If you want to not be tracked you require a random/different IP and a browser fingerprint that blends with the crowd.
As generations that understand this tech implicitly come to power, things will change. To someone that does everything digitally the meaning of these words will be quite different than the currently accepted interpretation:
“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”
From May on sites have to offer yes/no, they may only track you if you choose yes, and if you choose no they may not ask again, and may not refuse access either.
Which is what was originally intended all this time, and which all good websites offered anyway.
Would something like that work?
(Edit: Ah, apparently this sort of thing is already allowed, according to comments I didn't read before writing this. Sensible legislators.)
Alternatively, the legal definition of tracking cookie can differ from the technical definition of cookie. It wouldn't be the first time...!
Cookie to say "has clicked no"? okay.
Login cookie? okay.
Cookie to track the user? not okay.
Local storage to track the user? not okay.
Tracking the user based on magic? not okay.
How stupid is that? Privacy at the expense of security?
JS is also used for things that are doable with CSS or even HTML only. This isn't the first time.
My tin-foil hat persona suspects it's yet another way to force me to disable the various script and ad-blockers in the guise of protecting users for privacy concerns. But my more realistic side assumes this is just laziness.
Or just use NoScript.
https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-p...
Anyone know if this is still the case? I looked at a couple of pages and only saw tiqcdn.com being blocked by uBlock.
Tag managers allow you to encapsulate third party tags (and really, any JavaScript you want) and have them dynamically injected without having to hard code anything else on the page.
Since that was blocked, you never even saw the other tags that would have attempted being ran.
"Can one disable the HTTP referrer for only when one is going to a third-party domain?" https://support.mozilla.org/en-US/questions/1130505
A stock Firefox can tune the referer behavior through about:config, including completely disabled or spoofed to the target URL.
It's increasingly becoming impossible to have any actual privacy, so in my opinion the best option is to make the data collected worthless.
https://addons.mozilla.org/en-US/firefox/addon/smart-referer...
We did a user research study measuring website breakage under various privacy protections:
https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...
tl;dr - strict-origin-when-cross-origin was one of the protections with the lowest amount of breakage. Entering Private Browsing is a clear, strong signal that the user wants more privacy, so we started by implementing this protection in Private Browsing.
However, note that some advertisers demand that AdTech vendors must not serve their ads on certain kinds of pages. (e.g., https://support.google.com/adsense/answer/1348688?hl=en&topi...) Many of those agreements require full referrers to be able to audit the ad inventory.
So there are some concerns and trade-offs to make in this space.
If Mozilla's users are saying “yes, this is good; please do more”, Mozilla can use that as a defence against any resistance from advertisers.
However, if “you” is a company that is in some other business, but collects analytics for the purposes of optimizing it’s product and figuring out what actually works for their users, then you don’t event want to run the risk of ingesting something private. Especially with exposure to different jurisdictions.
Think of it as the difference between a double-opt-in email list where you are very sure people want to receive the communications and an unsolicited spam list. If the user volunteers this data and it has some relevant business purpose, that’s great. However, if the user doesn’t know I have this info and wouldn’t want me to have it, then acting on that data could create a lot of negative emotions that as a company I wouldn’t want.
Private browsing will(1) start out with no sessions (none from normal browsing mode), (2) provides automatic tracker protection, and (3) will clear sessions (cookies and history) on exit leaving no trace. Private browsing is great for a number of use cases such as debug/test web app with a new session, visit NSFW, or hide the fact you watch cat videos on your puppy-lover friend's computer.
So it makes sense to hide the referrer in private sessions opt-in automatically. As for the normal browsing, you can disable referrer. See [1].
I would like to see more privacy and security options to be shown in the preferences UI. about:config is "okay" but it feels like Windows registry, not good for user experience, even by developer standard when one just want to toggle on/off privacy and security settings.
[1]: https://askubuntu.com/questions/797135/how-to-disable-http-r...
Information leaks. You click a link from your email to a news article. The URL for the news article has your email in it. Then you click an ad on the news article. The ad just got your email address.
Worse still - instead of an email address, it's a token that auto signs you in to your account with the news site.
Sites are pretty bad at sanitizing their outgoing referers.
Hopefully, even though groovecoder doesn't mention the possibility, if this works well then we'll see it rolling into regular browsing too, or at least having some UI exposed, in the same way that tracking protection moved from being private browsing only to having an option to enable it in regular browsing.
Actually, now I think of it, I wonder if the two could sit behind the same preference in the end?
We could, of course, build the same functionality into our implementation without relying having the path/query in the referer.
Personal data in 3rd party referral is only one of the many side effects. If personal data is available in the URL as query string, chances (very high chances) are that the same data is perfectly visible in clear in the web server logs, and from there only God knows where it's spread, including all the 3rd party services used on the backend side.
Yeah, but it may surprise you to know that your opinion isn't shared by the people who own the computers in question, or the private data you're digging in.
Your personal strong belief is, in this case, utterly irrelevant.
They don't seem to have said so clearly enough. I think some people just read the first half of the sentence and are ready to be mad!
It is very useful to know where your traffic is coming from, but that’s usually viewed at a higher level than the querystring params being shown. In some cases, this may restrict you from knowing which article the person was reading on the given site before clicking through to yours, but if that’s so important, there are other ways to instrument source tracking.