News for hackers. Stuff that matters.
Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @10:11AM (#21980608)
Here's my Firefox wishlist:

- Open new windows more quickly. Firefox feels sluggish (on Mac) even though it isn't, simply because it opens new windows far more slowly than Safari or Chrome.

- Use the platform native key store. I don't want my passwords stored unencrypted on disk. But I don't want to enter a separate master password either. I do want to use fingerprint/face unlock on mobile to reveal passwords.

- Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

Re:Firefox 72.0 by makecheck on Tuesday January 07, 2020 @10:57AM (#21981135)
The window-opening animation might be a factor (applies across all of macOS).

You can disable it for all windows in all applications using a terminal command:

    defaults write NSGlobalDomain NSAutomaticWindowAnimationsEnabled -bool NO
You might need to restart apps to see this change.
Re:Firefox 72.0 by nathancahill on Wednesday January 08, 2020 @04:50AM (#21989952)
Oh that's very nice. In iOS 7 we had a jailbreak tweak called NoSlowAnimations[0]. It was amazing how much a simple thing increased the perceived speed and responsiveness of the OS.

[0] http://cydia.saurik.com/package/com.marcosinghof.noslowanima...

Re:Firefox 72.0 by deith on Wednesday January 08, 2020 @05:02AM (#21990003)
You can completely disable animations in accessibility settings.
Re:Firefox 72.0 by irrational on Wednesday January 08, 2020 @08:54AM (#21991385)
Do you mean "Reduce Motion" under Display?
Re:Firefox 72.0 by deith on Wednesday January 08, 2020 @08:56AM (#21991418)
Don't have an iphone handy but I think so. There are lots of options there to explore, there's also one to increase contrast and another to make buttons more evident. There's some cool stuff there in accessibility options
Re:Firefox 72.0 by irrational on Thursday January 09, 2020 @08:47AM (#22001093)
Ah, when "Mac" was mentioned I assume we were talking about MacOS, not iOS.
Re:Firefox 72.0 by randyrand on Wednesday January 08, 2020 @06:13PM (#21996812)
There is still a slow cross fade animation.
Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @11:07AM (#21981241)
Brilliant! It works. Thank you so much!
Re:Firefox 72.0 by Piskvorrr on Thursday January 09, 2020 @04:28PM (#22005989)
So, an OS setting makes FF look bad (...in comparison to the OS-integrated browser). Where have I seen that?
Re:Firefox 72.0 by smcleod on Wednesday January 08, 2020 @02:40AM (#21989214)
That is very handy preference, thank you for that!
Re:Firefox 72.0 by rolodato on Tuesday January 07, 2020 @10:36AM (#21980909)
> - Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

This can be done with uBlock Origin and an "annoyances" filter list such as EasyList Cookie. It doesn't actually give websites consent to use of cookies, only hides the consent form.

Re:Firefox 72.0 by muxator on Tuesday January 07, 2020 @09:19PM (#21987639)
Thanks! I really did not know of the annoyances, it really helps.
Re:Firefox 72.0 by Carpetsmoker on Tuesday January 07, 2020 @12:00PM (#21981820)
> lobby for a legally binding do-not-track header.

DNT is pretty dead, and IMHO was never a good idea in the first place. Opt-outing of invasive and unethical tracking is just weird. What about people who don't know about it? Or don't fully understand what it means?

It's almost like the Hitchhiker's Guide: "Well, you should have visited the planning department in the disused lavatory with a sign 'beware of the leopard".

I wrote some more about it over here: https://www.arp242.net/dnt.html

Re:Firefox 72.0 by mintocean on Tuesday January 07, 2020 @10:51PM (#21988115)
I always thought the point of DNT wasn’t technical, but to make it impossible to argue either (a) that users don’t really care (many opted in), or (b) that Google et al respect user’s wishes without regulation or technical barriers (they are aware of DNT and its specific meaning and they ignore it). In other words, political maneuvering towards getting the entire industry to accept implementing that technical solution.
Re:Firefox 72.0 by stuartd on Tuesday January 07, 2020 @09:05PM (#21987542)
The ultimate irony of DNT was that trackers could use the header as browser fingerprinting data..
Re:Firefox 72.0 by floatboth on Wednesday January 08, 2020 @06:44AM (#21990524)
Well, it only adds one bit of information, that is probably highly correlated with everything else being unique as well :)
Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @12:02PM (#21981852)
True, but is DNT the lesser evil compared to what we have now, which is only annoyance and effectively no control.
Re:Firefox 72.0 by Carpetsmoker on Tuesday January 07, 2020 @12:19PM (#21982030)
Well, if you're going to lobby for a change to the law then you might as well lobby for a change that's actually a good one, instead of a half-baked one that barely works.
Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @12:30PM (#21982182)
I would say it depends on how good any alternative solution is and how realistic it is to pass.

Edit: Having read your blog post, I want to say that I'm not necessarily asking for the original definition of DNT to be reused. What I want is for the DNT header to have the same effect as if I had said no to all optional categories of cookies.

The status quo is that we are asked a "yes or manage" question where "manage" means something horribly complicated that no one does. If we redefine DNT to mean "no to everything optional" then it becomes a matter of local law to define what is and isn't optional. This allows for the sort of minimum level of consumer protection that you're asking for.

The law could also require that this DNT header is opt-out. A per-site overridable DT header if you will.

I'm not going to claim that I have thought this through properly. It's just something that I wish Mozilla did some work on.

Re:Firefox 72.0 by theonemind on Thursday January 09, 2020 @02:42AM (#21999263)
I just block traffic with the RFC3514 evil bit set at my firewall.
Re:Firefox 72.0 by garaetjjte on Tuesday January 07, 2020 @01:18PM (#21982804)
>- Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

Maybe there should be standardized interface for accepting privacy policy and cookies, all managed in browser UI so you could set default settings and give exceptions for specific sites without cluttering website with various popups... oh wait https://en.wikipedia.org/wiki/P3P

Re:Firefox 72.0 by jensimmons on Wednesday January 08, 2020 @12:45PM (#21993802)
> I don't want my passwords stored unencrypted on disk.

Passwords are always stored encrypted when you save them in Firefox. You can read more about it here: https://support.mozilla.org/en-US/kb/how-firefox-securely-sa...

Re:Firefox 72.0 by ViViDboarder on Thursday January 09, 2020 @10:03AM (#22001738)
Same with Chrome actually. Your best bet is to use a proper password manager that integrates well.
Re:Firefox 72.0 by simon1573 on Tuesday January 07, 2020 @10:33AM (#21980860)
Re:Firefox 72.0 by takeda on Tuesday January 07, 2020 @01:22PM (#21982855)
Someone here responded[1], that you can just enable "EasyList Cookie" filter in adblock and it should have similar effect.

[1] https://news.ycombinator.com/item?id=21980909

Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @10:41AM (#21980968)
I'm extremely hesitant to give any extension automatic access to every single page I'm loading. I want Firefox to come with these things built in.
Re:Firefox 72.0 by andrewkdinh on Tuesday January 07, 2020 @10:47AM (#21981023)
If you trust uBlock Origin, you can block cookie banners by adding https://www.i-dont-care-about-cookies.eu/abp/ to uBlock Origin’s custom filter list
Re:Firefox 72.0 by Ghexor on Tuesday January 07, 2020 @10:32AM (#21980853)
Regarding #3 you might want to check out the "I don't care about cookies" add-on.

I use I on Firefox mobile and desktop - don't know if there's a chromium version.

Almost forgot I use it which is the most positive review an add-on like this could receive.

Re:Firefox 72.0 by wyre on Wednesday January 08, 2020 @12:30AM (#21988620)
https://www.i-dont-care-about-cookies.eu/

Looks available on a gamut of different browsers.

Re:Firefox 72.0 by stuartd on Tuesday January 07, 2020 @09:07PM (#21987564)
Don’t forget to chip in a few bucks to the author (if you can afford it) though
Re:Firefox 72.0 by coldpie on Tuesday January 07, 2020 @10:29AM (#21980820)
> - Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

Most of those are implemented in JS, so NoScript goes a pretty long way to fixing this. It would be nice if Firefox somehow auto-detected them, and other useless pop-overs, and nuked them.

Re:Firefox 72.0 by efreak on Tuesday January 07, 2020 @11:43PM (#21988423)
Unfortunately, browsing with JavaScript disabled on mobile, I've noticed quite a large number of sites (usually WordPress blogs) that have the opt out button in the HTML, controlled server-side, so you have to enable JavaScript at least once to get rid of it.

Given that I prefer brave or bromite custom tabs (via Lynket) for short sessions on mobile (and prefer not to have long sessions on mobile at all), I generally just deal with it.

Re:Firefox 72.0 by tgv on Tuesday January 07, 2020 @10:52AM (#21981084)
> Open new windows more quickly.

Windows open more quickly now than before. A few versions ago, it had become unbearably slow (I'm an FF user since Camino died), and I stuck to using tabs only, but 72 seems to have caught up again. I estimate that it's around 0.3s slower than Chrome on my machine.

> Use the platform native key store.

Amen to that.

Re:Firefox 72.0 by ridiculous_fish on Tuesday January 07, 2020 @12:44PM (#21982356)
Confirming the window opening speedup! Previously FF spent a lot of time compiling shaders when opening a new window. Perhaps these are now been cached.
Re:Firefox 72.0 by tpmx on Tuesday January 07, 2020 @10:33AM (#21980868)
> Open new windows more quickly. Firefox feels sluggish (on Mac)

I assume you mean new tabs?

That's very quick on Windows using FF 72. Interestingly that's been a long-time annoyance of mine when using Chrome on Mac - when compared to Safari which shines here.

Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @10:53AM (#21981098)
>I assume you mean new tabs?

No, I mean windows. Opening tabs is very fast.

Many of my workflows begin by opening an new empty browser window. I also tend to open links in new windows instead of tabs. I'm not a huge fan of tabs generally.

Re:Firefox 72.0 by tpmx on Tuesday January 07, 2020 @11:04AM (#21981209)
That's probably a pretty unusual scenario, generally speaking. On Mac I can see it making sense. Makes me curious to try out this browsing workflow...
Re:Firefox 72.0 by Normal_gaussian on Tuesday January 07, 2020 @11:28PM (#21988351)
I don't think it is.

Whilst there are the "every tab in o e window open forever" people, there are plenty of "window for task" people.

Personally, I have been a window for task person 'since forever' (tabs are context depth in said task, hence "close tabs to right" being one of the most useful features).

Re:Firefox 72.0 by Dylan16807 on Wednesday January 08, 2020 @08:48AM (#21991337)
"window for task" is not the same thing as "tend to open links in new windows"
Re:Firefox 72.0 by andai on Tuesday January 07, 2020 @10:27AM (#21980797)
It loads pages slower, too. Once they actually load though, performance is on par.
Re:Firefox 72.0 by icebraining on Tuesday January 07, 2020 @12:05PM (#21981883)
Regarding the native key store, why not just use full disk encryption? The session-specific encryption never made much sense to me, unless you share the computer with others. How many processes do you really have that are not running under your user or root?
Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @12:25PM (#21982103)
I do use full disk encryption, but when I'm logged in, any program that runs as me can access my files (subject to some partial restrictions that Apple introduced a while ago). And anyone gaining access to my unlocked computer can easily copy that password file.

You could say once malware is executed with my credentials it's game over anyway. But I disagree with that. Having a file full of passwords stolen is far worse than than anything else, including key loggers, because it's maximum damage in a minimum amount of time.

I want to make that as difficult as possible for any attacker.

Re:Firefox 72.0 by icebraining on Tuesday January 07, 2020 @05:37PM (#21985890)
> when I'm logged in, any program that runs as me can access my files

On Windows, the same is true of the encrypted data; any program that runs as you can decrypt it. Is it different on macOS? How does the system authenticate a specific program?

Re:Firefox 72.0 by fauigerzigerk on Tuesday January 07, 2020 @06:11PM (#21986262)
On the Mac, Safari and Chrome store passwords in a key chain. To reveal any of those passwords you have to re-enter your macOS login password or whatever authentication method was used to log into the device (fingerprint, face ID, ...).

So it's not the program that is authenticated. The system simply makes sure that any program accessing that particularly sensitive data is really controlled by the logged in user.

This is entirely separate from protections for other files that may or may not be encrypted.

Re:Firefox 72.0 by forgotpwd16 on Thursday January 09, 2020 @09:08AM (#22001259)
>Chrome store passwords in a key chain

Really? I thought Chrome, same as Firefox, stored credentials in an SQL file, the reason behind it being profiles and its built-in sync service.

Re:Firefox 72.0 by fauigerzigerk on Thursday January 09, 2020 @12:10PM (#22003067)
It appears you're right. Chrome doesn't actually use the system key chain underneath, but the UX is exactly the same as Safari.

Autofill doesn't require password entry, but before revealing any stored passwords you have to re-authenticate using the regular system login method.

I wish Firefox did the same.

Re:Firefox 72.0 by forgotpwd16 on Thursday January 09, 2020 @02:22PM (#22004522)
That's interesting and I wonder how they do it. Nevertheless this isn't good as it offers a false security sense since the end result is similar to using a master password which is the same as the login password.
Re:Firefox 72.0 by zelly on Wednesday January 08, 2020 @04:38AM (#21989887)
You are more likely to lose your data while the computer is on and drives decrypted than when it is off. The threat model for FDE is thieves or government physically stealing your drive. Much more people get pwned in software than physically. I mean you don't just leave root shells laying around do you?
Re:Firefox 72.0 by icebraining on Wednesday January 08, 2020 @04:47AM (#21989927)
The question was whether the keychain really protects from those software attacks. I wondered mostly because I know that Windows will allow any process running as a certain user to decrypt data stored by any other process (at least if it's stored using the Data Protection API, like Chrome does for its passwords), so it only really protects your data from other users and their malware.

It seems that macOS authenticates each process, so that might provide some extra security.