Hacker News Reader

Comment by dev_tty01 | Hacker News Reader

Is this better or worse than Safari's "Prevent cross-site tracking" feature?

https://support.apple.com/guide/safari/prevent-cross-site-tr...

It appears Safari is just blocking the cookies, while Firefox is isolating the cookies. I guess Safari has to keep track of who to block while Firefox just isolates everybody. Are there other benefits to the Firefox approach?

Frankly, I have a hard time understanding why this Cookie Sandbox approach wasn't implemented a long time ago. I get that 25 years ago we weren't concerned about privacy, but there has been plenty of time to fix this. Advertiser influence?

View on HN

I believe this is part of the "Prevent cross-site tracking" feature. I do know that Webkit/Safari has had this feature for a while now, under the name "Partitioned storage." Safari has a handful of other policies under the "Intelligent Tracking Prevention" banner, like blocked or ephemeral cookies for non-first-party domains.

Firefox is playing catch-up with this feature. The announcement says "...making Firefox the most private and secure major browser available across Windows and Mac." Note the part that I've emphasized.

3 hours later it says "... across Windows, Mac and Linux."

Sites that use cross site resource will still work. Except the cross domain resource provider will always see the same domain coming to get resource.

For example, if you are on Site A and use cross site resource from Site C. The site C will get a cookie C('A)

And in another day, you visited a Site B that also use resource from Site C. The site C get a cookie C('B).

And C('A) != C('B)

Although these cookie are both issued by Site C. They are associated to different first party domain and can't be connected directly.

It's just like you open a private browser session for every site you visit.

I think it is a extension usage from Firefox's container technology.

Thanks. In case anyone is interested, I looked around a bit more and found these descriptions of Safari's (Webkit) intelligent tracking prevention starting from 2017 (in reverse chronological order):

Safari Tracking Prevention background:

https://webkit.org/tracking-prevention/#intelligent-tracking...

Blog posts about tracking prevention updates:

https://webkit.org/blog/11545/updates-to-the-storage-access-...

https://webkit.org/blog/10218/full-third-party-cookie-blocki...

https://webkit.org/blog/9521/intelligent-tracking-prevention...

https://webkit.org/blog/8613/intelligent-tracking-prevention...

https://webkit.org/blog/8311/intelligent-tracking-prevention...

https://webkit.org/blog/8142/intelligent-tracking-prevention...

https://webkit.org/blog/7675/intelligent-tracking-prevention...

Here is their tracking prevention policy definition:

https://webkit.org/tracking-prevention-policy/

There has been first party isolation from Tor Browser in Firefox for a while.

https://addons.mozilla.org/en-US/firefox/addon/first-party-i...

That addon has links with info and just twiddles an about:config setting. It can break things (for example some ways Paypal is used by websites, although other ways work fine). There has also been the ability to block third party cookies for a very long time, possibly as long as there have been cookies, but it can also break things. As I understand it Total Cookie Protection is similar to these but with some exceptions so that not much breaks that users would notice.

Reply on news.ycombinator.com