallow ALL that. Just today some back-end problem was messing up all my stuff, and co-workers were asking, " did you try a different browser? " botch no I did not try Netscape
“I agree [with the opposite of what you said]. Also, here, have an irrelevant anecdote that includes a funny misspelling and a supposed diss of FF from 1999”
Not sure what you mean - I don’t think most of the people still using Firefox are going to switch to a Chromium based browser any time soon, I can’t speak for everyone of course but it feels like Firefox users tend to have an ideological objection to Google having a monopoly on web browsers.
It’s always worth trying a different browser when you have issues on websites - there are a lot of things that can be different beyond the layout and javascript engines - cookies, configuration, addons, etc. Yesterday I noticed a big difference between Chromium and Firefox in that even if you hard-refresh on a HTTP/2 connection, Chromium reuses a kept-alive connection, and firefox doesn’t — I would totally argue that Firefox’s implementation is more correct, but Chrome’s implementation will lead to a better experience for users hard-refreshing.
Personally, I remember chrome always flash banging me when on a website with a dark background and I clicked to the next page because apparently clearing the page to the same RGB value as what is set as the HTML background is too hard so they just always clear with pure white. But they did have a faster JS engine. Not sure anymore, haven’t given enough of a shit to try anything but firefox in years now.
Depends on how it “goes too far”. What I am, for example, afraid of is the possibility of removing Manifest V2 support. Maintaining the browser with such a significant change would get more and more difficult as time goes on.
This is currently one of the biggest selling points for the browser, since Chrom(ium) is dropping support for v2… So I don’t see that happening.
I think that would be an example of a wildly unpopular change, yeah.
Firefox did an add-on genocide years ago and it obviously didn’t hurt them in the long run.
Article from JUNE 14, 2022
I’m curious how this will affect OAuth (if at all). Does it use an offsite cookie to remember the session, or is that only created after it redirects back to the site that initiated the login?
I my experience it generally breaks it. Leveraging cookies on the auth domain is fine, but once you are redirected to another domain, that application needs to take the access and refresh tokens and manage reauthentication as a background process. Simply don’t store those things as cookies though.
I was also wondering that
Maybe they should try to develop the uBlock Origin extension with the dev to make it last more.
What about depreciating third party cookies?
I had never in the previous year visited a single site that required third party cookies.
I never found anyone who have a use case for it, I even disable it at every PC I setup or administer with zero problems.
Oracle, SAP, Redhat, all of their customer portals require it for SSO. I’m not saying it should be that way, but it is.
Yes we are going to enable this feature that is going to be irrelevant in the future, because where building an API in the browser to fetch browser History…
Yeah maybe 10 years late…
I wonder how long until all the distros have this.
Is this the reason why I have to “confirm it’s you” every time I sign into a Google service now? I appreciate the fact that Firefox’s protection is so good that Google doesn’t recognize my PC anymore, but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube.
This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.
but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube
This sounds wild. What is your setup? You are using Youtube directly and unmitigated?
At the moment yes cause I’m too lazy/ADHD to switch to NewPipe.
It’s okay to say lazy. Not everything is ADHD. You’re just lazy.
This wouldn’t make you have to log in every time you watch YouTube. It means by signing in to google.com, youtube.com can’t tell that you’re signed in. If you sign in on youtube.com, you’ll stay signed in on youtube.com unless you have something else deleting your cookies.
Well have had my cookies set to delete every time I close the browser for several years now but FF only now started doing this verification thing. A week ago all I had to do was enter my email and password.
This article is from 2022
It was updated today. 2 years ago it was just an announcement of a beta function in private browsing, the full rollout happened with 129.0.2 which was released a few days back.
Cool, thanks. How’d you find the version number? I was looking on the linked post but didn’t find it. Maybe just me being tired.
I don’t think it was in the article, but I updated to 192.0.2 yesterday and checked the enhanced tracking protection settings, and block cross-site cookies is now in the default profile, so that was my assumption since it wasn’t there previously.
You may want to just use tab containers for youtube, so that it maintains your session, but also isolates it.
Best way to use such (para)sites.
If you’re already deleting all your cookies every time you close, then this new change should be identical to your first login of the day when your browser has no cookies. If you’re only getting 2fa requests after this change, then maybe you weren’t actually deleting every cookie, and Google was still fingerprinting you somehow.
No. That’s just Google trying to pester you into using Chrome.
I actually had a problem where on Chrome, I would be signed out of my google account every time I restart my computer, while on Firefox, everything works normally. I use Firefox now lol.
Is this different from blocking 3rd party cookies?
A little. If a third party cookie is set while you’re visiting a site, only that site will get the third party cookie back. Multiple sites can have embedded content making third party cookies, and with this change firefox will track where it was made and only give it back there.
With this change, it doesn’t matter if it’s first or third or whatever; cookies will only be given back to a site that matches much of what is in your location bar.
Such a chad move. Respect!
Get fucked, advertisers.
Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.
It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.
Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.
The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.
WebGL
I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.
EU outlaws it
The EU isn’t the only place on the planet, even if its laws have an impact.
Don’t all the advanced ways rely on JavaScript?
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.
I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.
uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.
They might be fingerprinting me using these two extensions though.
“Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.
The people who I’ve tried to get on NoScript seem to have the brain capacity of goldfish. If the site doesn’t instantly work, it’s as if the sky has fallen and there is no way to convince them to pay attention to which scripts are actually needed.
It’s a rare breed that is willing to put up with toggling different scripts on and off. I’ll also acknowledge that too many people (including me) are in a giant rush. For work-type stuff, I have the laptop without noscript, because sometimes I do need something to work absolutely right now.
You don’t think you are being a tad judgemental?
People whose lives revolve around fashion probably think you dress like shit.
People who love food probably think you eat like shit.
People who love cars probably think you are a shit driver.
You probably love computers and care about privacy, and you are shitting on regular users(assumption, admittedly) for not being invested.
They had something that was working, you present noscript, thing no longer works. If you are not invested, how are you going to see the appeal of extra work?
Well, you know what they say. You can lead a horse to water, but you can’t make it interested in learning about the water cycle to have a deeper understanding of why the river flows in the first place.
Why not just use ublock medium mode?
Roughly similar to using Adblock Plus with many filter lists + NoScript with 1st-party scripts/frames automatically trusted. Unlike NoScript however, you can easily point-and-click to block/allow scripts on a per-site basis.
https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode
Am I in the wild? I use it.
They probably mean in the flesh.
I don’t really talk about it in meat space, so they just might not have known.
I go hard with DNS-based ad blocking and I’m constantly confirming it works by checking the network tab in developer tools. I’m basically only seeing first party scripts and CDN assets — 99% of websites don’t host tracking garbage themselves.
Pihole?
It’s a common solution but I do something more involved and manual, but it’s the same concept.
Is it something you can talk about? I’m currently in the process of trying to switch from pihole to pfblockerng but am interested if there are better alternatives
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
Librewolf has Resist Fingerprinting which comes pretty far.
Every Librewolf browser uses the same windows user agent, etc. But there are downsides, like time zones don’t work, and sites don’t use dark mode by default.
And even then, EFF’s Cover Your Tracks site can still uniquely identify me, mainly through window size. That’s one of the reasons why Tor Browser uses letterboxing to make the window size consistent.
Librewolf supports letterboxing as well, though the setting might be disabled by default
I don’t know what letterboxing is. But if window size is used to identify me, can’t it be circumvented simply by using the window in restored size, and not maximised?
Your restored window size is even more unique than your maximised window size!
The correct solution is to just not make the window size available to JS or to remotes at all. There’s no reason to ever need specifics on window size other than CSS media-queries, and those can be done via profiles.
But the restored size keeps changing - can’t be profiled, right?
And how do I not make the size available “to JS or to remote”?
There is still plenty of fish for advertisers, sadly.
ah yes, the other TCP
Tasty Consensual Photos
Maybe they should patent it, to protect their TCP IP.
Or have some higher tier version called Ultimate Cookie Protection {UDP)
Id prefer a security security oriented Secure Cookie Total Protection (SCTP)
Wouldn’t that be Ultimate Dookie Protection?
danvit, yes
LOL
