Hacker News Reader

Comment by xenophonf | Hacker News Reader

So here's something I've noticed that's confused me about Firefox's cookie handling: I have cookies turned off, but a PREF cookie for google.com keeps getting set. I've even tried blocking cookies from google.com, but I still see this cookie. I turned off Do Not Track but haven't tried disabling SafeBrowsing or all my extensions, so maybe it is one of those. Has anyone noticed this, too?

View on HN

See http://blog.sidstamm.com/2012/02/malware-and-phishing-protec... and http://bugzil.la/368255

Google's Safe Browsing API (malware and phishing protection) requires a cookie. But Firefox puts that cookie in a separate bucket than the one used for regular requests. If you have cookies enabled, you'll actually end up with two separate google.com "PREF" cookies - one for regular HTTP requests, and one just for for updating the Safe Browsing lists. Disabling Safe Browsing will prevent that cookie from every being sent, and should allow you to delete it (EDIT: modulo the cookie manager bug below).

UPDATE: It looks like http://bugzil.la/1026538 is why the cookie keeps reappearing.

Got it, thanks. I've disabled Safe Browsing and the cookie is gone. I'm curious: Does the Safe Browsing API offer any privacy guarantees? I confess that I don't really know how it works, although based on how it works with ClamAV, I assumed that Firefox periodically downloaded something from Google that let Firefox check a given URL against a list of known-bad hashes. If that's the case, I wouldn't mind leaving Safe Browsing enabled.

> I assumed that Firefox periodically downloaded something from Google that let Firefox check a given URL against a list of known-bad hashes.

Yes, that's basically how it works. Firefox periodically downloads a database of blocked URLs. Before loading a web page, it checks this database. If the check is negative then Firefox displays the page normally. If the check is positive, Firefox will also send a hashed URL to the Safe Browsing server to double-check whether to block the page or not.

This page has more documentation, including a link to the API specification:

https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...

See https://bugzilla.mozilla.org/show_bug.cgi?id=1008706

Haven't verified your claim but according to the linked bug, one has to wonder, what the Mozilla folks have not understand what "no cookies" and DNT means.

Oh, and Google should _really_ provide their Safebrowsing API without a cookie, too. Youtube-nocookie.com works fine too....

DNT only has the effect that the browser sets the Do Not Track header on each request, basically begging the server to not track the user.

It's probably related to their Google search partnership.

It's more likely to be a preemptive cookie set by a privacy extension.

It's more likely to be associated with built-in malware protection/phishing protection from Google. In Firefox's settings under Security, you can un-check "block reported attack sites" and "block reported web forgeries" and these cookies should disappear after running BleachBit.

these types of cookies may seem benign and helpful to users (and maybe they are), but i also wouldn't doubt that Google uses this information for persistent tracking.

it's already been disclosed that NSA uses Google PREF cookies to track users: http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10...

hence my other dispirited comment about the cookie UI... edit: reworded/clarified

At first I was only concerned about web page access tracking via this cookie (which indeed is set because of Safe Browsing---I turned both settings off, cleared my history, and the cookie is gone). If this cookie could be abused for location tracking, maybe it would be a good idea to leave Safe Browsing disabled.

Reply on news.ycombinator.com