Firefox Now Available with Enhanced Tracking Protection by Default
blog.mozilla.org
blog.mozilla.org
2014 me as a developer had Chrome as number 1 browser for both development and all rest. Firefox once a month just to check cross browser compatibility. And Safari was just installed without me using it.
2019 me uses Safari for everything except development. Excellent power consumption and UX. Firefox for development. And lastly Chrome for all web apps that only work on Chrome. ( Google Meet etc. ) I feel much much better that I am not dependent on chrome.
I use Firefox for all my browsing needs except for Google apps, for which I keep an install of Vivaldi around. I only really fire up Chrome if some stupid internal workplace app refuses to work on anything else. It truly is the new IE.
Funny, and true at least in the company I'm working for (officially supported browsers are primarily IE11 and optionally Chrome).
A colleague told me a few months ago that Firefox was not supported because it did not support some Windows "policies" (Windows or Active Directory? Not sure, no clue about that stuff) but that Firefox was going to support them soon... .
Both the ADMX templates for Windows and preference .plist for macOS are available from GitHub [3]. The full list of configurable preferences can be found on SearchFox.org [4].
As of Firefox 67 there are quite a lot of settings that can be managed now. Certainly enough for Firefox to be deployed in enterprise environments.
There was also a really interesting talk at MacADUK 2019 by Mike Kapley on the work Mozilla has done so far to support enterprise deployment [5].
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1433136
[2] https://github.com/mozilla/policy-templates/blob/master/mac/...
[3] https://github.com/mozilla/policy-templates
[4] https://searchfox.org/mozilla-central/source/browser/compone...
At least let me try and if it fails I’ll file an issue with FF so they can fix it and improve instead of locking me out with half-truths.
https://addons.mozilla.org/en-US/firefox/addon/reddit-enhanc...
Sure, we're still testing, if stuff works on IE10...
IE11 isn't much better, though...
I think Vivaldi (based on Chromium) is great for one time browsing (open -> close) But I got a bunch of sites I visit daily so I got them opened in Palemoon and open them when I need With another extension you can also unload tabs (manaual or auto, config it as you like) in Palemoon like Vivaldi (called hibernate in V)
Otherwise I discovered nextdns.io recently, which seems to work well too.
No, that's not what GP means. If the attacker manages to get malware on the Mac, for example by exploiting a browser 0day, then the attacker can simply circumvent the 2FA by making the Mac fetch the 2FA code. The user won't notice it.
Really, the SMS part is the actual weak link in the chain. Easier to hijack SMS than own a computer or phone.
That depends on the country, in Germany it's way more difficult.
Also, if you have touchID then you can use it on safari to autofill login credentials. I just wish safari had an active plugin ecosystem like firefox (or chrome) does.
The one thing I cannot stand is that fucking URL/search bar (I detest these things in general, but Safari has the worst implementation). Most implementations (e.g. Firefox and Chrome) will encode the space and go on their way, meanwhile Safari translates a space into a search unconditionally — because clearly I want my wikipedia viewing history to end up in my search history FFS. I'm also not a fan of view source opening in a dev tools frame versus a new tab/window like Chrome and Firefox.
Speaking of the dev tools, I was just poking around and saw this in the console:
[Info] Successfuly preconnected to https://securepubads.g.doubleclick.net/
[Info] Successfuly preconnected to https://aax.amazon-adsystem.com/
Interesting as I'm running uBlock Origin (which is, admittedly, more neutered on Safari). I know I've disabled that prefetching before, but I no longer see any options to turn it off. Speaking of UBO, Safari loves to claim UBO will increase energy consumption and slow down my browsing (HA). I wonder if the "disable plugins to save energy" option means that Safari will kill uBlock whenever it feels like. :/
What would you rather have it do? URL encode it?
Yes. I missed a few words on the original edit.
So yes Google, Chrome will always likely be running on my system, but in almost exactly the same place IE did 10-15 years ago. Is that something to be proud of?
I do look forward to the chrome devtools release videos, always learn something new.
Otherwise, Firefox has the better API for add-ons and a more 'open' approach in general, so there are a lot more things you can't do on Chrome that you can in Firefox than vice versa. I have yet to see a decent tree tabs extension for Chrome, for example. (They exist, but none compare to the one available for Firefox).
Edit: I'm mistaken - apparently you can : https://docs.firefox-dev.tools/backend/protocol.html ... So no reason to use chrome as a primary browser or development browser.
I use firefox for dev and browsing but my job requires me to check out chrome more because it's used the most. One thing I find myself using firefox for is the feature of visualising a flexbox which chrome doesn't have.
One of my favorite apps on macOS.
It also integrates very well with my other Apple devices, and works with AppleScripts and keyboard maestro to quickly do complex macros and talk to other apps.
I don't regret having stayed with Firefox through the years when Chrome was all the rage. IE6 was the most popular browser in the world when I first tried Firefox, so I know how it feels. Other browsers come and go, but Firefox keeps burning bright.
Safari needs a duplicate tab button though.
https://safari-extensions.apple.com/details/?id=com.el1t.uBl...
Despite other issues, which there are some, I'm really happy to see FF not only enable more ways for users to protect themselves - but to be rolling it out as a default.
A lot of non-technical users I've encountered usually want the extra (usually non-default) protections, but don't know where to begin (or what is even available) so they continue with the default installation. FF setting some of the more mature privacy protection features as a default moving forward is a great sign of commitment to the cause of bringing privacy to everyone. Even those who don't know how to poke around the settings or about:config.
>Today, we’re releasing the latest update for Facebook Container which prevents Facebook from tracking you on other sites that have embedded Facebook capabilities such as the Share and Like buttons on their site.
This is a much needed change that I'm also really happy to see. Not really containing anything if the embeds still function.
Tldr: I fully support security by default.
My only gripe is they still aren't blocking ALL ads, but regardless it's a way better user experience now than it ever was.
Firefox 67 feels like a whole new beast compared to their older versions.
If you haven't tried FF for a while I recommend doing so and I suggest trying it across multiple devices. The tab management, syncing, pinning and sending etc. across multiple devices is awesome.
I'll keep using Safari, which also gives me that wonderful cross-device syncing.
When you parrot this around, you stop Mozilla from feeling the pressure necessary to build a compelling product on Mac.
I depend on and use Firefox enough that I'd happily pay monthly for it.
I also recommend Privacy Badger. It’s a neat extension that automatically detects trackers by auto-learning. This means that Privacy Badger will catch trackers that aren’t caught by static lists, like what Firefox and uBlock Origin are doing.
Btw, both these extensions I mentioned are now deprecated in Chrome due to Manifest V3 and something tells me they’ll always be at home in Firefox ;-)
i trust ublock origin because gorhill is very public, passionate, and transparent. i trust privacy badger because it's backed by the EFF's reputation. those are two very high bars to set and they are literally the only two extensions i trust enough to install on my machine.
They survived for years without a permissions system in place. I'm glad that's now in place though.
I always felt uncomfortable letting random extensions active in Private Mode.
https://addons.mozilla.org/en-US/firefox/addon/multi-account...
Chrome makes it easy to switch profiles/accounts with the account button in the top right, but Firefox profile management is clunky. You have to choose on startup and can’t launch a window with a different profile from the browser itself.
Next time I tried, I found Multi-containers! It’s EXACTLY what I was trying to do with Chrome Profiles (isolate cookies per persona) and it improves on Chrome in a couple ways:
- lighter than Chrome profiles, very fast to create new containers
- Not tied to a google account
- multiple containers in the same window
- Domain-specific rules make sure you don’t cross-contaminate containers accidentally
- Profile stuff like History and bookmarks is shared across containers and securely synced with client side encryption by default.
You can also get a REAL win for privacy by adding the Temporary Containers extension [0]. This lets you create arbitrarily many containers. It defaults to being an option (right click -> open in temp container) but can be set much more aggressively. I have it create a new temporary container every time I move to a new domain. Amazing.
That DOES require some manual configuration to avoid breaking complex products like Office365. I created a huge regex that identifies Office365 domains and triggers a whitelist with less aggressive isolation. Still, not too much more work than running uBlock Origin with 3rd party resources disabled by default.
[0] https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
That's actually why I prefer the full profile option in Firefox (i.e. running 'firefox -p' and selecting a profile). I don't want shared history across profiles.
While I realize that's kind of the point, in my mind there is somewhat of a difference between "the site I'm on is tracking me to figure out how I use their site" vs. "any site I visit is essentially aggregated data because all the sites use the same major trackers and ad networks". I wonder if the big analytics companies will need to change their business model, or at least their tech, to account for these kinds of changes.
I think from a pure interested user perspective the bottom line is I don't care what happens to anything as long as I'm not tracked/measured etc. Find another way or just get lucky with the correct mixture of creativity and hiring. My web browsing does not exist for companies to exist.
You can still have analytics with this Firefox change, you just have to use your own domain for the cookies.
These changes make it harder for analytics companies to track users across domains, but still allows site owners to analyze their own traffic.
The list [1], which includes many APIs, also breaks hundreds of websites [2] that access those APIs
[1] https://github.com/disconnectme/disconnect-tracking-protecti...
I will be excited for the day when Privacy Badger is an unnecessary extension.
https://www.eff.org/privacybadger/faq#How-does-Privacy-Badge...
This sounds more like Safari's newer behaviour, which sounds good in theory but in Safari's case where it can't be turned off, it breaks things in practice. This seems like a good solution for people that are aware of what's happening enough to pay attention and disable it when something is not working as expected, but makes a bad default for the typical user.
Disconnect may or may not use M-L classifiers in their selection process, I don’t know.
In short, I'm looking for a list of instructions: go to Options > Privacy and Security > Content Blocking > make sure cookies is set to at least "All third party cookies...".
> For existing users, we’ll be rolling out Enhanced Tracking Protection by default in the coming months without you having to change a thing. If you can’t wait, you can turn this feature on by clicking on the menu icon marked by three horizontal lines at the top right of your browser, then under Content Blocking. Go to your privacy preferences and click on the Custom gear on the right side. Mark the Cookies checkbox and make sure that “Third-party trackers” is selected. To learn more about our privacy and security settings and get more detail on what each section – Standard, Strict, and Custom – includes, visit here [1].
(It is not “Block all third-party cookies”, make sure to select the correct one.)
Even with these changes, there are still lots of ways for Google to track you and monetize ads.
They should be focused on giving a better smooth UI, make it faster, remove unwanted extensions like pocket, make all the sites work.
Let's see how valid this comment is in couple of years.
Firefox is not as popular as Chrome thanks to the intense Google advertising some time ago. Even nowadays Google still advertises "this sites runs best on Chrome", kinda like Coca Cola still advertises its products even if they are already the leaders in the segment.
You can just put a banner saying this website works well on chrome.
FF should be more active in making all the sites work on their browser.
How? By matching any bugs or spec incompatibilities Chrome has that makes the site only work in Chrome? Or by begging the site authors to fix the HTML or CSS or JS? Because I don't see any other options.
The first defeats the purpose of having an independent browser (or web standards). The second won't work -- or at least, its success is determined entirely by market share, not directly by what Mozilla does.
I'm really not sure what you're asking for.
What Chrome only features are you possibly using that would mean a separate Firefox version?
Indeed Chrome is the new IE
It's like a privacy friendly social network can't beat Facebook.
Unless Google does something extremely stupid people are going to stick to it.
People use Gmail, YouTube, Docs,Google search, Android and all of them are in sync with chrome. It goes hand in hand with your life.
Same is for Apple, they make iPhone they have mail they have macos. Everything sync with safari. Makes life easy.
What does Firefox offer? Only a browser. And privacy is not going make people switch to them.
In what way are those sites in sync with Chrome? There's sync of tabs and such across devices, but Firefox has that too.
Like removing APIs used for Ad blocking effectively crippling Ad blockers?
> Everything sync with safari. Makes life easy.
Firefox can send tabs between your devices, not sure if it can sync them in their entirety. Not sure i'd want it to though.
Privacy is vegetables -- I know I should eat more, but I'm not going to go out of my way for it.
Now, everywhere offers a vegetarian option, it's normal. What it took was dedication by fanatics* and to increase mindshare amongst the young. I'd venture that the same conditions would reap the same rewards with privacy.
* that's a wee joke… or is it? :-)
The majority of regular users don't know the extent to which they are being tracked, because they don't have a good grasp of the technology or a good idea of what's possible.
Those are all things which do not differentiate Firefox from Chrome. They're focusing on that as well, but Chrome will never be able to copy their privacy-enhancing features, because that's Google's business model.
That aside, as commenters everywhere will tell you, Mozilla has made huge performance improvements in Firefox over the last few years and continues to do so. It's not like Mozilla has decided to stop doing everything except privacy.
So I think we’ve reached a phase where performance is good enough on any hardware for people to start worrying about the big picture problems like privacy and tracking as well. Not to the exclusion of performance - but it’s clearly become more important to random non-tech folks.
Profiles contain all your settings, history, bookmarks, themes, sync settings, etc. They’re stored in a folder on disk. It’s kinda a hassle to switch between them.
Containers isolate cookies (and other stuff?) within a single tab or group of tabs. It lets you run a specific website or set of websites in isolation from your other browsing activity. This has security benefits, but is also great for logging into the same service with multiple accounts simultaneously.
I was initially annoyed by Firefox profiles because they’re clunkier than Chrome accounts, but was very happy when I figured out that Firefox Containers gave me the isolation benefits I was actually looking for, with some real improvements over Chrome.
Except of course, syncing container rule settings across Firefox sync devices.
Getting more people on Firefox would do the tech world so much good, diversifying who controls what in the web.
So, stable should be perfectly fine for day to day use if you feel less adventurous. It's basically the release intended for world+dog. The only people actually using ESR probably are enterprises that for whatever reason actually care about which version of Firefox they are using and third party software integrators that just don't want to deal with major changes every minor release. Tor browser is a good example.
I'll click the update button after clicking reply. It seems I missed a few updates. Zero issues that I noticed with this one: 68.0b4.
Though that also means finding a good source for them as I currently just use the packages from Debian Stable (well, upcoming stable as I upgraded to Buster early).
How is this relevant? Did Dave Camp's SVP appointment trigger these changes? Honest question, because this is the first sentence of the article and I'm having a hard time understanding why.
Tracking protection is great though. I hope Firefox gains market share again, I love the direction it's taking.
Maybe it’s the same thing?
https://mozilla-services.readthedocs.io/en/latest/howtos/run...
https://bugzilla.mozilla.org/show_bug.cgi?id=1404042
I was able to achieve way better performance by changing this to `true` in `about:config`:
gfx.compositor.glcontext.opaque
gfx.webrender.all
gfx.webrender.enabled
If you set these options, and then later on, you find that your Firefox is super buggy and won't render anything properly and has weird crashes, it could be because you set these options — and it might take hours or days to realize that.
(And then reverse them, somehow, assuming that gfx.webrender.all hasn't broken about:config!)
My daily driver is Firefox Nightly with WebRender + Mesa-git + FreeBSD -CURRENT on a Radeon RX Vega. Haven't seen any GPU related crashes in months, it's very stable actually.
> reverse them, somehow, assuming that gfx.webrender.all hasn't broken about:config
well, safe mode is a thing, but you can also use MOZ_WEBRENDER=1 instead of the about:config prefs.
Hopefully Mozilla will have funding and manpower to improve this.
Thanks for the work nonetheless.
The last descriptive update was 4 years ago,
> As the list is increasingly managed according to policy, breakage is a feature, not a bug.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1101005
Among the broken websites is one I just completed, revddit, "removeddit for user pages":
https://www.reddit.com/user/revddit/
Creating a bot to spam your own website is obviously against the site rules. I see most of your posts on Hacker News are similarly promotional.
The bot itself only responds once per user or thread, and I've already blacklisted some subreddits per suggestions [1]. Feel free to pm me at u/rhaksw if you would like to discuss it further.
>[Please don't] write bots that reply to comments or send private messages without solicitation.
>[Please don't] have your bot reply to every instance of a common word or phrase
It also violates the site's self-promotion guidelines.
It's a spambot, plain and simple. I have reported it as such.
The same sort of thing undermined do-not-track headers. The instant they passed from being user-enabled to on-by-default, advertisers were presented with a strong excuse to ignore them.
It was worse for do-not-track, as all the major browsers enabled it by default, making it not at all a signal of user preference.
Context is fun eh.
> But the majority of Firefox users aren't choosing it for privacy reasons
I'd like some stats on that please. Given the market share Firefox has why are people installing Firefox?
> so these privacy-preserving features are not a good signal that the user actually wants that privacy.
I consider installing privacy protecting software a pretty good signal but maybe I'm being generous.
> It was worse for do-not-track, as all the major browsers enabled it by default, making it not at all a signal of user preference.
Seems like a pretty strong signal that people don't want to be tracked to me, if a browser impliments something as a default then it would suggest to me that they know more than 50% of their userbase would think not being tracked online is a pretty fucking good idea.
I don't have any stats, but I think many of the people choosing Firefox are doing so because Google is getting scary and Microsoft's offering is always warned against for security reasons, and that sums up the main browsers. In this choice between three things, you're barely getting one bit of user preference information.
> they know more than 50% of their userbase would think not being tracked online is a pretty fucking good idea.
Which in the mind of advertisers means the other less than 50% don't mind being tracked and so they should be allowed to track. But maybe they'd just go with any excuse.
I'm personally hoping that the EU at least slightly fixes things for Europeans when it starts enforcing the GDPR with big fines. Once every site has the required 'No, you may not track me' simple button, the nags will be less irritating because they'll actually be working.
The old version is so much more usable that I find myself using that computer much more frequently. It is rock solid with 100's of tabs open, all my extensions work and without silly restrictions on what they can and can not do and it uses a lot less memory. It's measurably faster too. I'm all for progress and improvements in software but after a long stretch of being a very ardent FF supporter I really do wonder if they have a future. If a competitor had a dream about what they could do to ruin Firefox they could not have done a better job.
Enhanced tracking protection is great but it doesn't matter if you push away your users.
I've also got a Firefox 52 installation lying around and the new version is noticably faster.
Bigger problem are the apps that consume too much CPU and memory. Unfortunately there is no nice way to avoid their killing the whole system (Linux here). But other browsers are no better. The browser makers should realize they are delivering a multiuser OS and protect the resources accordingly.
I can confirm both that newer firefox is notably more responsive than old, and that I (or an extension, though I don't have many) managed to get a ff profile into a state where it had inexplicably bad performance, esp. unpredictable long freezes.
Something really unusual is happening then. I'd second trying with a new profile. You can get general troubleshooting advice at https://support.mozilla.org/en-US/kb/firefox-takes-long-time...
(disclaimer: i work for mozilla, but not on the browser)
Meaning: I basically have a mindset which as a programmer would say: "shall I spend effort trying to optimize my app for users that have 200 tabs open? Naaaa, I don't see a usecase for that to happen."
I found the ScrapbookQ plugin, which also is able (with some work, admittedly) to import data from the old Scrapbook plugin:
Perhaps there should be a way to passivate tabs so that they don't take up memory when they are not used for a while.
It is rock solid with 100's of tabs open
I want to be very, very clear: there is nothing "wrong" with having 100s of tabs open, and it certainly would be good if all browsers worked just as well with 500 tabs as a single tab. I'm on your side!
But, in general, people making sweeping statements about software in public have what I feel is a responsibility to be clear when they're using it in ways that are off the beaten path.
Like if I complained about "Windows being buggy", and it turned out I was using a copy of Windows 95 as a substitute for a proper realtime operating system for my spaceship's navigation computer, that's something I really ought to mention upfront.
(Not that having large numbers of tabs is that outlandish, or outlandish at all)
goto about:config and search for gfx.webrender.enabled and make sure it's set to false.
EDIT: More info on the rollout https://www.ghacks.net/2019/05/20/firefox-webrender-rollout-...
While I agree with you that the whole addon migration was a disaster and the wounds are healing just very slowly, I don't have the impression that recent Firefox versions had any performance issues (at least on my machines).
This is one reason why the software industry as a whole sucks, we just do not give a damn about the users.
I had to run waterFox to keep my old plugins working.
I want someone to be as dedicated to the product as id was to doom. I want to be able to use their browser for free for a year or three. If I still like you then I'll mary you. Then I'll pay a yearly fee for as long as I live.
Edit: until you start to act a fool. If you do then you're out. Can someone please create this product?
2 weeks ago mozilla deactivated by super-incompetent accident all of their security add ons and required a completely opaque 'studies' tool to push an update.
With the security features deactivated tons of people who need to get work done or didn't understand what was going on used the web with all of the tracking features turned on, no doubt allowing tons of previously anonymous stored data on users to be de-anonymized. They don't have to be able to track everyone all of the time, you just have to really get a unique identifier on the browser tracks left in the databases. Many FF installs in linux distributions ceased to function at all.
These simple observations went hardly remarked on HN.
BoingBoing.net which has previously covered security issues well, somehow did not notice/report this event, which stands out in recent memory as one of the worst privacy catastrophes. An inquiry to Mr. Doctorow himself in regards to this, as well as why there is still a tracking F on the page in 2019, has gone unanswered.
Now, a month later, without any further discussion of this event, Firefox wants us to trust it to single-handedly defeat tracking with a single new catch-all feature.
On HN, top rated comments, rather than expressing skepticism and asking for details, are about a completely different browser, Safari.
Perhaps the best comment after the firefix addon-aggedon noted, FF does not have to have a studies feature, it does not have to push automatic updates, it does not have to have a single signing certificate for all of the add-ons which creates a single point of failure. This line of inquiry is devastating to the true nature of mozilla and the loyalties of the individuals behind this code.
I am posting this as a response to the lowest rated, yet in my opinion best comment in this topic, hoping that other people who notice the complete distractions and consensus cracking going on all over the place above the fold, will know where to look for someone saying something intelligent about the situation.
And so this: the problem is not the computers and the software, it is the nature of these institutions and the people in them. Semi-corporate half-charitable, expansive things like whatever Mozilla is lend themselves easily to the same sort of infiltration and takeover as normal, evil, corporations. Do you not think the fbi, cia, air force and mossad have been spending years getting their agents into the 'key positions' at mozilla? Does mozilla(or canonical) seem to you like an organization who could resist this sort of effort?
It is now obvious that Firefox is run by the enemies of open culture, and having only the choice between FF and Chrome, developed by an even less trustworthy institution, the internet as dreamed of by people who care about freedom and liberty of the individual is in serious trouble.
So the comment to which I am replying is the best, what shape of institution will create software to make the internet open and fair, and facilitate free speech without infiltration and subversion by spies and paid propagandists?
Why can all of the kings horses and all the kings men not create a functional browser that doesn't publicize reading habits and de-anonymize with extremely obfuscated input analysis, if not outright keylogging and password theft and intentional malware backdoors?
The browser has replaced the television for most people, if you haven't noticed, so this is important and how discusion platforms like hackernews deal with the discussion of this, reveals all we need to know about the institution and individuals behind hackernews.
Something is rotten here and it could not be more obvious to anyone still capable of independent thought.
This Wil have three consequences: Many websites will partially break? Which ones? webmaster will lack many data necessary to understand what users do on their platform, where they missclick, what they don't use etc, thus diminishing the ability of webmasters to make great products. *the most dramatic one: People will see ads but the owner of a website will no longer earn ad money, because those are the third party scripts that allowed to prove to the ad platform that a user had effectively seen X ads.
You're going to have to live with it. Get some beta testers onboard maybe.
99% of the data anyone is collecting which you call "stalking" is either available in server logs or could be easily modified so that it was. I guess you might just have to stop using the internet.
Websites can find a way to operate without this information stream or go bust, it's no skin off my nose one way or another.
> 99% of the data anyone is collecting which you call "stalking" is either available in server logs
It's very unlikely that server logs will be able to contain mis-clicks and behavioural analytics to the same extent that analytics services use.
> I guess you might just have to stop using the internet
Or, you know, do exactly what the post I replied to was complaining about and use a browser that takes steps to protect my privacy, various blocking plugins etc etc
Fortunately blocking the Firefox agent for non-paying users is easy, as is detecting the blocking of these scripts in the case that you try to change the user agent.
I'm perfectly happy with that arrangement. I think we ought to make it even more explicit so that folks like yourself get the message. It's my computer not your remote terminal.
"great products". Yeah, websites used to be much, much better before loading every bit of text with a remote javascript.
Here's a behavioral data point: Go back to making good websites and stop leaking private data everywhere. That's a great product.
This update is only about a select list of "bad" domains, though. I don't think most users would want to block literally all third party scripts (Source: I use uMatrix set to do that, and every other site I visit requires a complicated ritual of unblocking layers of scripts, frames, and XHR. Don't even get me started on static sites that display blank without scripts from a dozen CDNs. At least it's a good opportunity to rethink if I really want to go there)
> According to the original screenshot in the thread, your web page is sending an HTTP request to https://www.reddit.com/api/v1/access_token. If the user has previously visited reddit.com, this request will include the user's reddit cookies normally. Also, the HTTP request I mentioned before has a Referer header that points to the address of your web page by default in most browsers. So Reddit will be able to tell which user has visited which page on your site. In other word, Reddit will be able to see the user's browsing history, as if they had access to the user's computer.
> Note that nobody is blaming you or your site here.
[1] https://revddit.com/user/rhaksw
[2] https://groups.google.com/d/msg/mozilla.dev.privacy/XO84Ezrw...
A few things,
(1) Why does it matter in this case? Under what scenario can you imagine reddit abusing the knowledge that certain users are reading metadata about reddit accounts off-site?
(2) It seems to me Firefox could selectively choose not to send cookies and the referrer header in this case, rather than rendering entire sites broken. In that manner, sites accessing social media APIs can function, no data leaks, and everyone is happy.
(3) Hundreds of sites are broken like this. An issue tracking them has been open for 5 years [1]. The list used to identify "tracking" websites is huge and not maintained by Firefox [2].
(4) Due to this list, it is virtually impossible to build a web service that queries any social media site and runs on Firefox under default settings, significantly handicapping apps that can be built. Devs' recommendation was for me to move the code to a server, which would be expensive to maintain and would limit usefulness to users by obscuring code and introducing per-IP rate limits from the external API, in this case reddit's.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1101005
[2] https://github.com/disconnectme/disconnect-tracking-protecti...
You may be the exception. But its a privacy tradeoff that benefits the majority.
And let me say: if webmasters had shown any respect for privacy in the first place, maybe this would not have occured.
You could click on the reports on this page [1] to find out which sites are broken. Maybe I'll do it when I have a chance.
Any site that uses an API published by one in the disconnect.me list is rendered unusable. That list is 3,000 domains long, so even if there were only an average of 1 legit non-tracking site accessing each domain, that's still 3,000 broken websites.
> You may be the exception. But its a privacy tradeoff that benefits the majority.
I don't know that a tradeoff is necessary. It seems to me it would be possible to not send cookies for the 3,000 domains in the disconnect.me list when tracking protection is enabled.
You can get an idea of which sites are blocked by reviewing the list of blocked domains [1] (this includes many APIs, such as reddit.com) and a 5 year old issue where people post websites broken by tracking protection [2].
[1] https://github.com/disconnectme/disconnect-tracking-protecti...