Slashdot Mirror
Another Tor Browser Feature Makes It Into Firefox: First-Party Isolation (bleepingcomputer.com)
An anonymous reader writes: Unbeknown to most users, Mozilla added a privacy-enhancing feature to the Firefox browser over the summer that can help users block online advertisers from tracking them across the Internet. The feature is named First-Party Isolation (FPI) and was silently added to the Firefox browser in August, with the release of Firefox 55. FPI works by separating cookies on a per-domain basis.
This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.
This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.
This seems like the kind of feature that should be enabled by default when using a private browsing window, or using the "never remember history" option in the settings page.
How does it feel to fail at even the most inane of tasks?
This is just Firefox trying to be a source of telemetry. Waterfox is based on Firefox, but removes all the telemetry, sponsored ads, etc plus a bunch of security holes the Firefox team isn't addressing.
Is this how it works? My understanding that tracking cookies will be a) multi-domain and b) will also include add network domain. For example, Taboola cookie would be still accessible across all sites that use Taboola. Is this not the case?
I configure browser to wipe all my cookies on browser close, and frequently close it. I recommend others to do the same.
Wonder what would be the work around for the trackers and advertisers. I've already done a lot to keep my footprint as small as possible but I know I'm still getting tracked in some ways I can't stop if I want to be able to do useful things online. Like paying my bills. And I personally question the usefulness of things outside of the plain browser identifier. I don't get why any site I visit would need to probe what addons or if javascript has been executed. Maybe I don't do enough site programming to "get it". But something like this, as much as I think it's nice is just going to escalate the battle against advertisers more.
Like forcing more websites to have signins to be useful. Or greater sharing of metacookies or whatever it's call when the server sending out the ads does the tracking itself.
Well, that's irrelevant! The fact remains that data can be collected and can be sent. "Can" is just as bad as "will".
I disagree. A privacy policy doesn't mean much, except for lawyers.
Saying they can do something bad don't mean they will do something bad. For example, if they provide a bug report feature, they will collect some data with it, and even though the user ultimately decide to send the report or not, and that it is really only used for debugging, it has to be mentioned in the policy, and considering the amount of data that may end up in a bug report, the terms can be scary.
OTOH, just because something isn't written in the privacy policy doesn't mean it can't be done. It just means it is illegal to do it. Most importantly, nothing in the privacy policy says that the software isn't full of exploitable bugs.
Why the fuck isn't that by design? Who's the moran who decided not to include that in the specifications?!
#DeleteFacebook
I'm surprised we haven't heard about hosts files yet...
#DeleteFacebook
They'll just link the separate cookies together with ETags. Unless you're also going to have a separate file cache for each domain too.... not a bad idea actually.
That is a cool feature that won't break anything (except the sites tracking you across multiple domains - which is the point here).
Why do they hide it? To don't piss off Yahoo/Yandex/Baidoo sponsors? I guess (sane/informed) people love it so make it DEFAULT!
Well, I've got to get back to work. When I stop rowing, the slave ship just goes in circles.
Way to miss the point, and more importantly, wait to miss the hypocrisy of Firefox apologists, including yourself.
Again and again we're sold this myth by Firefox apologists that Firefox somehow "respects the privacy" of its users.
Again and again we're told by Firefox apologists that Chrome is so awful because it might send data to Google.
Yet even a cursory reading of Firefox's privacy policy makes it very clear that Firefox is just as capable of sending personal data to Google, along with numerous other external parties!
Then instead of waking up to the fact that your beloved Firefox browser really isn't any better than Chrome, and may actually be worse, you Firefox apologists throw this hypocritical denialist gibberish at us!
Firefox's privacy policy just goes to show, in my opinion, that Firefox and its creators don't give a damn about user privacy.
If they did care about user privacy, then Firefox's privacy policy wouldn't be full of warnings about all of the data it collects and sends to various places because Firefox wouldn't even support any of this data collection and transmission to begin with!
Firefox apologists need to wake up to the fact that their browser of choice isn't the saint that they wrongly portray it as.
Then those Firefox apologists should do some proper apologizing by apologizing to the rest of us who have been subjected to your babble for so long!
The add-on, First Party Isolation, linked from the article, to
https://www.bleepingcomputer.c...
is something of a turd. There is no indication that it is doing anything. The preference page has no controls. The icon that is placed in the menu bar shows no state information—supposedly if you click on it, the FPI feature will be disabled for five minutes. There is absolutely no indication that anything happens when you click on it. plus, the icon is so hard to see that at first I thought there was no icon at all. The linked article mentions that you can also edit two entries in the about:config page. Nice if a little obscure. But you might think that the add-on would simply toggle these items, but installing the add-on does not affect these about:config items. So, again, the FPI add-on is poorly designed.
Ghostery does basically the same thing, and probably better. It works with the new version of firefox. (it's a WebExtension)
https://www.ghostery.com/
Chromium is garbage, it freezes up on page loads for 1-2 minutes every time you hit a website.
Many websites will break if you do this; USAA is broken with this, for example. My preferred method, without addons, is to set third party cookies to session only, something that no browser can do except for firefox.
My opinion? Combine privacy badger, cookie autodelete, and third party cookies session only, as FPI can break some websites, but the combination above should not break anything. For good measure, also add searchonymous2 and a redirect bypassing addon (redirect bypasser was the best, but I'm not sure which is right now.) Unfortunately, at the present time, extensions can't do anything about localstorage, which sites can and do use to track you. FPI effectively sandboxes localstorage from site to site, but it wastes disk space. Mozilla is extending the webextension API to allow manipulation of localstorage and will probably be the only browser to do so. The cookie autodelete developers plan on using it as soon as it's available, so that will be a complete solution.
That's the nice thing about firefox going forward: Mozilla continues to add new features to the webextension API and is very responsive to requests, but Chrome usually doesn't, and you can pretty much count on Edge only going so far as to always remain a subset of what Chrome does, as Microsoft just copies the Chrome API verbatim, but doesn't implement everything. Microsoft also uses a "whitelist only" model in Edge, which involves paying a fee to Microsoft and requesting that they review your extension, which they ignore in most cases, even if you own a very popular chrome extension.
I'm betting that in about a year, Firefox will be the browser with all of the best addons, just like it was before the switch to webextensions, and Edge will remain king at its job of being the tool everybody uses to download firefox.