Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn't do much to obscure the more advanced methods of tracking.
Don't all the advanced ways rely on JavaScript?
Lots do. But do you know anyone that turns JS off anymore? Platforms don't care if they miss the odd user for this - because almost no one will be missed.
"Anymore"? I've never met a single soul who knows this is even possible. I myself don't even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I've never met another NoScripter in the wild.
Am I in the wild? I use it.
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
Librewolf has Resist Fingerprinting which comes pretty far.
Every Librewolf browser uses the same windows user agent, etc. But there are downsides, like time zones don't work, and sites don't use dark mode by default.
And even then, EFF's Cover Your Tracks site can still uniquely identify me, mainly through window size. That's one of the reasons why Tor Browser uses letterboxing to make the window size consistent.
There is still plenty of fish for advertisers, sadly.
For those who don't care to read the full article:
This basically just confines any cookies generated on a page, to just that page.
So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.
Hahahahaha so it doesn't break anything that still relies on cookies, but neuters the ability to share them.
That's awesome
Honestly, I thought that's how it already worked.
Edit: I think what I'm remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.
But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.
Someone correct me if I got it wrong.
They've been doing this with container tabs, so this must be the successor to that idea (I'm going to assume they'll still have container tabs).
Container tabs are still a thing in FF. This is based on that work, if I remember correctly.
I love container tabs. It's one of the reasons I went back to FF.
Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox's Enhanced Tracking Protection (ETP) on strict mode.
They had a less powerful third-party cookie blocking feature for users that didn't have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)
This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.
That's not what I was thinking of, which was even more fundamental. But that's good info (and another way to cover stuff in the article).
Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren't allowed at all. Which was really dumb since of course they are.
Basically creates a fake VM like environment for each site.
For those who don't care to read the full article
Or even the whole title, really
I don't know why this wasn't the case long ago.
It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$
Isn't this basically Firefox's version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?
I mean, it's good news either way but I just want to know if this is somehow different or better.
Sites are much more contained now. Is much more like a profile per site.
Good to see Firefox still has value to provide
Firefox is awesome.
Does this make containers unnecessary? Or basically built in?
A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can't see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.
This keeps cookies locked to each page that needs cookies. So a lot stronger.
So what you’re saying is, each site gets its own container?
FREEEDOOOOOOOOOOOM
Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis
Forgive me if this is an overly simplistic view but if the ads with cookies are all served on Google's platform say then would all those ads have access to the Google cookie jar?
If they don't now then you can bet they are working on just that.
The way I'm reading it, they allow the third party cookies to be used within the actual site you're on for analytics, but prevent them from being accessed by that third party on other sites.
But I just looked at the linked article's explanation, and not a technical deep dive.
So that's what third party cookies are. What this does is make it so that when you go to example.com and you get a Google cookie, that cookie is only associated with example.com, and your random.org Google cookie will be specific to that site.
A site will be able to use Google to track how you use their site, which is a fine and valid thing, but they or Google don't get to see how you use a different site. (Google doesn't actually share specifics, but they can see stuff like "behavior on one site led to sale on the other")
We'll have to see what happens but what you are talking about is what Mozilla calls Third-Party Cookies and... they are aware of it.
I can't entirely tell if that means they will be put in the facebook cookie jar or if it will be put in the TentaclePorn Dot Org (don't go there, it is probably a real site and probably horrifying) cookie jar. If the former? Then only facebook themselves have that which... is still a lot better I guess? If the latter then that is basically exactly what we all want but a lot of sites are gonna break (par for the course with Firefox but...).
The cookie would go to the Facebook or tentacleporn cookie jar depending on which site the user has actually visited. Whatever the domain in the address bar says.
InB4 the guy who replies to defend tenticle porn.....
They are usually separate things. Cookies are produced/saved locally, to be read in the next visit (by the same website or maany websites basically forever unless you use firefox containers or at least clear them once in a while). There's also local storage which is different but can also be used to identify you across the web. Ads, trackers, all of these categories are often made of many small components: you read a single article on a "modern" newspaper website, hundreds of connection are being made, different tiny scripts or icons or images are being downloaded (usually from different subdomains for different purposes but there's no hard rule). It's possible to block one thing and not another. For example I can block Google Analytics (googletagmanager) which is a tracker, but accept all of Google's cookies.
Does this stop me from adding to my website an iframe to facebook where facebook can keep its cookies for my user? That would be great but I doubt it.
IIRC an iframe contents is treated as a separate window, so cookies aren’t shared either
Mozilla completes what Google was too afraid to finish.
Well, now how am I supposed to cross reference my need of fuzzy slippers and woodworking stuff?!
It baffles me that this was ever not the case.
They call it TCP. All we need now is IP, and we'll be set lol
Take that, cookie monsters!
Is this the reason why I have to "confirm it's you" every time I sign into a Google service? I appreciate the fact that Firefox's protection is so good that Google doesn't recognize my PC anymore, but it's extremely annoying to have to pull out my phone every time I want to watch YouTube.
This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.
Maybe they should try to develop the uBlock Origin extension with the dev to make it last more.
Article from JUNE 14, 2022
I think this tips it over the edge for me to switch to Firefox
I hope so! It's a wonderful side of the Internet to be on
I prefer waterfox. Hard to trust Mozilla Corpos.
As long as it's not Chromium, I'm happy people aren't just handing over the keys to the Internet to Google.
Yeah, Waterfox is just another browser built on top of the Mozilla's GECKO engine. But without all the AI dickriding.
How terrible to offer client-side translation or webpage description for differently abled people!
Client side incorrect translations*
How incorrect is it?
Sentences are a lot like math problems. An incorrect part changes the entire outcome.
Yes, so show me how incorrect is their translation, since you claim it to be incorrect.
LLM and ML generated translations generate a series of tokens individually. That's why AI Chatbots hallucinate so often, they decide the next most likely word in a sequence is "No" when the correct answer would be "Yes" and then the rest of the prompt devolves into convincing nonsense. Machines are incapable of any sort of critical thinking to discern correct from incorrect to decide whether to use contextual responses.
Those are not examples, just what you claim will happen based on what you think you understand about how LLM works.
Show me examples of what you meant. Just run some translations in their AI translator or something and show me how often they make inaccurate translations. Doesn't seem that hard to prove what you claimed.
You want examples but you never disclosed which product you're asking about, and why should I give a damn in the first place? I shouldn't have to present an absence of evidence of it working to prove it doesn't work.
I haven't seen anything to signal Mozilla is untrustworthy other than from that one right wing guy with a chip on his shoulder.
The Mozilla Corporation is a for profit entity owned by the non-profit Mozilla Foundation, which lets them claim to be a nonprofit, which is a sketchy looking way to set up and promote your business if nothing else. They get most of their money from Google and they've been riding AI like all the other unethical companies.
I see absolutely no reason to give them a chance, either. Just use an actual open source build instead of the mainstream one.
Get fucked, advertisers.
Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn't do much to obscure the more advanced methods of tracking.
Don't all the advanced ways rely on JavaScript?
Lots do. But do you know anyone that turns JS off anymore? Platforms don't care if they miss the odd user for this - because almost no one will be missed.
"Anymore"? I've never met a single soul who knows this is even possible. I myself don't even know how to do it if I wanted to.
I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I've never met another NoScripter in the wild.
Am I in the wild? I use it.
Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.
Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.
It's not much but they try a whole lot more than most.
Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
Librewolf has Resist Fingerprinting which comes pretty far.
Every Librewolf browser uses the same windows user agent, etc. But there are downsides, like time zones don't work, and sites don't use dark mode by default.
And even then, EFF's Cover Your Tracks site can still uniquely identify me, mainly through window size. That's one of the reasons why Tor Browser uses letterboxing to make the window size consistent.
There is still plenty of fish for advertisers, sadly.
For those who don't care to read the full article:
This basically just confines any cookies generated on a page, to just that page.
So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.
Hahahahaha so it doesn't break anything that still relies on cookies, but neuters the ability to share them.
That's awesome
Honestly, I thought that's how it already worked.
Edit: I think what I'm remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.
But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.
Someone correct me if I got it wrong.
They've been doing this with container tabs, so this must be the successor to that idea (I'm going to assume they'll still have container tabs).
Container tabs are still a thing in FF. This is based on that work, if I remember correctly.
I love container tabs. It's one of the reasons I went back to FF.
Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox's Enhanced Tracking Protection (ETP) on strict mode.
They had a less powerful third-party cookie blocking feature for users that didn't have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)
This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.
That's not what I was thinking of, which was even more fundamental. But that's good info (and another way to cover stuff in the article).
Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren't allowed at all. Which was really dumb since of course they are.
Basically creates a fake VM like environment for each site.
Or even the whole title, really
I don't know why this wasn't the case long ago.
It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$
Isn't this basically Firefox's version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?
I mean, it's good news either way but I just want to know if this is somehow different or better.
Sites are much more contained now. Is much more like a profile per site.
Good to see Firefox still has value to provide
Firefox is awesome.
Does this make containers unnecessary? Or basically built in?
A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can't see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.
This keeps cookies locked to each page that needs cookies. So a lot stronger.
So what you’re saying is, each site gets its own container?
FREEEDOOOOOOOOOOOM
Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis
Forgive me if this is an overly simplistic view but if the ads with cookies are all served on Google's platform say then would all those ads have access to the Google cookie jar?
If they don't now then you can bet they are working on just that.
The way I'm reading it, they allow the third party cookies to be used within the actual site you're on for analytics, but prevent them from being accessed by that third party on other sites.
But I just looked at the linked article's explanation, and not a technical deep dive.
So that's what third party cookies are. What this does is make it so that when you go to example.com and you get a Google cookie, that cookie is only associated with example.com, and your random.org Google cookie will be specific to that site.
A site will be able to use Google to track how you use their site, which is a fine and valid thing, but they or Google don't get to see how you use a different site. (Google doesn't actually share specifics, but they can see stuff like "behavior on one site led to sale on the other")
We'll have to see what happens but what you are talking about is what Mozilla calls Third-Party Cookies and... they are aware of it.
https://support.mozilla.org/en-US/kb/third-party-cookies-firefox-tracking-protection#:~:text=Third%2Dparty%20cookies%20are%20cookies,considered%20a%20third%2Dparty%20cookie.
I can't entirely tell if that means they will be put in the facebook cookie jar or if it will be put in the TentaclePorn Dot Org (don't go there, it is probably a real site and probably horrifying) cookie jar. If the former? Then only facebook themselves have that which... is still a lot better I guess? If the latter then that is basically exactly what we all want but a lot of sites are gonna break (par for the course with Firefox but...).
The cookie would go to the Facebook or tentacleporn cookie jar depending on which site the user has actually visited. Whatever the domain in the address bar says.
InB4 the guy who replies to defend tenticle porn.....
They are usually separate things. Cookies are produced/saved locally, to be read in the next visit (by the same website or maany websites basically forever unless you use firefox containers or at least clear them once in a while). There's also local storage which is different but can also be used to identify you across the web. Ads, trackers, all of these categories are often made of many small components: you read a single article on a "modern" newspaper website, hundreds of connection are being made, different tiny scripts or icons or images are being downloaded (usually from different subdomains for different purposes but there's no hard rule). It's possible to block one thing and not another. For example I can block Google Analytics (googletagmanager) which is a tracker, but accept all of Google's cookies.
Does this stop me from adding to my website an iframe to facebook where facebook can keep its cookies for my user? That would be great but I doubt it.
IIRC an iframe contents is treated as a separate window, so cookies aren’t shared either
https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage
Mozilla completes what Google was too afraid to finish.
Well, now how am I supposed to cross reference my need of fuzzy slippers and woodworking stuff?!
It baffles me that this was ever not the case.
They call it TCP. All we need now is IP, and we'll be set lol
Take that, cookie monsters!
Is this the reason why I have to "confirm it's you" every time I sign into a Google service? I appreciate the fact that Firefox's protection is so good that Google doesn't recognize my PC anymore, but it's extremely annoying to have to pull out my phone every time I want to watch YouTube.
This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.
Maybe they should try to develop the uBlock Origin extension with the dev to make it last more.
Article from JUNE 14, 2022
I think this tips it over the edge for me to switch to Firefox
I hope so! It's a wonderful side of the Internet to be on
I prefer waterfox. Hard to trust Mozilla Corpos.
As long as it's not Chromium, I'm happy people aren't just handing over the keys to the Internet to Google.
Yeah, Waterfox is just another browser built on top of the Mozilla's GECKO engine. But without all the AI dickriding.
How terrible to offer client-side translation or webpage description for differently abled people!
Client side incorrect translations*
How incorrect is it?
Sentences are a lot like math problems. An incorrect part changes the entire outcome.
Yes, so show me how incorrect is their translation, since you claim it to be incorrect.
LLM and ML generated translations generate a series of tokens individually. That's why AI Chatbots hallucinate so often, they decide the next most likely word in a sequence is "No" when the correct answer would be "Yes" and then the rest of the prompt devolves into convincing nonsense. Machines are incapable of any sort of critical thinking to discern correct from incorrect to decide whether to use contextual responses.
Those are not examples, just what you claim will happen based on what you think you understand about how LLM works.
Show me examples of what you meant. Just run some translations in their AI translator or something and show me how often they make inaccurate translations. Doesn't seem that hard to prove what you claimed.
You want examples but you never disclosed which product you're asking about, and why should I give a damn in the first place? I shouldn't have to present an absence of evidence of it working to prove it doesn't work.
I haven't seen anything to signal Mozilla is untrustworthy other than from that one right wing guy with a chip on his shoulder.
The Mozilla Corporation is a for profit entity owned by the non-profit Mozilla Foundation, which lets them claim to be a nonprofit, which is a sketchy looking way to set up and promote your business if nothing else. They get most of their money from Google and they've been riding AI like all the other unethical companies.
I see absolutely no reason to give them a chance, either. Just use an actual open source build instead of the mainstream one.
This is old news, from 2022!!
From the blog post:
Let me guess, itll still let websites see a list connected microphones and cameras with zero user interaction?