• ngwoo@lemmy.world
      link
      fedilink
      English
      arrow-up
      140
      arrow-down
      4
      ·
      4 months ago

      Advertisers track you with device fingerprinting and behaviour profiling now. Firefox doesn’t do much to obscure the more advanced methods of tracking.

        • hoot@lemmy.ca
          link
          fedilink
          English
          arrow-up
          62
          ·
          4 months ago

          Lots do. But do you know anyone that turns JS off anymore? Platforms don’t care if they miss the odd user for this - because almost no one will be missed.

          • pixelscript@lemm.ee
            link
            fedilink
            English
            arrow-up
            30
            ·
            4 months ago

            “Anymore”? I’ve never met a single soul who knows this is even possible. I myself don’t even know how to do it if I wanted to.

            I do use NoScript, which does this on a site-by-site basis, but even that is considered extremely niche. I’ve never met another NoScripter in the wild.

            • Buddahriffic@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              4 months ago

              I like the grid add-on for Firefox. It disables 3rd party pretty much anything by default. And you can control cookies separately from everything else, and I can’t remember any time I’ve needed to enable those cookies to get a site working properly (whereas sometimes you need to enable scripting, media, or iframe for cdn or something).

            • BalooWasWahoo@links.hackliberty.org
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              4 months ago

              The people who I’ve tried to get on NoScript seem to have the brain capacity of goldfish. If the site doesn’t instantly work, it’s as if the sky has fallen and there is no way to convince them to pay attention to which scripts are actually needed.

              It’s a rare breed that is willing to put up with toggling different scripts on and off. I’ll also acknowledge that too many people (including me) are in a giant rush. For work-type stuff, I have the laptop without noscript, because sometimes I do need something to work absolutely right now.

              • papabobolious@feddit.nu
                link
                fedilink
                English
                arrow-up
                6
                ·
                4 months ago

                You don’t think you are being a tad judgemental?

                People whose lives revolve around fashion probably think you dress like shit.

                People who love food probably think you eat like shit.

                People who love cars probably think you are a shit driver.

                You probably love computers and care about privacy, and you are shitting on regular users(assumption, admittedly) for not being invested.

                They had something that was working, you present noscript, thing no longer works. If you are not invested, how are you going to see the appeal of extra work?

              • pixelscript@lemm.ee
                link
                fedilink
                English
                arrow-up
                3
                ·
                4 months ago

                Well, you know what they say. You can lead a horse to water, but you can’t make it interested in learning about the water cycle to have a deeper understanding of why the river flows in the first place.

          • Prison Mike@links.hackliberty.org
            link
            fedilink
            English
            arrow-up
            10
            ·
            edit-2
            4 months ago

            I go hard with DNS-based ad blocking and I’m constantly confirming it works by checking the network tab in developer tools. I’m basically only seeing first party scripts and CDN assets — 99% of websites load all the tracking garbage from third-party domains that can be easily blocked.

          • MigratingtoLemmy@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            4 months ago

            uBlock origin + NoScript for me. I deal with the bigger umbrella of scripts with uBlock and then fine tune permissions to the ones that uBlock allowed with NoScript.

            They might be fingerprinting me using these two extensions though.

          • pmc@lemmy.blahaj.zone
            link
            fedilink
            English
            arrow-up
            2
            ·
            4 months ago

            I use LibreJS with few exceptions. If I need to use a site that requires non-free JavaScript, I’ll use a private browsing window or (preferably) Tor Browser.

        • Septimaeus@infosec.pub
          link
          fedilink
          English
          arrow-up
          9
          ·
          4 months ago

          Not all but most, yes. But TBF, sites that still function with JS disabled tend to have the least intrusive telemetry, and might pre-date big data altogether.

          Regardless, unless the extent of a page’s analytics is a “you are the #th visitor” counter, all countermeasures must remain active.

        • ngwoo@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          4 months ago

          It’s really strange how they specifically mention HTML5 canvas when you can run any fingerprinter test on the internet and see that Firefox does nothing to obfuscate that. You can run a test in Incognito mode, start a new session on a VPN, run another test, and on Firefox your fingerprint will be identical.

          • icydefiance@lemm.ee
            link
            fedilink
            English
            arrow-up
            3
            ·
            edit-2
            4 months ago

            Well yeah, they’re just blocking known fingerprinting services. If you use a tool that they don’t recognize, it’ll still work, but their approach will still block the big companies that can do the most harm with that data.

            The only alternative is probably to disable WebGL entirely, which isn’t a reasonable thing to do by default.

            • Venia Silente@lemm.ee
              link
              fedilink
              English
              arrow-up
              2
              ·
              4 months ago

              WebGL

              I wish Firefox had a per-site or per-domain preference for WebGL (as well as for wasm, etc), the same way we have per-site cookies or notifs preferences. It’d help clear most issues regarding this.

      • KairuByte@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        1
        ·
        4 months ago

        Honestly would be hard to do. There a perfectly legitimate and everyday uses for pretty much everything used in fingerprinting. Taking them away or obscuring them in one way or another would break so much.

        • Justin@lemmy.jlh.name
          link
          fedilink
          English
          arrow-up
          15
          ·
          4 months ago

          Librewolf has Resist Fingerprinting which comes pretty far.

          Every Librewolf browser uses the same windows user agent, etc. But there are downsides, like time zones don’t work, and sites don’t use dark mode by default.

          And even then, EFF’s Cover Your Tracks site can still uniquely identify me, mainly through window size. That’s one of the reasons why Tor Browser uses letterboxing to make the window size consistent.

            • Justin@lemmy.jlh.name
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              4 months ago

              Oh neat! I just tried it, and it seems it’s broken on Gnome when using 125% scaling though :/ Still cool to have the feature!

              I also just figured out how to expose dark mode and my timezone though with RFP, which is useful.

          • mitrosus@discuss.tchncs.de
            link
            fedilink
            English
            arrow-up
            3
            ·
            4 months ago

            I don’t know what letterboxing is. But if window size is used to identify me, can’t it be circumvented simply by using the window in restored size, and not maximised?

            • Venia Silente@lemm.ee
              link
              fedilink
              English
              arrow-up
              4
              ·
              4 months ago

              Your restored window size is even more unique than your maximised window size!

              The correct solution is to just not make the window size available to JS or to remotes at all. There’s no reason to ever need specifics on window size other than CSS media-queries, and those can be done via profiles.

              • mitrosus@discuss.tchncs.de
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 months ago

                But the restored size keeps changing - can’t be profiled, right?

                And how do I not make the size available “to JS or to remote”?

                • Venia Silente@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  4 months ago

                  Changing the source code of the browser, unfortunately. I don’t know what Tor Browser does or how, but basically you’d have to do about the same as they do.

  • ArchRecord@lemm.ee
    link
    fedilink
    English
    arrow-up
    310
    arrow-down
    1
    ·
    4 months ago

    For those who don’t care to read the full article:

    This basically just confines any cookies generated on a page, to just that page.

    So, instead of a cookie from, say, Facebook, being stored on site A, then requested for tracking purposes on site B, each individual site would be sent its own separate Facebook cookie, that only gets used on that site, preventing it from tracking you anywhere outside of the specific site you got it from in the first place.

    • peopleproblems@lemmy.world
      link
      fedilink
      English
      arrow-up
      207
      arrow-down
      2
      ·
      4 months ago

      Hahahahaha so it doesn’t break anything that still relies on cookies, but neuters the ability to share them.

      That’s awesome

      • ripcord@lemmy.world
        link
        fedilink
        English
        arrow-up
        60
        ·
        edit-2
        4 months ago

        Honestly, I thought that’s how it already worked.

        Edit: I think what I’m remembering is that you can define the cookies by site/domain, and restrict to just those. And normally would, for security reasons.

        But some asshole sites like Facebook are cookies that are world-readable for tracking, and this breaks that.

        Someone correct me if I got it wrong.

        • ArchRecord@lemm.ee
          link
          fedilink
          English
          arrow-up
          31
          ·
          4 months ago

          Total Cookie Protection was already a feature, (introduced on Feb 23st 2021) but it was only for people using Firefox’s Enhanced Tracking Protection (ETP) on strict mode.

          They had a less powerful third-party cookie blocking feature for users that didn’t have ETP on strict mode, that blocked third party cookies on specific block lists. (i.e. known tracking companies)

          This just expanded that original functionality, by making it happen on any domain, and have it be the default for all users, rather than an opt-in feature of Enhanced Tracking Protection.

          • ripcord@lemmy.world
            link
            fedilink
            English
            arrow-up
            9
            ·
            edit-2
            4 months ago

            That’s not what I was thinking of, which was even more fundamental. But that’s good info (and another way to cover stuff in the article).

            Edit: what I was thinking originally was really stupid, that 3rd-party cookies weren’t allowed at all. Which was really dumb since of course they are.

            • catloaf@lemm.ee
              link
              fedilink
              English
              arrow-up
              8
              ·
              4 months ago

              No, you weren’t far off. A single site can only get and set cookies on its domain. For example, joesblog.com can’t read your Facebook session cookie, because that would mean they could just steal your session and impersonate you.

              But third-party cookies are when joesblog.com has a Facebook like button on each post. Those resources are hosted by Facebook, and when your browser makes that request, it sends your Facebook cookies to Facebook. But this also lets Facebook know which page you’re visiting when you make that request, which is why people are upset.

              With this third-party cookie blocking, when you visit joesblog.com and it tries to load the Facebook like button, either the request or just the request’s cookies will be blocked.

              Although that raises an interesting question. Facebook is at facebook.com, but its resources are all hosted under fbcdn.com. Have they just already built their site to handle this? Maybe they just don’t strictly need your facebook.com cookies to load scripts, images, etc. from fbcdn.com.

        • Telorand@reddthat.com
          link
          fedilink
          English
          arrow-up
          26
          ·
          4 months ago

          They’ve been doing this with container tabs, so this must be the successor to that idea (I’m going to assume they’ll still have container tabs).

          • jollyrogue@lemmy.ml
            link
            fedilink
            English
            arrow-up
            21
            ·
            4 months ago

            Container tabs are still a thing in FF. This is based on that work, if I remember correctly.

              • Kushan@lemmy.world
                link
                fedilink
                English
                arrow-up
                5
                ·
                4 months ago

                Same, they’re an absolute game changer for me. I have to use multiple different identities in work due to separate active directories and container tabs makes it super easy

          • snaggen@programming.dev
            link
            fedilink
            English
            arrow-up
            7
            ·
            4 months ago

            Container tabs are still useful, as they let you use multiple Cookie jars for the same site. So, it is very easy to have multiple accounts on s site.

      • FiniteBanjo@lemmy.today
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        4 months ago

        Unless that cookie was somehow important for you to use both sites, but thats incredibly rare.

      • Buddahriffic@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        4 months ago

        From my experience, blocking 3rd party cookies in general doesn’t seem to make any difference for site functionality anyways. Though I never log into sites with a Google or FB account other than Google or FB sites (and rarely at all for the latter).

    • Liam Mayfair@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      6
      ·
      4 months ago

      Isn’t this basically Firefox’s version of the third party cookie block that Chrome rolled out a few months ago? Or am I missing something here?

      I mean, it’s good news either way but I just want to know if this is somehow different or better.

      • The Quuuuuill@slrpnk.net
        link
        fedilink
        English
        arrow-up
        11
        ·
        4 months ago

        It increases implementation complexity of the browser and loses people who fund Firefox and contribute code $$$

    • FiniteBanjo@lemmy.today
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      5
      ·
      edit-2
      4 months ago

      Disabling cross site cookie is already a thing for decades…

      Same with Do Not Track requests.

      • sugar_in_your_tea@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        1
        ·
        4 months ago

        Do Not Track has never really done anything, it just asks websites politely to not track you. There’s no legal or technical limitation here.

        • FiniteBanjo@lemmy.today
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          I still much rather have it than not. It also lead to the spiritual successor GPC which does actually have regulatory requirements under the CCPA.

      • ArchRecord@lemm.ee
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        4 months ago

        Disabling cross site cookies and allowing them to exist while siloed within the specific sites that need them are two different things.

        Previous methods of disabling cross site cookies would often break functionality, or prevent a site from using their own analytics software that they contracted out from a third party.

        • FiniteBanjo@lemmy.today
          link
          fedilink
          English
          arrow-up
          3
          ·
          4 months ago

          Thank you for your explanation, tbat greatly clears up my confusion.

          TBH, if a person’s concern is being tracked by, for example, Facebook; then this just lets Facebook continue tracking them without directly allowing Facebook’s anaylitics customers to track them to another site directly (but indirectly that information can still be provided). But I guess for all the people giving FB and Google those proviledges better to have this than not.

      • ours@lemmy.world
        link
        fedilink
        English
        arrow-up
        41
        arrow-down
        1
        ·
        4 months ago

        As long as it’s not Chromium, I’m happy people aren’t just handing over the keys to the Internet to Google.

      • croaker@lemmy.zip
        link
        fedilink
        English
        arrow-up
        6
        ·
        4 months ago

        I haven’t seen anything to signal Mozilla is untrustworthy other than from that one right wing guy with a chip on his shoulder.

        • TheFrirish@jlai.lu
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          Most of the revenue of Mozilla Corporation comes from Google (81% in 2022[2]) in exchange of making it the default search engine in Firefox.

          Source: wikipedia

          Other issues I have with Firefox is the telemetry bits, the way they handle some of their employees (laying one guy off because he has cancer), the lack of meaningful updates and features in the last decade, CEO granting herself a nice pay rise after doing well nothing really. The list goes on and on honestly.

          Don’t get me wrong, you should still use Firefox or a Firefox derived browser if you care about a free internet. I myself use firefox (although I just switched to Zen browser on my PC which is based on Firefox). However we shouldn’t be blind ourselves just because we hate anything google based and/or closed sourced. Firefox is still back by a for profit company which is, as I quoted earlier, backed at least by 80% by google.

          For the positive side now it seems that in the last 2-3 months firefox has been pumping out meaningful updates (even on mobile). Things seem to be taking a positive turn recently and I’m actually a bit excited to see where firefox is going to go from here.

        • FiniteBanjo@lemmy.today
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          4
          ·
          edit-2
          4 months ago

          The Mozilla Corporation is a for profit entity owned by the non-profit Mozilla Foundation, which lets them claim to be a nonprofit, which is a sketchy looking way to set up and promote your business if nothing else. They get most of their money from Google and they’ve been riding AI like all the other unethical companies.

          I see absolutely no reason to give them a chance, either. Just use an actual open source build instead of the mainstream one.

  • intensely_human@lemm.ee
    link
    fedilink
    English
    arrow-up
    86
    arrow-down
    4
    ·
    4 months ago

    Aren’t cookies already limited to the site at which they were created??

    What the fuck? You mean to tell me sites have been sharing cookies?

    I thought all browsers only delivered cookies back to the same site.

    • Dave@lemmy.nz
      link
      fedilink
      English
      arrow-up
      157
      ·
      4 months ago

      The problem is that a website is generally not served from one domain.

      Put a Facebook like button on your website, it’s loaded directly from Facebook servers. Now they can put a cookie on your computer with an identifier.

      Now every site you visit with a Facebook like button, they know it was you. They can watch you as you move around the web.

      Google does this at a larger scale. Every site with Google ads on it. Every site using Google analytics. Every site that embeds a Google map. They can stick a cookie in and know you were there.

        • Dave@lemmy.nz
          link
          fedilink
          English
          arrow-up
          59
          ·
          4 months ago

          Yes, it’s the reason for the tracking. To sell more targeted ads.

          If you’re up for reading some shennanigans, check out the book Mindf*ck. It’s about the Cambridge Analytica scandal, written by a whistleblower, and details election manipulation using data collected from Facebook and other public or purchased data.

      • MonkderVierte@lemmy.ml
        link
        fedilink
        English
        arrow-up
        17
        ·
        edit-2
        4 months ago

        Put a Facebook like button on your website, it’s loaded directly from Facebook servers. Now they can put a cookie on your computer with an identifier.

        Which is not allowed by GDPR btw, because they do that even if you don’t click them. There are plenty guides online, how to create your own, not tracking, facebook like button.

        • Dave@lemmy.nz
          link
          fedilink
          English
          arrow-up
          5
          ·
          4 months ago

          How does GDPR fit in to Google Analytics and personalised ads?

          I would have thought it went something like: random identifier: not linked to personal info, just a collection of browsing history for an unidentified person, not under GDPR as not personal info.

          Link to account: let them request deletion (or more specifically, delinking the info from your account is what Facebook lets you do), GDPR compliant.

          Both Google and Facebook run analytics software that tracks users. I presume letting people request deletion once it’s personally linked to them is probably what let’s them do it? But I don’t live in a GDPR country, so I don’t know a whole lot about it.

          • MonkderVierte@lemmy.ml
            link
            fedilink
            English
            arrow-up
            5
            ·
            4 months ago

            No, it should’ve been opt-in. But loophole with “vital interest” and politics being slow and surface-level like politics.

        • Dave@lemmy.nz
          link
          fedilink
          English
          arrow-up
          43
          ·
          4 months ago

          It doesn’t have to be. Your browser sends the cookies for a domain with every request to that domain. So you have a website example.com, that embeds a Facebook like button from Facebook.com.

          When your browser downloads the page, it requests the different pieces of the page. It requests the main page from example.com, your browser sends any example.com cookies with the request.

          Your browser needs the javascript, it sends the cookie in the request to get the JavaScript file. It needs the like button, it sends a request off to Facebook.com and sends the Facebook.com cookies with it.

          Note that the request to example.com doesn’t send the cookies for Facebook.com, and the request to Facebook.com doesn’t send the cookie for example.com to Facebook. However, it does tell Facebook.com that the request for the like button came from example.com.

          Facebook puts an identifier in the cookie, and any request to Facebook sends that cookie and the site it was loaded on.

          So you log in to Facebook, it puts an identifier in your cookies. Now whenever you go to other sites with a Facebook like button (or the Facebook analytics stuff), Facebook links that with your profile.

          Not logged in? Facebook sets an identifier to track you anyway, and links it up when you make an account or log in.

          • intensely_human@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            ·
            4 months ago

            How is Facebook able to know what site is requesting it? Is it in the referer header, or is it parameters in the javascript/image url?

            • Dave@lemmy.nz
              link
              fedilink
              English
              arrow-up
              2
              ·
              4 months ago

              There is a referer header sent, but depending on the exact code added to the page, it’s very likely they are loading a snippet of JavaScript that lets them collect other information and trigger their own sending of information to their server.

              For example, Google Analytics has javascript added to the page, but loading fonts from Google’s CDN (which many sites do) will rely on the referer.

    • Mongostein@lemmy.ca
      link
      fedilink
      English
      arrow-up
      47
      arrow-down
      3
      ·
      edit-2
      4 months ago

      I know Facebook and Reddit are in cahoots.

      I went to visit Reddit a couple weeks back to read the Deadpool & Wolverine comments, but used the wrong container tab and now Facebook feeds me endless Marvel related stuff.

      A lot of it is culture war bullshit too. Hmmmmm 🤔

      • AShadyRaven@lemmy.zip
        link
        fedilink
        English
        arrow-up
        1
        ·
        4 months ago

        oh i know how this works and its not the way you think. Its somehow better and worse at the same time

        Im going to describe the process using a hypothetical situation:

        You decide to try a new shampoo but you’re not sure what to buy. You ask your friend “hey what shampoo do you use” and they tell you they use Head and Shoulders.

        Later that night, you google head and shoulders and read reviews

        The next day, your friend gets Head and Shoulders ads on youtube and facebook and Instagram, etc

        This is because google knows both of your locations and search history. It sees that you two were within a few feet of each for hours and decides to shoot ads at you both, based on what either of you have searched recently.

        This is called proximity targetted advertising and i think its gross.

        But this is why so many people say things like “we were talking about it and now im seeing ads they must be spying on me”

      • lud@lemm.ee
        link
        fedilink
        English
        arrow-up
        13
        arrow-down
        71
        ·
        4 months ago

        No, you don’t know anything. Just because you have a suspicion because something happened to you once doesn’t mean you are sure in any way.

        • Mongostein@lemmy.ca
          link
          fedilink
          English
          arrow-up
          24
          ·
          4 months ago

          Nah I’m sure.

          I never once saw a post about Marvel fed to me by Facebook and now it’s constant

          • lud@lemm.ee
            link
            fedilink
            English
            arrow-up
            5
            arrow-down
            24
            ·
            4 months ago

            Did it start after the extremely popular marvel movie “Deadpool and Wolverine” released?

            • 11111one11111@lemmy.world
              link
              fedilink
              English
              arrow-up
              16
              arrow-down
              2
              ·
              4 months ago

              Lol that’s your argument for why you think they don’t know what they’re talking about? Because all you did is make yourself seem like you have no idea how cookies work 🤣

              • lud@lemm.ee
                link
                fedilink
                English
                arrow-up
                5
                ·
                4 months ago

                It’s just one single person who noticed something once.

                That’s an awful awful sample size absolutely filled with bias and thought fallacies.

            • Mongostein@lemmy.ca
              link
              fedilink
              English
              arrow-up
              6
              arrow-down
              2
              ·
              edit-2
              4 months ago

              Before. “Couple weeks” is more like 5 months at this point now that I think about it.

              I don’t mind some of it much, but the obvious culture-war bait is infuriating.

              It’s not because the movie just came out. I’ve been diligent about keeping Facebook and Reddit in their container tabs for years. It’s just Marvel stuff, not just the movies. Marvel’s been putting out huge movies for years and this hasn’t happened around any of their other releases.

              • lud@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 months ago

                Why aren’t you just using the official automatic Facebook container?

    • troybot [he/him]@midwest.social
      link
      fedilink
      English
      arrow-up
      28
      ·
      4 months ago

      Looks like the article was updated today. I’m guessing this was originally covering an announcement for a future rollout and now it’s finally happening?

      • TrickDacy@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        2
        ·
        4 months ago

        Maybe. Confusing decision on the part of Mozilla though, if so. I was checking to see if they mentioned which version this update happened in, but couldn’t find it. Then I noticed the original post date. Weird.

      • sandbox@lemmy.world
        link
        fedilink
        English
        arrow-up
        18
        arrow-down
        2
        ·
        4 months ago

        The moment that Firefox goes too far, it’ll immediately be forked and 75% of the user base would leave within a few months. Their user base is almost entirely privacy-conscious, technologically savvy people.

        • EngineerGaming@feddit.nl
          link
          fedilink
          English
          arrow-up
          2
          ·
          4 months ago

          Depends on how it “goes too far”. What I am, for example, afraid of is the possibility of removing Manifest V2 support. Maintaining the browser with such a significant change would get more and more difficult as time goes on.

          • verdigris@lemmy.ml
            link
            fedilink
            English
            arrow-up
            1
            ·
            4 months ago

            This is currently one of the biggest selling points for the browser, since Chrom(ium) is dropping support for v2… So I don’t see that happening.

            • EngineerGaming@feddit.nl
              link
              fedilink
              English
              arrow-up
              1
              ·
              4 months ago

              Sure hope so! But sadly, I think this is a possibility - iirc they were working on a different implementation of Manifest V3, so I fear that it might still happen eventually, “for the sake of security”.

        • morriscox@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          4 months ago

          Firefox did an add-on genocide years ago and it obviously didn’t hurt them in the long run.

        • unemployedclaquer@sopuli.xyz
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          7
          ·
          4 months ago

          I agree, but something will have to change because chrome will swallow ALL that. Just today some back-end problem was messing up all my stuff, and co-workers were asking, " did you try a different browser? " botch no I did not try Netscape

          • TrickDacy@lemmy.world
            link
            fedilink
            English
            arrow-up
            6
            ·
            4 months ago

            “I agree [with the opposite of what you said]. Also, here, have an irrelevant anecdote that includes a funny misspelling and a supposed diss of FF from 1999”

          • sandbox@lemmy.world
            link
            fedilink
            English
            arrow-up
            6
            ·
            4 months ago

            Not sure what you mean - I don’t think most of the people still using Firefox are going to switch to a Chromium based browser any time soon, I can’t speak for everyone of course but it feels like Firefox users tend to have an ideological objection to Google having a monopoly on web browsers.

            It’s always worth trying a different browser when you have issues on websites - there are a lot of things that can be different beyond the layout and javascript engines - cookies, configuration, addons, etc. Yesterday I noticed a big difference between Chromium and Firefox in that even if you hard-refresh on a HTTP/2 connection, Chromium reuses a kept-alive connection, and firefox doesn’t — I would totally argue that Firefox’s implementation is more correct, but Chrome’s implementation will lead to a better experience for users hard-refreshing.

            • Esp@lemmy.blahaj.zone
              link
              fedilink
              English
              arrow-up
              3
              ·
              4 months ago

              Personally, I remember chrome always flash banging me when on a website with a dark background and I clicked to the next page because apparently clearing the page to the same RGB value as what is set as the HTML background is too hard so they just always clear with pure white. But they did have a faster JS engine. Not sure anymore, haven’t given enough of a shit to try anything but firefox in years now.

            • unemployedclaquer@sopuli.xyz
              link
              fedilink
              English
              arrow-up
              1
              ·
              4 months ago

              I meant, talking to coworkers, – yes, I already tried Chrome, Edge, etc, not sure what etc would include - not worth it to explain what little I know of Chromium, and it doesn’t matter. I’m aware it’s Chromium or Firefox in getting a page to work. Random coworkers, they don’t know or care.

    • Altima NEO@lemmy.zip
      link
      fedilink
      English
      arrow-up
      30
      ·
      4 months ago

      A lot different. Containers act as a separate instance of Firefox. So any sites you visit within a container can see each other as if you were using a browser normally. The containers can’t see the stuff from other containers though. So you have to actively switch containers all the time to make it work right.

      This keeps cookies locked to each page that needs cookies. So a lot stronger.

      • PeachMan@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        edit-2
        4 months ago

        I think there’s some confusion here. You’re talking about Multi-Account Containers, that person was talking about the Facebook Container. Both Firefox features with confusingly similar names, and honestly that’s on Firefox for naming them.

        Facebook Container is similar to this TCP feature, but focused on Facebook. And of course it was a separate extension, so very opt-in. Now, Firefox has rolled it out for ALL sites by default, which is awesome and SHOULD HAVE BEEN HOW COOKIES WORKED IN THE FIRST PLACE!

        • stephen01king@lemmy.zip
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          Isn’t there just a non-extension container feature, I can’t tell what’s the difference between that one and multi-account containers.

    • Jessica@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      11
      ·
      4 months ago

      Yeah this basically sounds like it takes the temporary container add on that I think was folded into Firefox at some point recently and basically just does it behind the scenes now on a per domain basis

    • snaggen@programming.dev
      link
      fedilink
      English
      arrow-up
      3
      ·
      4 months ago

      It is making the tracking protection part of containers obsolete, this is basically that functionality but built in and default. The containers still let you have multiple cookie jars for the same site, so they are still useful if you have multiple accounts on a site.

    • Billegh@lemmy.world
      link
      fedilink
      English
      arrow-up
      64
      ·
      4 months ago

      A little. If a third party cookie is set while you’re visiting a site, only that site will get the third party cookie back. Multiple sites can have embedded content making third party cookies, and with this change firefox will track where it was made and only give it back there.

      With this change, it doesn’t matter if it’s first or third or whatever; cookies will only be given back to a site that matches much of what is in your location bar.

  • Psythik@lemmy.world
    link
    fedilink
    English
    arrow-up
    28
    arrow-down
    6
    ·
    edit-2
    4 months ago

    Is this the reason why I have to “confirm it’s you” every time I sign into a Google service now? I appreciate the fact that Firefox’s protection is so good that Google doesn’t recognize my PC anymore, but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube.

    This might be what finally convinces me to ditch Google for good. Good job, Firefox devs.

      • AdrianTheFrog@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        4 months ago

        I actually had a problem where on Chrome, I would be signed out of my google account every time I restart my computer, while on Firefox, everything works normally. I use Firefox now lol.

      • Psythik@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        3
        ·
        4 months ago

        Well have had my cookies set to delete every time I close the browser for several years now but FF only now started doing this verification thing. A week ago all I had to do was enter my email and password.

        • xthexder@l.sw0.com
          link
          fedilink
          English
          arrow-up
          22
          ·
          4 months ago

          If you’re already deleting all your cookies every time you close, then this new change should be identical to your first login of the day when your browser has no cookies. If you’re only getting 2fa requests after this change, then maybe you weren’t actually deleting every cookie, and Google was still fingerprinting you somehow.

        • catloaf@lemm.ee
          link
          fedilink
          English
          arrow-up
          8
          ·
          4 months ago

          You may want to just use tab containers for youtube, so that it maintains your session, but also isolates it.

          • viking@infosec.pub
            link
            fedilink
            English
            arrow-up
            14
            ·
            4 months ago

            It was updated today. 2 years ago it was just an announcement of a beta function in private browsing, the full rollout happened with 129.0.2 which was released a few days back.

            • TrickDacy@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              arrow-down
              1
              ·
              4 months ago

              Cool, thanks. How’d you find the version number? I was looking on the linked post but didn’t find it. Maybe just me being tired.

              • viking@infosec.pub
                link
                fedilink
                English
                arrow-up
                5
                ·
                4 months ago

                I don’t think it was in the article, but I updated to 192.0.2 yesterday and checked the enhanced tracking protection settings, and block cross-site cookies is now in the default profile, so that was my assumption since it wasn’t there previously.

    • LunchMoneyThief@links.hackliberty.org
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      4
      ·
      4 months ago

      but it’s extremely annoying to have to pull out my phone every time I want to watch YouTube

      This sounds wild. What is your setup? You are using Youtube directly and unmitigated?