Firefox rolls out Total Cookie Protection by default to all users

Why weren't separate cookie jars the default in the first place? I know that browsers other than Firefox have no real incentive to protect your privacy, but I'm wondering why cookies were designed to be shared among different pages in general

Does this obviate the need for [Facebook Container](<a href="https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;facebook-container&#x2F;" rel="nofollow">https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;facebook-cont...</a>)?

I wonder if there&#x27;s anyone from any advertising&#x2F;ad-targeting companies on HN who can shed some light on if&#x2F;how much this change may affect their &quot;product&quot;.<p>Asking this since I know friends working at companies that were DRASTICALLY affected by the Apple advertising changes in terms of user targetability (and hence revenue) and I&#x27;m wondering if this change will be similar.

Is this better or worse than Safari&#x27;s &quot;Prevent cross-site tracking&quot; feature?<p><a href="https:&#x2F;&#x2F;support.apple.com&#x2F;guide&#x2F;safari&#x2F;prevent-cross-site-tracking-sfri40732&#x2F;15.1&#x2F;mac&#x2F;12.0" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;guide&#x2F;safari&#x2F;prevent-cross-site-tr...</a><p>It appears Safari is just blocking the cookies, while Firefox is isolating the cookies. I guess Safari has to keep track of who to block while Firefox just isolates everybody. Are there other benefits to the Firefox approach?<p>Frankly, I have a hard time understanding why this Cookie Sandbox approach wasn&#x27;t implemented a long time ago. I get that 25 years ago we weren&#x27;t concerned about privacy, but there has been plenty of time to fix this. Advertiser influence?

It would be nice to allow users to create &quot;trusted tuples&quot; to list small groups of domains that are allowed to share their cookies. For instance: Zendesk, Asana, Jira, etc.<p>But have each tuple listed still be isolated from the other, only domains listed together in a single list could share a cookie container.

Very cool to see more privacy by default in Firefox.<p>It is still a lot of effort to have clear separations in every browsern...<p>I am using Firefox containers with the temporary containers plugins (with history deletion enabled) as well as cookies auto delete plugin (which supports containers).<p>Therefore, everything is usually isolated in a container inside a tab and only white listed cookies are kept in the named containers.

I&#x27;ve never understood the thinking that went behind allowing one site to see the existence of another site&#x27;s cookie in the first place. I don&#x27;t think I&#x27;m even coming at this with the security hindsight of decades, it&#x27;s just common sense, isn&#x27;t it?

Cool. Just a heads&#x27; up that I had to disable it on Zendesk and Asana so they could talk to each other - you might experience similar issues.

Privacy wins aside, can anyone please help educate if third party single sign ons will still continue to work?

&gt; making Firefox the most private and secure major browser available across Windows and Mac.<p>Which one do they think is the most private and secure browser for Linux?

I&#x27;ve had third party cookies blocked for ten years. Some sites don&#x27;t work. I don&#x27;t use those sites.

I wonder why Microsoft doesn&#x27;t make Edge a privacy-oriented browser. I&#x27;m surprised they think they can make more from the data economy than they would gain by seriously hurting Google et al.

How is this different from the old privacy.firstparty.isolate, and do I still need that&#x2F;should I keep that enabled?

I&#x27;ve been blocking cookies actively for a long time, and except some technical embeds (for example STEP file viewer on misumi) I had zero issue.<p>This is great news. I really hope we will not lose firefox. I&#x27;m not saying it is better than chromium, but I think it is important that it exists.

How does this relate to the existing tracking protection settings - should I turn off &quot;block all third party cookies&quot;?<p>That setting breaks a few things, but mostly works OK. I&#x27;m confused which protection level this new capability corellates to.

I remember losing a bet a while back, because I was naive enough to think that was how cookies worked in the first place. Why did other sites ever have access to cookies they didn’t create was beyond me.

If anyone wonders how bad the situation RE cookies is there is a local newspaper owner in the UK called reach PLC who own 100+ newspaper websites.<p>Their cookie allow dialog has over 700 data share partners, not including their own &quot;legitimate interest&quot; cookies. The dialog looks like this [1] and cannot be resized and is lazy loaded (i.e. you have to manually scroll to have the page load all of them with a few visible each scroll). And its slow so it takes a while and doesn&#x27;t play well with the mouse in the iframe. There are even ones not in english or latin characters [2]<p>[1] <a href="https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;ciuRWSx" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;ciuRWSx</a> [2] <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;4yc6Flo.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;4yc6Flo.png</a><p>Anyway i lazy loaded all of them and there are 753 (the html just to display it is &gt; 1 megabyte<p><pre><code> $ xmllint --format reach2.html | grep qc-cmp2-list-item-header | tail &amp;&amp; xmllint --format reach2.html | grep qc-cmp2-list-item-header | wc -l &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;Yieldmo, Inc.&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;YOC AG&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;YouGov&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;ZAM Network LLC dba Fanbyte&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;Zemanta, Inc.&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;zeotap GmbH&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;Zeta Global&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;Ziff Davis LLC&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;zillian sa&quot; aria-live=&quot;polite&quot;&gt; &lt;button role=&quot;listitem&quot; class=&quot;qc-cmp2-list-item-header&quot; aria-label=&quot;Zoomd Ltd.&quot; aria-live=&quot;polite&quot;&gt; 753 </code></pre> It&#x27;s crazy

Does this affect single-sign-on implementations?

I know Firefox has a small market share, but this is the sort of feature other browsers may adopt. Maybe not the big boys like Chrome or Edge, but I could see all the niche privacy focused browsers implementing it and maybe even Safari given Apples claims to support user privacy. If a certain percentage of browsers started to use similar functionality I could tracking companies starting to develop countermeasures.<p>In fact I&#x27;ve already encountered one site that gave me a popup telling me to enable third party cookies. It was one of those dodgy sites that scrapes and copies Stack Overflow content and the JavaScript that enabled it was very clunky - but it worked. I&#x27;m surprised there aren&#x27;t more websites already doing something similar.

Does anyone know if this covers network-layer state like keep-alive or TLS session reuse?

Why not abolish third-party cookies altogether? There are very few good uses for them.

It&#x27;s nice, but is that so hard for Mozilla to tell in which version it will appear? Is it the current version or is it the next 102 version (which releases in 2 weeks, but then why they say it &quot;rolls out&quot;?)

When will the browsers take care of handling the cookie options for all the sites, so I can declare my preferences once and everyone stops putting up a popup? Surely this is already in the works?

Does someone have a link about the technical details for developers that it might affect (SSO, cookies for subdomains, etc). This is just a marketing post.

Ok, is this just a more complicated (and less private) version of the 3rd party cookie blocking that’s been in safari for more than 15 years?<p>If it is better - which seems surprising given it still seems to result in 3rd party cookies continuing to exist - how does it compare to safari’s domain partitioning from what seems like 5 years back, or the newer aayyyy iiiii tracker detecting stuff?

please someone fix the internet... I don&#x27;t want to see any cookie popups on each site and accept &#x2F; decline each cooke first only so I can see the content I want. I don&#x27;t care about all these cookies and this should be managed by a browser. I hope what Firefox did is the beginning of such a fix.

Is that basically the PrivacyBadger plugin integrated into Firefox? Can I uninstall it now?

given that Electron is really just a featureless browser shouldn&#x27;t it be straightforward to make your own browser now? An address bar, navigation, and bookmarks ought to be enough to get you there. Seems like you should be able to make a browser for your specific needs&#x2F;wants pretty easily these days. I&#x27;m not suggesting some sort of money making venture where you&#x27;re beholden to investors to try and turn revenue with it but more just like a utility. Like a script or something... maybe that&#x27;s the way to think about it, something cobbled together quickly to read websites.

When Mozilla comes out with a feature like this it usually whitelists google, microsoft and similar big sites so people can still log in across their network. Anybody know the current list for this feature?

Reminds me of what Google Chrome (and others browsers) did for cache. That&#x27;s clever, not 100% sure this will prevent tracking, but at least it makes tracker&#x27;s life a bit harder.

I really want to enable resist fingerprinting, unfortunately it disables dark theming on github, ddg and other websites.<p>I wish I could add an exception rule to this...

I think OS Telemetry will see to it that its not private!<p>However this will make it easier than it currently is, to work out who is data sharing illegally.

This will only further entrench the big players (google, facebook, etc) while making it impossible for new &amp; small players to compete. All of the services the big players offer effectively make working without universal cookies trivial.<p>For the small players though, without massive ad-supported service offerings like Gmail, Facebook (as a platform), etc, this will screw them completely.<p>Mind you, I&#x27;m a HUGE privacy advocate, so I like the new Firefox functionality... but the unintended side effects cannot be ignored.

This is a fantastic way to do this. I wish Safari worked the same way instead of just completely blocking third-party cookies.

I see this and I ask why it hasn&#x27;t been this way since the beginning? why it took so long to have it?

UIs there a dashboard of somesort where I can see all the tracking&#x2F;cookies bullshit affecting me?

Can someone help me understand how this is different from blocking third party cookies?

Firefox + ublock origin is my trusted porn browser.

Would love for Safari &#x2F; iOS to follow suit.

Wish there was a feature or extension to auto accept cookie banners on websites

Cool but this product naming sounds like some scummy antivirus from 2001

Before anyone jumps to why Chrome doesn&#x27;t block third-party cookies, some context:<p>Regulators did warn Google NOT TO block third-party cookies before they provide a replacement, UK CMA accepted the latest proposal from Google: <a href="https:&#x2F;&#x2F;www.gov.uk&#x2F;government&#x2F;news&#x2F;cma-to-keep-close-eye-on-google-as-it-secures-final-privacy-sandbox-commitments" rel="nofollow">https:&#x2F;&#x2F;www.gov.uk&#x2F;government&#x2F;news&#x2F;cma-to-keep-close-eye-on-...</a><p>Apple&#x27;s tracking rules also raised a lot of anti-trust concerns, giving advertisement in App Store unfair advantages among other ad platforms. Latest from German Government: <a href="https:&#x2F;&#x2F;www.bundeskartellamt.de&#x2F;SharedDocs&#x2F;Publikation&#x2F;EN&#x2F;Pressemitteilungen&#x2F;2022&#x2F;14_06_2022_Apple.pdf" rel="nofollow">https:&#x2F;&#x2F;www.bundeskartellamt.de&#x2F;SharedDocs&#x2F;Publikation&#x2F;EN&#x2F;Pr...</a><p>Banning third-party cookies will increase the gap between Google, Microsoft, Apple and other ad platforms, because they can still track you based on your account (e.g. Gmail, Hotmail, iCloud). It&#x27;s a huge red flag for antitrust cases they are facing (especially Google).

About 90% of Mozilla&#x27;s income comes from Google.<p>If this would prevent tracking, Google would not allow Mozilla to release it.