Hacker News Reader

Comment by fancl20 | Hacker News Reader

Before anyone jumps to why Chrome doesn't block third-party cookies, some context:

Regulators did warn Google NOT TO block third-party cookies before they provide a replacement, UK CMA accepted the latest proposal from Google: https://www.gov.uk/government/news/cma-to-keep-close-eye-on-...

Apple's tracking rules also raised a lot of anti-trust concerns, giving advertisement in App Store unfair advantages among other ad platforms. Latest from German Government: https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pr...

Banning third-party cookies will increase the gap between Google, Microsoft, Apple and other ad platforms, because they can still track you based on your account (e.g. Gmail, Hotmail, iCloud). It's a huge red flag for antitrust cases they are facing (especially Google).

View on HN

Just to clarify, Total Cookie Protection in Firefox is not the same as blocking third-party cookies. Firefox will accept third-party cookies and send them back, but only on this particular site. So third parties (read ad networks) will be able to track you on any site, but not across sites (without some other means of tracking).

If you don’t want Firefox to do even that, you can go to Settings, click on Privacy & Security, then choose the Strict option. It’ll warn you that it might break sites, but you can always turn it off on a site-specific level by clicking on the shield in the address bar and turning off the toggle.

Be aware though that this will make firefox tell sites that you want a light color scheme instead of doing the more sensible thing and indicating no preference.

Though IIRC from some bugginess I was noticing a while ago, only to the JS API, it will still obey the dark color scheme media query (but sometimes inconsistently, I would load the same page in multiple tabs and sometimes get dark or light schemes).

This chain of replies containing only pertinent facts to inform the reader exemplifies what's so great about Hacker News. :-)

Interesting. I’m a light mode user, so hadn’t seen that.

Yeah, which is why sites are all requiring logins nowdays, so they can use server-side ID syncs.

> so they can use server-side ID syncs

Does this only work if you use the same email across multiple sites?

If so it's yet another reason to use a different email address with every site you sign up at.

Which incidentally Mozilla also has a product for: https://relay.firefox.com

(Disclosure: I work on Firefox Relay :) And yes, I know some people also have their own domain with unlimited email addresses.)

> I know some people also have their own domain with unlimited email addresses

A friend of mine does it the hardcore way, through DNS. He adds MX records for subdomains corresponding to the name of the site he's signing up for. Lets say his domain name is example.com:

bob@hilton.example.com bob@ycombinator.example.com bob@firefox.example.com and so on

He also does it for friends(!) meaning when he gives you "his" email, it's always of the form bob@<yourname>.example.com

If he tires of you or your comms get too spammy, he just bins the relevant DNS record. No more mail from you!

Woah, I did not know that, but that is indeed hardcore!

Is there any plans to support naming my different relay addresses? :)

The service is awesome but it's quite confusing to know which one to use on which websites and which one to delete etc

There is already! However, depending on how long you've been a user, you might not see it yet; there's an option to allow us to store that data on our servers that we didn't turn on for people who were using Relay before that setting was introduced. You can enable it here ("Allow ⁨Relay⁩ to collect data showing the sites on which your masks are created and used"): https://relay.firefox.com/accounts/settings/

If you use the extension [1] [2], it can also store them locally if you want, and it will automatically track where you used the addresses, rather than you having to manually label them.

And finally, if you have Relay Premium, you can claim your own subdomain, and come up with an arbitrary address name (e.g. "hackernews@yourdomain.mozmail.com"), but since that's less anonymous than a random address, we recommend only using that if you need to come up with an address on the spot in the real world.

[1] https://addons.mozilla.org/firefox/addon/private-relay/

[2] https://chrome.google.com/webstore/detail/firefox-relay/lknp...

I'm sorry to bother you (and rest of HN) about your product in an off-topic thread, but I noticed ⁨Relay Premium⁩ is available in limited countries. Considering some countries in that list are part of EU, what are the limitations why I'm not able to subscribe to the premium service? Or is there a way to join Relay Premium while not in listed countries (for example, having credit card issued by a listed country)?

I'm not entirely sure, actually, but I think it mostly has to do with legal clearance (but might be wrong here). Your country is autodetected from your IP, so a different credit card won't work, I think.

I did recently build a waitlist, so you can sign up to be notified when it becomes available in your country. We're not linking to it from anywhere yet, but if you promise not to tell (just kidding), you can already find it at https://relay.firefox.com/premium/waitlist/.

I've been following Firefox Relay features for a bit now. Is there a difference between the service offered by Firefox Relay premium to the free DuckDuckGo Email Protection?

Do you believe DDG will also eventually move to the subscription model for these features (unlimited aliases, reply to sender)?

I'm not super familiar with DDG's offering (and of course can't predict what they will do in the future), but some differences that I see on first glance:

- You need to use their app or browser extension to use it. (You can use Relay using just the website at https://relay.firefox.com.)

- Mozilla is a non-profit, whereas DDG is a for-profit company. (Though I should add that I'm a happy user of DDG search, and that I think they're pretty great.)

- There might still be a waitlist?

- Relay Premium has features like your own custom subdomain so you can come up with new addresses on the fly, the ability to reply to forwarded emails without revealing your address, unlimited addresses, of which I don't know whether DDG's service has them.

- On the other hand, Relay doesn't block trackers yet (but incidentally, that's the feature I'm working on right now).

- And of course, by subscribing to Relay Premium, you can support Mozilla and make it less reliant on Google :)

So yeah, not a particularly helpful comparison, since I'm not too familiar with their offering, sorry.

> Does this only work if you use the same email across multiple sites? At a huge risk of EU regulars cracking on, it is quite possible to track a user across multiple accounts by simply using a cookie that lives long enough (say, 30 days) to establish the connections between multiple accounts.

For a server-side ID sync, you don't even need user accounts. Just a unique ID set in a cookie will do.

How would this work when the cookie ID is different for every different embedding (first-party) context? That's the whole point of total cookie isolation.

Ah that’s very interesting. This really goes to show how powerful companies get when they have decent market share in the browser space while they have products on the web that have decent market share in other spaces, when there are grave concerns about what they do on either side of a decision. Chrome has been damn convenient from a dev perspective, and damn good, but the list of reasons I should be reaching for Firefox more often seems to be growing.

>Total Cookie Protection creates a separate cookie jar for each website you visit.

Means third parties win't be able to identify you qccriss sites through cookies. Means the Google Ads cookie or Floc ID will be different for each site you visit.

    they can still track you based on your
    account (e.g. Gmail, Hotmail, iCloud)

Really? I don't think so. How would that work? If you visit www.somesite.com - how would javascript on that site identify you via Gmail?

Okay:

1) you visit to www.somesite.com

2) it serves an ad <iframe src="www.google.com/givemeanad?userforme=waps&hespent=500"

3) your browser does a request to google. It sends:

a) your login cookie from your gmail session (or ...)

b) the referrer header tells it which site to serve the ad on

c) any information the site itself wants to attach to the request

4) Google/Microsoft/Apple store this information and can provide advertisers with your identity, all sites you visit that have their ads, the "flow" (what you visited in what order, e.g. how far did you get in an ordering funnel) and any information those sites share about your account on their site.

Okay, but: a) is blocked by site partitioning, b) doesn't have per-user tracking information, and c) only works (of course) if you've explicitly signed in with Google on that site. I don't think Google supports third-party tracking for ads via that personalization path yet, but plenty of non-Google advertisers do: they take your hashed email address and use that to replace their third-party tracking cookies. This is what the ad community is hailing as their "privacy first" approach that breaks Google's "monopoly"—sending your email address to every single advertiser who they partner with.

Because Google's, Apple's and Microsoft's accounts specifically are tied to their particular browser and/or OS, not just the websites you're on.

So are Firefox accounts but they probably don't have the numbers to engage in any particularly egregious behavior.

What kind of mechanic are you describing? Are you saying the browser is phoning home, telling Google which sites you visit?

Yes. You can turn it off, though, if you take Google at its word.

https://support.google.com/websearch/answer/54068?hl=en&co=G...

Well, Chrome obviously does if you’re ‘signed in’ to Google and haven’t turned off their sync settings… which I imagine is the most common end user path, and chrome is the most popular browser. https://www.google.com/chrome/privacy/

Are you saying that Google is using their control of the user agent to specifically tie a Google auth cookie to an individual third-party-context web request even when third party cookies are blocked? If so, that would be a major scandal. What evidence do you have that this is the case?

What application are you using to visit that site?

Yet another reason that we need to ensure that third party browsers are being used and in active development.

Reply on news.ycombinator.com