Hacker News Reader

Comment by fauigerzigerk | Hacker News Reader

Here's my Firefox wishlist:

- Open new windows more quickly. Firefox feels sluggish (on Mac) even though it isn't, simply because it opens new windows far more slowly than Safari or Chrome.

- Use the platform native key store. I don't want my passwords stored unencrypted on disk. But I don't want to enter a separate master password either. I do want to use fingerprint/face unlock on mobile to reveal passwords.

- Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

View on HN

The window-opening animation might be a factor (applies across all of macOS).

You can disable it for all windows in all applications using a terminal command:

    defaults write NSGlobalDomain NSAutomaticWindowAnimationsEnabled -bool NO

You might need to restart apps to see this change.

Brilliant! It works. Thank you so much!

So, an OS setting makes FF look bad (...in comparison to the OS-integrated browser). Where have I seen that?

That is very handy preference, thank you for that!

Oh that's very nice. In iOS 7 we had a jailbreak tweak called NoSlowAnimations[0]. It was amazing how much a simple thing increased the perceived speed and responsiveness of the OS.

[0] http://cydia.saurik.com/package/com.marcosinghof.noslowanima...

You can completely disable animations in accessibility settings.

Do you mean "Reduce Motion" under Display?

Don't have an iphone handy but I think so. There are lots of options there to explore, there's also one to increase contrast and another to make buttons more evident. There's some cool stuff there in accessibility options

Ah, when "Mac" was mentioned I assume we were talking about MacOS, not iOS.

There is still a slow cross fade animation.

> - Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

This can be done with uBlock Origin and an "annoyances" filter list such as EasyList Cookie. It doesn't actually give websites consent to use of cookies, only hides the consent form.

Thanks! I really did not know of the annoyances, it really helps.

> lobby for a legally binding do-not-track header.

DNT is pretty dead, and IMHO was never a good idea in the first place. Opt-outing of invasive and unethical tracking is just weird. What about people who don't know about it? Or don't fully understand what it means?

It's almost like the Hitchhiker's Guide: "Well, you should have visited the planning department in the disused lavatory with a sign 'beware of the leopard".

I wrote some more about it over here: https://www.arp242.net/dnt.html

True, but is DNT the lesser evil compared to what we have now, which is only annoyance and effectively no control.

Well, if you're going to lobby for a change to the law then you might as well lobby for a change that's actually a good one, instead of a half-baked one that barely works.

I would say it depends on how good any alternative solution is and how realistic it is to pass.

Edit: Having read your blog post, I want to say that I'm not necessarily asking for the original definition of DNT to be reused. What I want is for the DNT header to have the same effect as if I had said no to all optional categories of cookies.

The status quo is that we are asked a "yes or manage" question where "manage" means something horribly complicated that no one does. If we redefine DNT to mean "no to everything optional" then it becomes a matter of local law to define what is and isn't optional. This allows for the sort of minimum level of consumer protection that you're asking for.

The law could also require that this DNT header is opt-out. A per-site overridable DT header if you will.

I'm not going to claim that I have thought this through properly. It's just something that I wish Mozilla did some work on.

The ultimate irony of DNT was that trackers could use the header as browser fingerprinting data..

Well, it only adds one bit of information, that is probably highly correlated with everything else being unique as well :)

I always thought the point of DNT wasn’t technical, but to make it impossible to argue either (a) that users don’t really care (many opted in), or (b) that Google et al respect user’s wishes without regulation or technical barriers (they are aware of DNT and its specific meaning and they ignore it). In other words, political maneuvering towards getting the entire industry to accept implementing that technical solution.

I just block traffic with the RFC3514 evil bit set at my firewall.

>- Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

Maybe there should be standardized interface for accepting privacy policy and cookies, all managed in browser UI so you could set default settings and give exceptions for specific sites without cluttering website with various popups... oh wait https://en.wikipedia.org/wiki/P3P

> I don't want my passwords stored unencrypted on disk.

Passwords are always stored encrypted when you save them in Firefox. You can read more about it here: https://support.mozilla.org/en-US/kb/how-firefox-securely-sa...

Same with Chrome actually. Your best bet is to use a proper password manager that integrates well.

I use this addon to get rid of the cookie banners: https://www.i-dont-care-about-cookies.eu

Firefox addon: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...

I'm extremely hesitant to give any extension automatic access to every single page I'm loading. I want Firefox to come with these things built in.

If you trust uBlock Origin, you can block cookie banners by adding https://www.i-dont-care-about-cookies.eu/abp/ to uBlock Origin’s custom filter list

Someone here responded[1], that you can just enable "EasyList Cookie" filter in adblock and it should have similar effect.

[1] https://news.ycombinator.com/item?id=21980909

Regarding #3 you might want to check out the "I don't care about cookies" add-on.

I use I on Firefox mobile and desktop - don't know if there's a chromium version.

Almost forgot I use it which is the most positive review an add-on like this could receive.

Don’t forget to chip in a few bucks to the author (if you can afford it) though

https://www.i-dont-care-about-cookies.eu/

Looks available on a gamut of different browsers.

Most of those are implemented in JS, so NoScript goes a pretty long way to fixing this. It would be nice if Firefox somehow auto-detected them, and other useless pop-overs, and nuked them.

Unfortunately, browsing with JavaScript disabled on mobile, I've noticed quite a large number of sites (usually WordPress blogs) that have the opt out button in the HTML, controlled server-side, so you have to enable JavaScript at least once to get rid of it.

Given that I prefer brave or bromite custom tabs (via Lynket) for short sessions on mobile (and prefer not to have long sessions on mobile at all), I generally just deal with it.

> Open new windows more quickly.

Windows open more quickly now than before. A few versions ago, it had become unbearably slow (I'm an FF user since Camino died), and I stuck to using tabs only, but 72 seems to have caught up again. I estimate that it's around 0.3s slower than Chrome on my machine.

> Use the platform native key store.

Amen to that.

Confirming the window opening speedup! Previously FF spent a lot of time compiling shaders when opening a new window. Perhaps these are now been cached.

> Open new windows more quickly. Firefox feels sluggish (on Mac)

I assume you mean new tabs?

That's very quick on Windows using FF 72. Interestingly that's been a long-time annoyance of mine when using Chrome on Mac - when compared to Safari which shines here.

>I assume you mean new tabs?

No, I mean windows. Opening tabs is very fast.

Many of my workflows begin by opening an new empty browser window. I also tend to open links in new windows instead of tabs. I'm not a huge fan of tabs generally.

That's probably a pretty unusual scenario, generally speaking. On Mac I can see it making sense. Makes me curious to try out this browsing workflow...

I don't think it is.

Whilst there are the "every tab in o e window open forever" people, there are plenty of "window for task" people.

Personally, I have been a window for task person 'since forever' (tabs are context depth in said task, hence "close tabs to right" being one of the most useful features).

"window for task" is not the same thing as "tend to open links in new windows"

It loads pages slower, too. Once they actually load though, performance is on par.

Regarding the native key store, why not just use full disk encryption? The session-specific encryption never made much sense to me, unless you share the computer with others. How many processes do you really have that are not running under your user or root?

I do use full disk encryption, but when I'm logged in, any program that runs as me can access my files (subject to some partial restrictions that Apple introduced a while ago). And anyone gaining access to my unlocked computer can easily copy that password file.

You could say once malware is executed with my credentials it's game over anyway. But I disagree with that. Having a file full of passwords stolen is far worse than than anything else, including key loggers, because it's maximum damage in a minimum amount of time.

I want to make that as difficult as possible for any attacker.

> when I'm logged in, any program that runs as me can access my files

On Windows, the same is true of the encrypted data; any program that runs as you can decrypt it. Is it different on macOS? How does the system authenticate a specific program?

On the Mac, Safari and Chrome store passwords in a key chain. To reveal any of those passwords you have to re-enter your macOS login password or whatever authentication method was used to log into the device (fingerprint, face ID, ...).

So it's not the program that is authenticated. The system simply makes sure that any program accessing that particularly sensitive data is really controlled by the logged in user.

This is entirely separate from protections for other files that may or may not be encrypted.

>Chrome store passwords in a key chain

Really? I thought Chrome, same as Firefox, stored credentials in an SQL file, the reason behind it being profiles and its built-in sync service.

It appears you're right. Chrome doesn't actually use the system key chain underneath, but the UX is exactly the same as Safari.

Autofill doesn't require password entry, but before revealing any stored passwords you have to re-authenticate using the regular system login method.

I wish Firefox did the same.

That's interesting and I wonder how they do it. Nevertheless this isn't good as it offers a false security sense since the end result is similar to using a master password which is the same as the login password.

You are more likely to lose your data while the computer is on and drives decrypted than when it is off. The threat model for FDE is thieves or government physically stealing your drive. Much more people get pwned in software than physically. I mean you don't just leave root shells laying around do you?

The question was whether the keychain really protects from those software attacks. I wondered mostly because I know that Windows will allow any process running as a certain user to decrypt data stored by any other process (at least if it's stored using the Data Protection API, like Chrome does for its passwords), so it only really protects your data from other users and their malware.

It seems that macOS authenticates each process, so that might provide some extra security.

Reply on news.ycombinator.com