Slashdot Mirror
Another Tor Browser Feature Makes It Into Firefox: First-Party Isolation (bleepingcomputer.com)
An anonymous reader writes: Unbeknown to most users, Mozilla added a privacy-enhancing feature to the Firefox browser over the summer that can help users block online advertisers from tracking them across the Internet. The feature is named First-Party Isolation (FPI) and was silently added to the Firefox browser in August, with the release of Firefox 55. FPI works by separating cookies on a per-domain basis.
This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.
This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.
All problems solved!
This seems like the kind of feature that should be enabled by default when using a private browsing window, or using the "never remember history" option in the settings page.
you which use browser? opera (not chrome mod) ?
How does it feel to fail at even the most inane of tasks?
Everyone who considers using Firefox should read its privacy policy.
Firefox's privacy policy mentions it sending data to organizations/companies like Mozilla, Google, SalesForce, Leanplum, Adjust, and possibly others.
The privacy policy dated September 28, 2017 contains awful stuff like:
This is just Firefox trying to be a source of telemetry. Waterfox is based on Firefox, but removes all the telemetry, sponsored ads, etc plus a bunch of security holes the Firefox team isn't addressing.
The summary says this feature was 'silently added' to FF. Is this true? Do the FF 55 release notes really not list this change?
If this is true, then this scares the heck out of me. I don't want my browser including new functionality unexpectedly! I thought that FF was supposed to be transparent and trustworthy. Adding features secretly is not transparent and trustworthy, if that is what has happened in this case.
Is this how it works? My understanding that tracking cookies will be a) multi-domain and b) will also include add network domain. For example, Taboola cookie would be still accessible across all sites that use Taboola. Is this not the case?
I configure browser to wipe all my cookies on browser close, and frequently close it. I recommend others to do the same.
Wonder what would be the work around for the trackers and advertisers. I've already done a lot to keep my footprint as small as possible but I know I'm still getting tracked in some ways I can't stop if I want to be able to do useful things online. Like paying my bills. And I personally question the usefulness of things outside of the plain browser identifier. I don't get why any site I visit would need to probe what addons or if javascript has been executed. Maybe I don't do enough site programming to "get it". But something like this, as much as I think it's nice is just going to escalate the battle against advertisers more.
Like forcing more websites to have signins to be useful. Or greater sharing of metacookies or whatever it's call when the server sending out the ads does the tracking itself.
Why have you bothered posting this FILLER material when there are so many more pressing stories dealing with GLOBAL WARMING!!??!!
Please, editors, get your priorities right!
My cookies are all deleted when the browser is closed. I haven't saved cookies to disk since the 90's. /shrug
Why the fuck isn't that by design? Who's the moran who decided not to include that in the specifications?!
#DeleteFacebook
All the best parts of Chromium (NOT Chrome) but hardened for additional privacy and security. Easy interface, very fast, very secure.
I'm surprised we haven't heard about hosts files yet...
#DeleteFacebook
They'll just link the separate cookies together with ETags. Unless you're also going to have a separate file cache for each domain too.... not a bad idea actually.
That is a cool feature that won't break anything (except the sites tracking you across multiple domains - which is the point here).
Why do they hide it? To don't piss off Yahoo/Yandex/Baidoo sponsors? I guess (sane/informed) people love it so make it DEFAULT!
Well, I've got to get back to work. When I stop rowing, the slave ship just goes in circles.
Oh great. I've been taking advantage of this kind of this for years courtesy of Privoxy, which can block third-party cookies. Now with a major browser doing that, the next step in the arms race will be something worse on the part of the advertisers.
Maybe they can make a browser that actually works more than thirty percent of the time.
So folks won't need to click the linked article for instructions:
The feature is not enabled by default, as it's known to cause some login persistence problems. To enable it users have two options.
The first is to use a dedicated Firefox add-on. The add-on's name is "First Party Isolation," and once you install it, it immediately turns on FPI and adds a fishbowl icon on the Firefox UI.
Users can press this button to temporarily disable FPI (for five minutes). If users want to disable FPI for good, they can either disable or remove the add-on.
The second method of enabling FPI is by modifying parameters in the about:config settings page. To access this page, users must type about:config in the address bar and press Enter.
Once they reached the about:config page, they can search for "firstparty," and the two FPI parameters will appear.
To enable FPI, users must set "privacy.firstparty.isolate" to true by double-clicking it. The second parameter — "privacy.firstparty.isolate.restrict_opener_access" — works by lowering some of the "isolation" rules. Users can set this parameter to false if they're having problems logging into websites.
No, you don't get it. The guy you're replying to is trying to elevate the conversation to beyond myth. He has this weird bias toward facts. That means he doesn't give a flying fuck what someone was "sold" nor does he give a flying fuck about what the privacy policy says. The privacy policy is irrelevant. The rumors that it "respects privacy" are irrelevant. Nobody cares about that stuff. Why would they?
What he's trying to do is forget all this irrelevant and unimportant stuff, and instead, talk about what the software actually does.
Do you understand, that once people get into what Firefox does, anyone who brings up a written policy or what someone was "sold," is wasting time with off-topic nonsense? The grownups are talking about how fast the car is, and you're still talking about its tail fins. Nobody cares.
Wait ... President Trump, is that you? Do you "hear things" about Firefox?
The add-on, First Party Isolation, linked from the article, to
https://www.bleepingcomputer.c...
is something of a turd. There is no indication that it is doing anything. The preference page has no controls. The icon that is placed in the menu bar shows no state information—supposedly if you click on it, the FPI feature will be disabled for five minutes. There is absolutely no indication that anything happens when you click on it. plus, the icon is so hard to see that at first I thought there was no icon at all. The linked article mentions that you can also edit two entries in the about:config page. Nice if a little obscure. But you might think that the add-on would simply toggle these items, but installing the add-on does not affect these about:config items. So, again, the FPI add-on is poorly designed.
Another example of Firefox leading, while Chrome is for sheeple.
baaa baaa
Yay Freedom.
Brave Ads is ONE of the three methods available which allows vetted, privatized ads to be served through the Brave network. You can also choose to block all ads (period), or block all ads and donate to your preferred publishers using a crypto wallet.
You know nothing.
I have used Firefox for over ten years, but this comment is just sad. Firefox has been DECIMATED by Chrome. There is no comparison; the numbers do not lie.
Mozilla really began to irritate me when they fired Brendan Eich, then partnered up with George Soros on the MITI. That is why I use Brave now as my primary browser.
I think this should have been in the summary.
Go to: about:config Search for privacy.firstparty.isolate and set it to true by double-clicking it.
Ghostery does basically the same thing, and probably better. It works with the new version of firefox. (it's a WebExtension)
https://www.ghostery.com/
My browser is only closed when the hardware crashes.