Ever encountered Google ReCaptcha when you've turned off third party cookies or while in incognito/private mode? It's a nightmare, even if you're logged into a Google account. You can be shown upto 7-8 challenges, painfully slow loading images and Google's insistence that they encountered malicious traffic from your IP when attempting to use the audio version. What's even worse is they track your mouse movements and fast solvers like me are penalized since they think I'm not human anymore.

As much as I hate third party cookies, turning them on drastically simplifies the captcha solving process. So much so, I now use a separate browser profile with third party cookies allowed, just for the sake of captcha heavy sites.

Given that Google benefits by tracking my activities and free labor from my captcha solving, they will always punish privacy conscious users via such dark patterns.

The optimist in me thinks that if browsers started to disallow third party cookies, ReCaptcha might have to adapt to the change and make it easier to solve if third party cookies are blocked. After all, if they didn't, they'd risk website owners moving away from ReCaptcha because visitors could no longer interact with the site.

The pessimist in me thinks that if a browser were to disallow third party cookies, users might simply switch to a different browser that does allow them.

I don't think it has so much to do with reCAPTCHA as much as it has to do with Cloudflare and website owners themselves. Most reCAPTCHA challenges come in the form of Cloudflare challenge passage pages. Website owners have 5 options to choose from regarding challenges:[1]

— Essentially off: Challenges only the most grievous offenders

— Low: Challenges only the most threatening visitors

— Medium: Challenges both moderate threat visitors and the most threatening visitors

— High: Challenges all visitors that have exhibited threatening behavior within the last 14 days

— I’m Under Attack!: Should only be used if your website is under a DDoS attack (Visitors will receive an interstitial page while we analyze their traffic and behavior to make sure they are a legitimate human visitor trying to access your website)

I think a lot of companies set it to "High" and forget about it, not realizing that it's ruining the experience for a lot of users.

[1]: https://www.cloudflare.com/a/firewall/ebelinski.com#security...

It doesn't ruin the experience of anyone except a couple of overly technical users and customers in the wrong locations.

It's very good at blocking malicious traffic though and it's totally worth losing a pair of users for that.

Yes, it's the users that are wrong!

> The optimist in me thinks that if browsers started to disallow third party cookies, ReCaptcha might have to adapt to the change and make it easier to solve if third party cookies are blocked.

That needs to bring everybody to the same table, Firefox will not do that alone and Google Chrome is not there for nothing.

Basically, Google must accept the proposal of disabling third-party cookies by default which will effect their income negatively, so they may just refuse to implement that feature for Chrome and even may prevent that feature from become a standard.

Sad.

Chrome already has a "Block third-party cookies" feature in Privacy and security > Content settings > Cookies.

Kinda hard to find though.

Users tend to blame websites rather than browsers when the websites don't work. So by using bad CAPTCHAs, i'd guess, users would more liekly blame those sites using them.

This is what finally made me switch my default search engine away from Google. I will put up with a lot of crap, but I'm not going to spend 60s to solve a CAPTCHA every time I do a search.

Bear in mind that Google might be correctly identifying your IP address as a botnet source. If you start seeing lots of CAPTCHAs, it's worth it to take a look around your network for open ports or weak ssh passwords etc., or just look at a traffic monitor to see if there's a lot of egress from your net.

Oh, I'm sure there are a million reasons for them to block me. I normally use a VPN, incognito searches, limited script blocking, and cookie blocking. Pretty sure they don't want me as a customer, not that I can completely blame them. Anyway, I've discovered that there are other reasonably effective search engines with a different business model, and I'm fine using those and giving them a modest amount of revenue. (I don't block ads that don't track me.)

I've never seen a CAPTCHA when simply doing a search - is that because I refuse to log in to Google?

Perhaps Firefox could fake thirdparty cookies instead of disallowing them.

Then you'd probably never pass captcha.

firefox is big enough that captcha would be forced to change, so long as firefox stuck to it.

I make no claim that the above is a good idea. It is possible, but it strikes me there are unintended consequences that I won't think of.

Btw this exists: https://support.cloudflare.com/hc/en-us/articles/11500199265...

This has been a huge problem of mine when using tor, after disabling 3rd party cookies and also using Firefox containers. Took me two days to just love duck duck go and now it's been set on my laptop, phone and all tables, where Firefox with uBlock origin are to browse the web.

ReCaptcha means to me that I need to blacklist your site and never come back. F@ck that noise

I got very sick of this crap from Google, which is why I switched my default search engine to DuckDuckGo.

Yeah we need to have a talk about captchas and privacy. They're pretty plainly used by providers (Google) to force people into being tracked.

I can't even get recaptcha to work when I have the umatrix extension turned on, even when I turn off the functionality of umatrix by whitelisting everything. I need to go into my browser extensions and turn off the whole extension just to get past a recaptcha.

Using the logger is key to solve that sort of issues. As stated in the documentation, the per-scope switches keep having an effect even if you disable matrix filtering. The logger will show you what is still modified by uMatrix if there is anything.

With umatrix, try unchecking the 'Spoof HTTP header' option. I was able to get it working this way. There's no need to disable the extension itself.

I sympathize. It's terrible when a computer thinks you must not be human because you're not slow and don't make enough mistakes.

I've been accused of being a bot before also.

I tried making a throwaway account on Protonmail account while on the Tor network. I swear, I probably had to go through 25 captchas before it worked.

Google’s recaptcha doesn’t work even when you are logged in sometimes.

I've always had to solve 3-4 captchas. They are insufferable and I have simply stopped using most of the sites that use recaptcha unless they are vital to me.

It feels like Google is using me as a mechanical turk to solve their autonomous car rubbish, which will make them millions, and I have no choice but to do it, or I'm barred from the sites I need to access. It's profoundly despicable, as if I didn't hate Google enough already.

>It feels like Google is using me as a mechanical turk to solve their autonomous car rubbish

That explains why the majority of ReCaptchas I get are along the lines of "Click the squares that contain a street sign" or "Click the squares that contain a bicycle."

The security model of the internet is whack. Javascript should be opt-in, especially from 3rd party sources. "This website wants/requires javascript for an enhanced viewing experience [allow/deny]". Instead not only will any stock browser gladly run anything thrown at it, it will also accept any cookies and now run WebGL code, trigger DRM engines and various other things. All that because the engineers who wrote the standards had enough hubris to think that a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed.

The web is a lost cause as far I'm concerned, it was under-engineered at the start and as a result people kept pilling mounds of crap on top to make up for it. What started as a way to display basic markup and images has been arm wrestled into handling complex web applications and videogames. The thing is so complex that it would probably take me less time to write a basic operating system and run Firefox on it than implementing my own browser from scratch on Linux. And despite all of this you end up having to use a billion of 3rd party javascript libraries to do anything remotely complex in the browser, things that have been standard in Qt or GTK since forever with a fraction of the code base and memory footprint.

And now people seem to enjoy reimplementing all the internet protocols on top of HTTP. The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain.

I'm glad that there appears to be a lot of discussion surrounding internet privacy lately, including in the mainstream. However I think that focusing all the discussion of Facebook is becoming counter-productive. Facebook exploited the weaknesses of the web very successfully but it only exploited tools that existed long before it was created. I have absolutely no illusion that Google & friends are doing pretty much the same thing, and if you have an Android phone the amount of info Google can harvest is nothing short of terrifying when you think about it from an Orwellian perspective. Don't miss the forest for the Facetree.

Assuming that internet giants will adhere to some "code of conduct" is naive at best. "Do no evil", yeah right. We let them have to tools to do these things, we need to pry some of them away from their hands through technology and regulation (probably in that order).

> a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed.

I wonder why you say that. I concede that web has evolved from no-security in the 90s, when random applets and ActiveX controls were 1-click away from rooting your machine, through faulty security in 2000s, where stack smashing IE was a hobby of mine, and up to the current era of sandboxes. Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses.

The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem. It's compounded then as a political problem, where major browser investment are controlled by advertising companies that have a massive conflict of interest regarding the users privacy, and are likely to promote bandaids like "Do not track" instead of the fundamental privacy re-engineering the web urgently requires.

> The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain.

When I'm thinking like this is usually a sign of age. Hang in there buddy, we'll be fine. There is a promised land just around the corner with rich, secure web applications and strong privacy. If only everybody agreed we want it.

>Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses.

I consider that the widespread fingerprinting and user tracking is a form of sandbox evasion but I agree that it goes way beyond JS. The only identifying info that ought to be sent to some website by default is your IP address since it's necessary to actually send you back the data. Having the size of my view port, the version of my browser and OS, the type of video codecs I support and other shenanigans shouldn't leave my browser without my consent. The problem is that I can easily spoof most of my browser's info but JS makes it almost impossible to sanitize everything.

>The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem

How is that not a complete contradiction? I'm not saying it's a bug, I know very well it's just a huge dump of features that keeps pouring in year after year. I'm just saying that web standards are the embodiment of "we were so preoccupied with whether or not we could that we didn't stop to think if we should".

IMO there are broadly two different use cases for the web currently: Web applications like Google Docs on one hand and glorified PDF reader for mostly static content like HN, internet forums, news websites, Wikipedia etc... on the other. Web Apps are the part that require this ridiculous complexity to expose rich content. That's the stuff you'd use Java applets, XUL, Flash or ActiveX for in the past. Those apps could be whitelisted on a site-by-site basis in the same way that you install an app on your smartphone for instance. You know that you expose yourself to bugs and privacy leakages but you know what you're in for.

99% of the websites I browse everyday don't expose any functionality that ought to require any form of interactive scripting or advanced features beyond displaying text and images (and maybe video). Yet my browser will gladly let them access all these advanced APIs by default, load custom fonts, let them run code on my GPU, make 3rd party requests, mine cryptocurrencies... That's just ridiculous.

The safest code is code that doesn't run.

>When I'm thinking like this is usually a sign of age

Come on, we're not old, we're wise! At least I hope so...

Spot on. And most of website should not even need javascript but some simple extension to xhtml to allow interactive websites in a declarative fashion rather than having a Turing-complete language.

CSS is Turing-complete.

https://news.ycombinator.com/item?id=2300836 (2011) https://news.ycombinator.com/item?id=10734966 (2015)

Those comment threads dispute that claim.

So?

So using CSS, one can fingerprint a browser and communicate that information back to home base by programmatic inclusion of font A or font B. This inclusion triggers the download from the respective URL, thus giving that URL information about the user.

Yeah so is Power Point too.

Javacript running automatically is a decision made at the user agent level, it isn't really part of the "internet" security model. If browsers didn't run scripts automatically I think that would be the #1 support question, "How do I turn off those prompts!?".

Prompts could include a checkbox "Allow scripts for all sites".

Also: Some user would ask the site's support about the prompts, not the browser's, which would be an incentive to get rid of JavaScript for the site.

Hear hear! Is a mountain next to you occupied yet?

Exactly. Why aren't all websites run in containers by default (personally I'm envisioning per-domain containers)? What benefit do we get from full-coverage containerization not being the default?

In short: site breakage.

We're so deep in this that a first party isolation would break almost every single website. In a cooperation with Tor, Mozilla actually ported the first-party isolation feature in mainstream Firefox (available in Nightly, don't know about stable), but since it would break almost every single website, there are no plans to turn it on by default. You can, of course, enable it yourself by turning on "privacy.firstparty.isolate" in about:config.

Disclaimer: I'm a Mozilla Foundation affiliate that has nothing to do with Mozilla Corporation nor Firefox.

It would break some sites (certainly not every site, I'm browsing this site right now with it enabled) because 3rd party cookies are an entrenched, standardized feature of the web, you can't simply turn them off tomorrow. Developers are using them to create benign functionality, for example spread an application across multiple domains owned by the same publisher.

What I proposed above is that we introduce an opt-in feature: before the browser is allowed to connect to 3rd parties (in the tracking and cookie sense), the user needs to opt-in, for example by clicking in a notice window displayed at the corner of the browser window. Instead of nagging every user of every site that "This site is using cookies", developers should nag only when connecting to other applications, using a standardized browser API. After sometime from standardization, you can roll out this functionality to all users and nothing legitimate would break.

There should be no presumed used consent - because there really is none, the outcry against Facebook and advertiser tracking shows people don't expect the web to work the way it does.

We ran a breakage study near the end of last year.

First-Party Isolation (FPI) did have the highest breakage scores: ~18-19% of users reported problems with it, and 9-10% of FPI users disabled the study.

Those are low relative numbers, but at entire-market scale, they are big absolute numbers. :/

https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...

It would be great if we could have "FPI on by default with whitelist".

I think the stats are iffy because a lot of the breakages are things I would want broken.

I've been using first party isolation for the last year or so, and I can't think of anything it's broken.

Good to know, I'm gonna try this starting now.

Using the extention: https://addons.mozilla.org/en-US/firefox/addon/first-party-i...

2 week report: I haven't seen anything break.

I tried it out and yes, it breaks AuthN with third party sites, but besides that I had a mostly good time with it. I did turn it off.

Is there any plan to create an exceptions mechanism? "Allow Facebook access to your activities on this webpage?" or something like that?

In my experience with Brave browser I had to enable third-party cookies only for very few sites. In most cases that was to support some external login mechanism that the site used, not to access the site after a login. So I doubt the claim about breakage on most sites.

While micro-sites and CDNs could still be brought under the same SLD. The biggest blocker as is OAuth. I'd want to make a UX call to see if browser could elegantly prompt the user for a 3rd party interaction.

While we are at it, I keep wondering (in a strictly SSL world) if it would be a good idea to restrict CORS calls only to sites using the same certificate as the webpage. Would make life easier for folks like facebook.com making CORS to fb-blablabla.fbcdn.com.

Wouldn't Facebook just start promoting their super Facebook compliant certificate to their partners then ?

Some sites rely on multiple domains to work. E.g. open auth, cdns are usually a separate domain, a lot of big corporates create new domains for “microsites” when they want to do something new but are tied down by slow moving corporate practices (although the world would be a better place without microsites).

Basically, you couldn’t do it without breaking a large part of the internet.

They could build a whitelist and distribute it with Firefox (?)

I agree FPI should be on by default and have a whitelist.

This can be done with Firefox Multi-Account Containers[1] and Temporary Containers[2].

[1]: https://addons.mozilla.org/en-US/firefox/addon/multi-account...

[2]: https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

Indeed. Safari blocks 3rd party cookies by default, I see no reason why Firefox can't do the same. The fact that they don't is a direct contradiction to their claims that they care about user privacy. The only explanation I have is that they do not want to anger their long-time money sources Google and other advertisers.

Safari's third-party cookie blocking is not the same as Firefox's, last I checked.

Firefox just blocks them. Safari blocks them unless you visited that site in a first-party context. Shipping the thing Firefox implements breaks a lot more than what Safari ships.

So for example, if you visited facebook normally, third-party Facebook cookies won't get blocked in Safari.

Firefox _could_ ship the same thing as Safari. The upshot is entrenching existing monopolies, because only big enough players are then able to track you via third-party cookies.... This is the main reason Firefox hasn't done this, as far as I know.

Disclaimer: I work on Firefox, but not on the cookie bits.

I agree, but blocking third-party cookies does break a whole lot of sites.

Apple can do this, because they have a limited yet consistent market share that mostly consists of their own customers.

But Firefox? If they block third-party cookies and Chrome does not, they might just end up losing even more users.

Sure you can argue that way. But it's not as big of a problem as you think it is. The fact that Apple does it is enough proof for that.

Websites can be changed to work without third party cookies. I'm blocking cookies since years and I have come across less than 10 sites that require it. When that happens, most of the time I just go elsewhere or I'll send them an email.

I’ve been blocking third party cookies for as long as Safari has had that option, and I’ve never noticed an issue. I only get Google’s annoying recaptchas when my search string is too specific for their tastes.

What sites are broken by Safari because of its default cookie options? I haven't encountered any.

Any site which iframes in another site where you're expected to be logged in. For example, Disqus comments, Facebook like buttons, Youtube embeds (which work, but show ads even if you've paid for no ads).

There are also lots of one-off cases where developers split functionality across multiple domains in ways that were fine at the time but now get blocked. These are all fixable, unlike the iframing case, but it's still a lot of sites.

We need to redefine 'break' into:

Breaks because it was abusing lack of FPI.

Breaks innocently.

I think it's more nuanced than just blocking ALL third-party cookies. If you have visited the site before (e.g. facebook.com), my understanding is that those cookies are allowed. It's only blocking third-party cookies from sites you have never explicitly visited before.

Atlassian's HipChat web app breaks (in Gnome Web, which also disables third-party cookies).

<snark>So, nothing you'd want to use.</snark>

A large percentage of things that break SHOULD BREAK. That's the whole point isn't it?

Perhaps they could make "better default-settings" an option :)

There are valid uses for some of these. Imagine where online User eXperience and User Interfaces would be without services that help tell someone what is working and what is not.

Fortunately, many US companies are starting to consider a GUID and your IP address to be PII, and no longer allow that information to be stored.

There are lots of "shoulds" in the world. People should be nice, not steal, etc.

It seems to me, if users act differently, there "should" be a way to fingerprint them.

Anybody aware of any browsers making this a trivial workflow? Any comprehensive list of recommended plugins? Anything targeting mobile platforms?

Firefox's first-party isolation (brought across from Tor Browser) will foil cross-site tracking. Combined with Privacy Badger and Cookie Autodelete, your browser won't make the requests and even if they did, they wouldn't have any cookies attached.

https://github.com/mozfreddyb/webext-firstpartyisolation https://www.eff.org/privacybadger https://github.com/Cookie-AutoDelete/Cookie-AutoDelete

Wow. Obviously this idea gets thrown around HN a lot, but you deserve props for phrasing it so perfectly.