Firefox rolls out Total Cookie Protection by default to more users worldwide

Re:Firefox rolls out Total Cookie Protection by default to m... by kevin_thibedeau on Wednesday April 12, 2023 @04:28PM (#35546327)

> allowing those [third party] cookies to fulfill their less invasive use cases (e.g. to provide accurate analytics

Separate cookie jars don't prevent data brokers from correlating cookies from a common IP + user agent pair. The only solution is to block third parties altogether.

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by seizethegdgap on Wednesday April 12, 2023 @04:40PM (#35546517)

Obviously doesn't help when using an app, but what about an extension that changes your user agent every single time you send a request to a website? Does such an extension even work, or exist?

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by Nextgrid on Wednesday April 12, 2023 @04:42PM (#35546550)

Even if it did, it will be useless because fingerprinting (of various kinds - whether TCP or TLS stack, doesn't even have to be JS-based) will still tell which browser you're running on.

Worse, it may actually make you more identifiable because a Chrome on Linux user agent with the TCP fingerprint of Windows and TLS fingerprint of Firefox is going to stick out like a sore thumb, even more than a rare-but-at-least-consistent fingerprint with no trickery.

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by benmmurphy on Wednesday April 12, 2023 @05:26PM (#35547205)

I'm not sure TCP fingerprints are very reliable because a lot of ISPs and Mobile Carriers are doing proxying at the application level for HTTP/HTTPS ports so even if you are on an iPhone you might end up having a linux TCP fingerprint. This site allows you test your TCP fingerprint: http://witch.valdikss.org.ru

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by jhoechtl on Wednesday April 12, 2023 @05:04PM (#35546899)

What if I browse using tor?

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by the_pwner224 on Wednesday April 12, 2023 @04:53PM (#35546708)

The long term workaround for data brokers is to become a first party... have the main website serve your 3rd party JS from their own server under their own domain. That makes it much harder to block.

For your IP+UA hypothetical, the easy fix is to make everyone look the same. IP should be the only personally identifiable factor. Tor and desktop Firefox w/ privacy.resistFingerprinting turned on both do this. Open window not-maximized at 1000x1000 size, use the same UA regardless of what platform & browser version you're actually on, and a bunch of other stuff. That said, I don't know how effective it actually is against modern comprehensive fingerprinting libraries.

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by OkayPhysicist on Wednesday April 12, 2023 @05:01PM (#35546848)

User-Agent strings are now net-negative in the web world. Their uses are slim, and their abuses are plentiful. They should probably be removed altogether, but in the meantime non-Chrome browsers should universally adopt Chrome's UA.

[ Parent | on HN ]

Re:Firefox rolls out Total Cookie Protection by default to m... by MrRadar on Wednesday April 12, 2023 @05:52PM (#35547515)

User-Agent strings are still useful for identifying non-browser user agents but I agree that given the privacy issues they present all browsers should adopt a single standard UA string (one each for desktop and mobile). (Did you know that Chrome on Android puts your device model in the UA string? One of the many reasons to use Firefox for Android...)

[ Parent | on HN ]