Firefox rolls out Total Cookie Protection by default to all desktop users worldwide | It is Firefox’s strongest privacy protection to date, confining cookies to the site where they were created

Get fucked, advertisers.

Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn't do much to obscure the more advanced methods of tracking.
- Don't all the advanced ways rely on JavaScript?
- It's not much but they try a whole lot more than most.
- Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.
- EU outlaws it
- Yeah, you need uMatrix. although it can be tricky to use.
There is still plenty of fish for advertisers, sadly.

For those who don't care to read the full article:

This basically just confines any cookies generated on a page, to just that page.

So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.

Hahahahaha so it doesn't break anything that still relies on cookies, but neuters the ability to share them.

That's awesome
- Honestly, I thought that's how it already worked.
  
  Edit: I think what I'm remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.
  
  But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.
  
  Someone correct me if I got it wrong.
- Unless that cookie was somehow important for you to use both sites, but thats incredibly rare.
- From my experience, blocking 3rd party cookies in general doesn't seem to make any difference for site functionality anyways. Though I never log into sites with a Google or FB account other than Google or FB sites (and rarely at all for the latter).
- I would love to see an icon of a neutered cookie please 🥺😄.
Basically creates a fake VM like environment for each site.
For those who don't care to read the full article

Or even the whole title, really
I don't know why this wasn't the case long ago.
- It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$
Isn't this basically Firefox's version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?

I mean, it's good news either way but I just want to know if this is somehow different or better.
- Sites are much more contained now. Is much more like a profile per site.
Disabling cross site cookie is already a thing for decades...

Same with Do Not Track requests.
- Do Not Track has never really done anything, it just asks websites politely to not track you. There's no legal or technical limitation here.
- Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.
  
  Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.

I think this tips it over the edge for me to switch to Firefox

I hope so! It's a wonderful side of the Internet to be on
Really? This is what does it for you?
- Ur... Yeah?
I miss Mozilla the product.
- I unironically miss Netscape Communicator. Yes most of that went into Firefox but not all and I really miss the frame layout.
I prefer waterfox. Hard to trust Mozilla Corpos.
- As long as it's not Chromium, I'm happy people aren't just handing over the keys to the Internet to Google.
- I haven't seen anything to signal Mozilla is untrustworthy other than from that one right wing guy with a chip on his shoulder.

Yup. Nobody else gets those cookies.

Aren’t cookies already limited to the site at which they were created??

What the fuck? You mean to tell me sites have been sharing cookies?

I thought all browsers only delivered cookies back to the same site.

The problem is that a website is generally not served from one domain.

Put a Facebook like button on your website, it's loaded directly from Facebook servers. Now they can put a cookie on your computer with an identifier.

Now every site you visit with a Facebook like button, they know it was you. They can watch you as you move around the web.

Google does this at a larger scale. Every site with Google ads on it. Every site using Google analytics. Every site that embeds a Google map. They can stick a cookie in and know you were there.
- Is this also how they know which ads to feed you?
- Put a Facebook like button on your website, it's loaded directly from Facebook servers. Now they can put a cookie on your computer with an identifier.
  
  Which is not allowed by GDPR btw, because they do that even if you don't click them. There are plenty guides online, how to create your own, not tracking, facebook like button.
- Is that because the like button is an iframe?
I know Facebook and Reddit are in cahoots.

I went to visit Reddit a couple weeks back to read the Deadpool & Wolverine comments, but used the wrong container tab and now Facebook feeds me endless Marvel related stuff.

A lot of it is culture war bullshit too. Hmmmmm 🤔
- oh i know how this works and its not the way you think. Its somehow better and worse at the same time
  
  Im going to describe the process using a hypothetical situation:
  
  You decide to try a new shampoo but you're not sure what to buy. You ask your friend "hey what shampoo do you use" and they tell you they use Head and Shoulders.
  
  Later that night, you google head and shoulders and read reviews
  
  The next day, your friend gets Head and Shoulders ads on youtube and facebook and Instagram, etc
  
  This is because google knows both of your locations and search history. It sees that you two were within a few feet of each for hours and decides to shoot ads at you both, based on what either of you have searched recently.
  
  This is called proximity targetted advertising and i think its gross.
  
  But this is why so many people say things like "we were talking about it and now im seeing ads they must be spying on me"
- No, you don't know anything. Just because you have a suspicion because something happened to you once doesn't mean you are sure in any way.
NO.

https://en.m.wikipedia.org/wiki/Third-party_cookies

Maybe it's not allowed in your local jurisdiction? But it's been a problem since forever.

Why are we posting 2 year old articles as though they are new?

Looks like the article was updated today. I'm guessing this was originally covering an announcement for a future rollout and now it's finally happening?
- this article has not been edited, is from 2022, and says the feature was rolled out in June.
- Maybe. Confusing decision on the part of Mozilla though, if so. I was checking to see if they mentioned which version this update happened in, but couldn't find it. Then I noticed the original post date. Weird.
I guess it says updated, but hey. PR for Firefox is cool, until the imminent enshittification.
- The moment that Firefox goes too far, it’ll immediately be forked and 75% of the user base would leave within a few months. Their user base is almost entirely privacy-conscious, technologically savvy people.

Does this make containers unnecessary? Or basically built in?

A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can't see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.

This keeps cookies locked to each page that needs cookies. So a lot stronger.
- So what you’re saying is, each site gets its own container?
- I think there's some confusion here. You're talking about Multi-Account Containers, that person was talking about the Facebook Container. Both Firefox features with confusingly similar names, and honestly that's on Firefox for naming them.
  
  Facebook Container is similar to this TCP feature, but focused on Facebook. And of course it was a separate extension, so very opt-in. Now, Firefox has rolled it out for ALL sites by default, which is awesome and SHOULD HAVE BEEN HOW COOKIES WORKED IN THE FIRST PLACE!
Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis
- Containers also handle other cached content besides cookies.
It is making the tracking protection part of containers obsolete, this is basically that functionality but built in and default. The containers still let you have multiple cookie jars for the same site, so they are still useful if you have multiple accounts on a site.
FREEEDOOOOOOOOOOOM

Good to see Firefox still has value to provide

Firefox is awesome.

Is this different from blocking 3rd party cookies?

A little. If a third party cookie is set while you're visiting a site, only that site will get the third party cookie back. Multiple sites can have embedded content making third party cookies, and with this change firefox will track where it was made and only give it back there.

With this change, it doesn't matter if it's first or third or whatever; cookies will only be given back to a site that matches much of what is in your location bar.

Mozilla completes what Google was too afraid to finish.

Article from JUNE 14, 2022

Is this the reason why I have to "confirm it's you" every time I sign into a Google service now? I appreciate the fact that Firefox's protection is so good that Google doesn't recognize my PC anymore, but it's extremely annoying to have to pull out my phone every time I want to watch YouTube.

This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.

No. That's just Google trying to pester you into using Chrome.
- I actually had a problem where on Chrome, I would be signed out of my google account every time I restart my computer, while on Firefox, everything works normally. I use Firefox now lol.
This wouldn't make you have to log in every time you watch YouTube. It means by signing in to google.com, youtube.com can't tell that you're signed in. If you sign in on youtube.com, you'll stay signed in on youtube.com unless you have something else deleting your cookies.
- Well have had my cookies set to delete every time I close the browser for several years now but FF only now started doing this verification thing. A week ago all I had to do was enter my email and password.
but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube

This sounds wild. What is your setup? You are using Youtube directly and unmitigated?
- At the moment yes cause I'm too lazy/ADHD to switch to NewPipe.

ah yes, the other TCP

Maybe they should patent it, to protect their TCP IP.
- Or have some higher tier version called Ultimate Cookie Protection {UDP)
Tasty Consensual Photos

I wonder how long until all the distros have this.

This is old news, from 2022!!

From the blog post:

"June 14, 2022"

"Updated Aug. 28, 2024"

"And starting in 2024, all our users can look forward to Firefox blocking even more third party cookies."
- Except it's still out of date because it mentions chrome also blocking third party cookies when at this point in time they've announced that they've abandoned that course of action now.

Starting in what versions?

Forgive me if this is an overly simplistic view but if the ads with cookies are all served on Google's platform say then would all those ads have access to the Google cookie jar?

If they don't now then you can bet they are working on just that.

The way I'm reading it, they allow the third party cookies to be used within the actual site you're on for analytics, but prevent them from being accessed by that third party on other sites.

But I just looked at the linked article's explanation, and not a technical deep dive.
So that's what third party cookies are. What this does is make it so that when you go to example.com and you get a Google cookie, that cookie is only associated with example.com, and your random.org Google cookie will be specific to that site.

A site will be able to use Google to track how you use their site, which is a fine and valid thing, but they or Google don't get to see how you use a different site. (Google doesn't actually share specifics, but they can see stuff like "behavior on one site led to sale on the other")
We'll have to see what happens but what you are talking about is what Mozilla calls Third-Party Cookies and... they are aware of it.

https://support.mozilla.org/en-US/kb/third-party-cookies-firefox-tracking-protection#:~:text=Third-party cookies are cookies,considered a third-party cookie.

I can't entirely tell if that means they will be put in the facebook cookie jar or if it will be put in the TentaclePorn Dot Org (don't go there, it is probably a real site and probably horrifying) cookie jar. If the former? Then only facebook themselves have that which... is still a lot better I guess? If the latter then that is basically exactly what we all want but a lot of sites are gonna break (par for the course with Firefox but...).
- TentaclePorn Dot Org (don’t go there, it is probably a real site and probably horrifying)
  
  It's registered through namecheap and points to cloudflare, but there's nothing behind cloudflare. It just times out. That was disappointing.
- The cookie would go to the Facebook or tentacleporn cookie jar depending on which site the user has actually visited. Whatever the domain in the address bar says.
- InB4 the guy who replies to defend tenticle porn.....
They are usually separate things. Cookies are produced/saved locally, to be read in the next visit (by the same website or maany websites basically forever unless you use firefox containers or at least clear them once in a while). There's also local storage which is different but can also be used to identify you across the web. Ads, trackers, all of these categories are often made of many small components: you read a single article on a "modern" newspaper website, hundreds of connection are being made, different tiny scripts or icons or images are being downloaded (usually from different subdomains for different purposes but there's no hard rule). It's possible to block one thing and not another. For example I can block Google Analytics (googletagmanager) which is a tracker, but accept all of Google's cookies.

I'm curious how this will affect OAuth (if at all). Does it use an offsite cookie to remember the session, or is that only created after it redirects back to the site that initiated the login?

I was also wondering that
I my experience it generally breaks it. Leveraging cookies on the auth domain is fine, but once you are redirected to another domain, that application needs to take the access and refresh tokens and manage reauthentication as a background process. Simply don't store those things as cookies though.
- Yeah that's kind of what I was getting at. It's been a while since I've worked with it so I couldn't remember if it used cookies for the token exchange or some other mechanism.

It baffles me that this was ever not the case.

It was - in the ancient times. Then, there were 3rd party cookies which you had to manually approve upon the initial creation. And then it went all down south and got abused via CDNs and ad networks.

Such a chad move. Respect!

Take that, cookie monsters!

Alright fine ill switch browsers AGAIN

Does this stop me from adding to my website an iframe to facebook where facebook can keep its cookies for my user? That would be great but I doubt it.

IIRC an iframe contents is treated as a separate window, so cookies aren’t shared either
- https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage
- Sure, but the separate window can be on a different domain. Now you have a way to share cookies across multiple websites on different domains if all of them include an iframe to this external domain. And you can use in-browser messages (see window.postMessage()) to communicate between iframes and main window.
I haven't worked with HTML since 1999; I hate that I'm just now finding out that iframes are somehow still a thing in the modern world. What the actual fuck. Why? Don't we have some fancy HTML5 or Ajax or something that can replace them?
- Yeah i don't know why, probably exactly because is such a neglected feature that it offers workarounds for some limitations, like in the case of cookie-related patterns.
- HTML5 can store HTML files inside of HTML files, allowing you to do what an iframe does but with a static (or updated when the page refreshes or whatever) html page
  
  AJAX also has something that can replace iframes
  
  But iframes continue to exist likely for legacy and how easy it is to get a basic page running using them for home projects

Maybe they should try to develop the uBlock Origin extension with the dev to make it last more.

They call it TCP. All we need now is IP, and we'll be set lol

Nah math is bad for internet.

Does making it the default also set it on my already-downloaded Firefox or only to new downloads? Just to know if I'll have to manually set it.

It very probably wont change your settings for you. That would be super annoying if it changed things you set on purpose.
- What if I never changed it in the first place. So before I had it on "default" and now it would still be on "default".
  
  Good to know anyway

Well, now how am I supposed to cross reference my need of fuzzy slippers and woodworking stuff?!

Yes we are going to enable this feature that is going to be irrelevant in the future, because where building an API in the browser to fetch browser History...

Yeah maybe 10 years late...

making Firefox the most private and secure major browser

If calling home and to selected 3rd party analytics aren't part of the metric then yes, Firefox might be the most private. What proof, even they say they've telemetry.

Here's all the domain Firefox uses for telemetry: https://raw.githubusercontent.com/MrRawes/firefox-hosts/firefox-hosts/hosts

So much for privacy.

Just move to LibreWolf.

You're aware that LibreWolf is a Firefox fork, right? The quote is literally "major browser", which obviously precludes fairly niche forks.
- Of course I am… and that’s the point. Librewolf is Firefox without the spyware.

Chrome, I'm looking at you. When are you getting it?

Never, because Chrome is a data harvesting platform.
- Made by an advertising company
Google recently cancelled their 3rd party cookie plan because they realized its not gonna work for their data harvesting goals
- Drats, I may need to switch.

Very good! Please remove anonym/PPA, DoH to cloudflare, Google search, telemetry, and pocket next, and I'll make a consideration to stop calling your browser malware!

Shocker, FF troll hates on FF even when it does good things
- 1 step forwards 3 steps back is still 1 step forward 3 steps back

Let me guess, itll still let websites see a list connected microphones and cameras with zero user interaction?

Trying

navigator.mediaDevices.enumerateDevices() .then(function(devices) { devices.forEach(function(device) { console.log(device.kind + ": " + device.label + " id = " + device.deviceId); }); })

it appears to have no label and the ids are randomly generated per site.
- So it still ahows the number of devices then?