Mozilla anti-cookie tool plans crumbling
sfgate.com
sfgate.com
It's a real shame, I've been blocking all 3rd party cookies and referrers for years and really want to see the web to a more privacy concious model. With all the web features tracking tricks out there now though, I feel it's nigh impossible.
Take for instance, common Javascript libraries hosted on CDNs. Every time you visit a jQuery based page where the js file is on a CDN you reveal to the host of that CDN (e.g. Google) what website you're on. You also put complete faith in that 3rd party CDN provider for your security.
3rd party cookies are just the tip of the iceberg in terms of how broken the web is for the privacy concious.
On the server side, companies are bound by data protection laws. Using the browser as a loop-hole for profit is not acceptable. Instead we get these absurd EU 'this site uses cookies' banners that do less than nothing for user privacy.
Unfortunately, it's not that simple.
From a user's point of view, asking questions that interrupt their browsing experience on every other site is usually unwelcome. The "We use cookies (like everyone else in the known universe)" messages in Europe that you mentioned are a great example, where good intentions ran headlong into practical limitations and the result was something that no-one actually likes.
From a business point of view, that same poor experience is a negative because it makes your site less attractive to visitors and ultimately hurts conversion. This remains true even if you're doing something reasonable with innocent intentions that almost all of your visitors would actually be happy for you to do.
I am very much in favour of protecting privacy on the Web and letting users make informed choices about when they are willing to give it up in return for something they value, but I don't see this working in practice until we have some sort of mandatory (with force of law) standards for disclosure by site operators that allow browsers to offer standardised preferences to their users that can be set once and then safely forgotten about. I think we need some sort of standardised, automation-friendly privacy policies, like the credit agreements where providers are required to provide key information up front in a standard format with the same assumptions for everyone, or the way a few open source licence agreements have become established and much of the time both the licensor and the licensee can just say "GPLv2" or "BSD" and everyone knows the deal.
Unfortunately, the wheels of standards turn slowly, the wheels of law more so, and the wheels of laws respected across borders even more so. Meanwhile, the wheels of businesses funded by invading privacy or otherwise exploiting users via modern technologies tend to turn very fast. I'm not sure how we fix this problem as long as the politicians are as technically illiterate and generally open to manipulation by special interest groups as they obviously are in many first world countries today.
It needs to be able to capture the things that significant numbers of people care about and summarise the main types of behavior encountered on real world web sites, but in a way that everyday users can see and configure in a few moments in their browser. This is a tall order, of course, but even a decent attempt at it would probably be better than the utter contempt for privacy and blatant exploitation of users' ignorance that is widespread today.
As a benchmark, I suggest looking at the way organisations like Facebook have presented privacy settings. Non-technical people understand concepts like sharing data with everyone vs. limited audiences, or allowing their name/photo to be associated with something. Significant numbers of people do set these preferences, and do object when they are violated or when their "preferences" are changed for them. But the choices probably have to be explained and configured at that kind of level of simplicity or it'll all be too much for most people to bother with.
(If there's a real app named Cookieland Adventure, I'm sure it's awesome, this was just a made up example, if you, your spouse or someone you vaguely remember talking to works on a Cookieland Adventure game for FB, I am sorry to associate your app with the scum of the earth)
That's the thing, blocking 3rd party cookies breaks (in my anecdotal experience) under 5% of sites. In general the only problem I see with it is when a site uses an iframe with a different domain that requires cookies which is a bad practice that shouldn't be done anyway. I can only think of two sites I know break because of this.
Mozilla doesn't seem to be breaking any new ground here. Safari already blocks third party cookies by default.
Does anyone know how I can load jQuery locally?
Mozilla will be attacked when sites start breaking.
You can experience it yourself in Firefox via Preferences -> Privacy -> Third party cookies -> Never
Oh crap, is THAT why I can usually not log in to disqus even when I disable Disconnect!
Man, that had been a mystery to me forever, I must have disabled third party cookies and not even remembered doing it.
Take for instance, common Javascript libraries hosted on
CDNs. Every time you visit a jQuery based page where the
js file is on a CDN you reveal to the host of that CDN
(e.g. Google) what website you're on
$ curl -I ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js
...
Cache-Control: public, max-age=31536000
...
(I work at Google on ngx_pagespeed, and sit next to the people who maintain the hosted libraries.)
Microsoft implemented a Do-Not-Track by default in IE 10 [0], only to later reveal it was planning an even more intrusive ad tracking system of its own [1]
Google added a Do-Not-Track feature belatedly to Chrome, buried within levels of settings and warnings [2]. And yeah, they're working on their own cookie replacement too [3].
Facebook meanwhile is tracking you across the web through its own re-targeting tech [4] and even your cursor movements on its site [5]
In fact, when companies like Google, Facebook and Microsoft want to dump cookies [6], I'd argue that we're already past the point where a Firefox can make a difference.
IMHO Internet tracking has become like fast food. A meaningful difference will only come when average users start caring about their privacy and are willing to make conscious choices for it.
[0] - http://arstechnica.com/information-technology/2012/08/micros...
[1] - http://adage.com/article/digital/microsoft-cookie-replacemen...
[2] http://www.pcmag.com/article2/0,2817,2411916,00.asp
[3] http://www.usatoday.com/story/tech/2013/09/17/google-cookies...
[4] - http://adage.com/article/digital/facebook-launches-retargeti...
[5] - http://www.pcmag.com/article2/0,2817,2426602,00.asp
[6] - http://online.wsj.com/news/articles/SB1000142405270230468250...
Definitely agreed. Unfortunately, I think it's much harder for your average web user to make that choice than for your average person to avoid fast food: Everyone knows what and where a grocery store is and that fast food is not usually nutritious, but I don't believe most web users understand how many browser options there are or, in many cases, what that actually means or what other means could help preserve their privacy, if they understand this particular privacy issue in the first place.
you probably have 3rd party cookie working as usual.
I think we're very lucky to have Mozilla in the FOSS world but the will for better privacy will have to come from the community.
[0] - http://www.forbes.com/sites/timworstall/2013/01/22/so-why-is...
[1] - http://www.mozilla.org/en-US/foundation/annualreport/2011/fa...
edit: I didn't state it explicitly but my argument is based on the idea that Google is primarily interested in a low-privacy and ad-based web.
And apple probably disabled some 3rd party cookies more to harm google than thinking on user privacy (now this is speculation, but add that the fact that jobs had said he'd gone nuclear on google at the time)
Searching for Jonathan Mayer in Bugzilla https://encrypted.google.com/search?sitesearch=bugzilla.mozi...
Here is the meta bug: https://bugzilla.mozilla.org/show_bug.cgi?id=818337
I think this is the patch: https://bugzilla.mozilla.org/show_bug.cgi?id=818340
Such dramatic silliness. An actual first stirke would be NoScript and AdBlock installed by default (which I already do to begin with). Removing third-party cookie functionality is just a shot across the bow.
As for the immediate reason Mozilla is backing off, have you ever wondered how you make money as a browser? One of the key revenue streams for a company like Mozilla or Opera is referral fees from search engines. Ever wonder why Microsoft is so desperate to make it difficult to use non-IE browsers? it's because they have their own search engine.
My own personal speculation is that some of Mozilla's search engine customers, whose business model often includes using cookies, came forward and indicated their displeasure with this initiative and pointed out that this would basically amount to biting the hand that feeds it on Mozilla's part.
I invite all who haven't done so yet to change their browser's settings right now to refuse 3rd party cookies. They have almost no legitimate use anyway. The only breakage of a useful site I'm aware of pertains to active Disqus logins, a price well worth paying in my opinion.
The 3rd party cookie tracking problem is worse than most people think. For instance, every time your browser pulls a file from a CDN, you're tracked.
Or they could make a system where a site can set their own unique id, that they can use.. oh, maybe have a custom key for this value.. and maybe they could call it a token system.. ooh or maybe cookies.
/sarcasm
http://www.electronista.com/articles/12/02/16/google.alleged...
If you visit a website (Assuming you don't go via some anonymizer proxy), they can track you, and they can pass your details to any 3rd party who wishes to also track you.
Cookies are the easiest way for them to do that, but its absurdly naive to think that if you block cookies then people won't track your browser activity online.
If you don't want to be 'tracked', stop generating HTTP requests, or do them through an anonymizer service. And good luck getting any website to work properly.
Now, sure there are other ways of doing cross-site tracking, like Etags, fingerprinting and such, but why shouldn't we try to plug those leaks too instead of giving up?
Current situation:
* You request website A, which includes 3rd party code from C. C drops a cookie
* You request website B, which includes 3rd party code from C. C knows you previously visited A.
* You request website A, which includes 3rd party code from C. Website A sends details of your visit via a backchannel to C.
* You request website B, which includes 3rd party code from C. Websites B sends details of your visit via backchannels, and C knows you previously visited A.
Yes - You should give up if you think you will able to continue sending websites HTTP requests directly, whilst not being tracked.
So, yeah, I see your point, but maybe I _would_ rather make it much more expensive to do that, and much harder for them to do it succesfully rather than messing up a technical detail.
On the other hand, I guess eventually they'd get it right in commodity software that everyone can use. Eventually.
Really, I don't know why anyone that wants to do the kind of tracking we're talking about is using cookies anyway, instead of user-agent fingerprints that have been shown to be pretty much unique anyway. So the cookies is perhaps all a distraction. The browser makers don't need to invent a new cookie-less browser fingerprint tracking system, they've already got it with the over-specialized user-agents.
you have unique combination of IP+UserAgent+extra Headers. That is enough. A and B does not even have to send anything. And this will continue to work even without cookies.
Same with User Agent: not useful if you're using Chrome on your laptop and Safari on your phone.
For example, google provides jquery CDN. website A and B uses that to save some cents on bandwidth. Google now knows you visited which pages on website A and B. and if A was a backpack store and B was a pressure cooker review, expect the NSA :D
Sure, server-side logging is always possible, but (AFAIK) advertisers and data miners have little interest in this information because it requires trusting the website owner not to forge results, which is obviously a very stupid idea when your business revolves around purchasing and selling ad impressions. Precluding the practical methods of this type of data mining (ideally by requiring whitelisting of Javascript and all access to third party resources, but disabling third party cookies is a good practical step) could greatly reduce the amount of surveillance that users are subject to, by eliminating the most common incentives to perform it.
>If you don't want to be 'tracked', stop generating HTTP requests, or do them through an anonymizer service.
I hope you realize that the effectiveness of services like Tor is greatly reduced if you aren't using the same techniques to reduce your surveillance "attack surface" that people are advocating for regular, non-anonymous browsing. It's really not hard to see why; considering the tracking cookie example: A unique cookie makes it clear to a site operator that the requests coming from all these different exit nodes are really originating from the same user. A third party tracking cookie can then make it clear to that third party that the same user is visiting sites A, B, and C over Tor. All it takes at this point is small handful of screwups (from mentioning personal information to something as innocuous as reading a news article that is only relevant to people living in a certain location) to greatly reduce the search space required to identify you. "Uses xmonad and likely lives in New York City" could be more than enough to tie a large amount of your Tor browsing activity to a small set of suspects, in this case.