Hacker News Reader

Comment by ComodoHacker | Hacker News Reader

Just to clarify, Total Cookie Protection in Firefox is not the same as blocking third-party cookies. Firefox will accept third-party cookies and send them back, but only on this particular site. So third parties (read ad networks) will be able to track you on any site, but not across sites (without some other means of tracking).

View on HN

If you don’t want Firefox to do even that, you can go to Settings, click on Privacy & Security, then choose the Strict option. It’ll warn you that it might break sites, but you can always turn it off on a site-specific level by clicking on the shield in the address bar and turning off the toggle.

Be aware though that this will make firefox tell sites that you want a light color scheme instead of doing the more sensible thing and indicating no preference.

Though IIRC from some bugginess I was noticing a while ago, only to the JS API, it will still obey the dark color scheme media query (but sometimes inconsistently, I would load the same page in multiple tabs and sometimes get dark or light schemes).

This chain of replies containing only pertinent facts to inform the reader exemplifies what's so great about Hacker News. :-)

Interesting. I’m a light mode user, so hadn’t seen that.

Yeah, which is why sites are all requiring logins nowdays, so they can use server-side ID syncs.

> so they can use server-side ID syncs

Does this only work if you use the same email across multiple sites?

If so it's yet another reason to use a different email address with every site you sign up at.

Which incidentally Mozilla also has a product for: https://relay.firefox.com

(Disclosure: I work on Firefox Relay :) And yes, I know some people also have their own domain with unlimited email addresses.)

Is there any plans to support naming my different relay addresses? :)

The service is awesome but it's quite confusing to know which one to use on which websites and which one to delete etc

There is already! However, depending on how long you've been a user, you might not see it yet; there's an option to allow us to store that data on our servers that we didn't turn on for people who were using Relay before that setting was introduced. You can enable it here ("Allow ⁨Relay⁩ to collect data showing the sites on which your masks are created and used"): https://relay.firefox.com/accounts/settings/

If you use the extension [1] [2], it can also store them locally if you want, and it will automatically track where you used the addresses, rather than you having to manually label them.

And finally, if you have Relay Premium, you can claim your own subdomain, and come up with an arbitrary address name (e.g. "hackernews@yourdomain.mozmail.com"), but since that's less anonymous than a random address, we recommend only using that if you need to come up with an address on the spot in the real world.

[1] https://addons.mozilla.org/firefox/addon/private-relay/

[2] https://chrome.google.com/webstore/detail/firefox-relay/lknp...

I've been following Firefox Relay features for a bit now. Is there a difference between the service offered by Firefox Relay premium to the free DuckDuckGo Email Protection?

Do you believe DDG will also eventually move to the subscription model for these features (unlimited aliases, reply to sender)?

I'm not super familiar with DDG's offering (and of course can't predict what they will do in the future), but some differences that I see on first glance:

- You need to use their app or browser extension to use it. (You can use Relay using just the website at https://relay.firefox.com.)

- Mozilla is a non-profit, whereas DDG is a for-profit company. (Though I should add that I'm a happy user of DDG search, and that I think they're pretty great.)

- There might still be a waitlist?

- Relay Premium has features like your own custom subdomain so you can come up with new addresses on the fly, the ability to reply to forwarded emails without revealing your address, unlimited addresses, of which I don't know whether DDG's service has them.

- On the other hand, Relay doesn't block trackers yet (but incidentally, that's the feature I'm working on right now).

- And of course, by subscribing to Relay Premium, you can support Mozilla and make it less reliant on Google :)

So yeah, not a particularly helpful comparison, since I'm not too familiar with their offering, sorry.

I'm sorry to bother you (and rest of HN) about your product in an off-topic thread, but I noticed ⁨Relay Premium⁩ is available in limited countries. Considering some countries in that list are part of EU, what are the limitations why I'm not able to subscribe to the premium service? Or is there a way to join Relay Premium while not in listed countries (for example, having credit card issued by a listed country)?

I'm not entirely sure, actually, but I think it mostly has to do with legal clearance (but might be wrong here). Your country is autodetected from your IP, so a different credit card won't work, I think.

I did recently build a waitlist, so you can sign up to be notified when it becomes available in your country. We're not linking to it from anywhere yet, but if you promise not to tell (just kidding), you can already find it at https://relay.firefox.com/premium/waitlist/.

> I know some people also have their own domain with unlimited email addresses

A friend of mine does it the hardcore way, through DNS. He adds MX records for subdomains corresponding to the name of the site he's signing up for. Lets say his domain name is example.com:

bob@hilton.example.com bob@ycombinator.example.com bob@firefox.example.com and so on

He also does it for friends(!) meaning when he gives you "his" email, it's always of the form bob@<yourname>.example.com

If he tires of you or your comms get too spammy, he just bins the relevant DNS record. No more mail from you!

Woah, I did not know that, but that is indeed hardcore!

> Does this only work if you use the same email across multiple sites? At a huge risk of EU regulars cracking on, it is quite possible to track a user across multiple accounts by simply using a cookie that lives long enough (say, 30 days) to establish the connections between multiple accounts.

For a server-side ID sync, you don't even need user accounts. Just a unique ID set in a cookie will do.

How would this work when the cookie ID is different for every different embedding (first-party) context? That's the whole point of total cookie isolation.

Reply on news.ycombinator.com