112
Firefox allows Google to use cross-site cookies by default despite claiming to block all of them OOTB (wetdry.world)
submitted 2 years ago by to c/privacy@lemmy.ml
36 comments fedilink hide all child comments
 

Did you know? Despite claiming to block all cross-site cookies out of the box, Firefox automatically allows Google to use them in your browser should you log in to one of their services.

The browser only lets you know about this once it happens, and it's on you to notice the permissions icon appearing in the URL bar. There is a link to a paragraph on a help page explaining this behaviour, but it seemingly goes unmentioned pretty much everywhere else on the internet.

This surprised me, especially considering Firefox's stance on privacy. I was even more surprised that this is done without consent. If this is for usability, Firefox should at least warn the user before this happens.

all 38 comments

sorted by: hot top controversial new old
[–] 220 points 2 years ago (3 children)

Take it you didn't click "learn more"?

To sign into YouTube, you need to sign into Google.Com. that's the cross site script. Nothing scary, or unexpected.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 134 points 2 years ago (2 children)

    What's with the influx of anti Firefox posts here? Really weird. Especially since yes everything is in their learn more stuff.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 78 points 2 years ago (1 child)

    It is a bit odd that there’s an influx of anti Firefox and AMD stuff after Google and Intel were in the news for major things.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 23 points 2 years ago (2 children)

    People have been up in arms for every new "flavor of the month" browser that boasts better security, or some new privacy thing, and Firefox not offering it. Also, the freakout about Mozilla enabling "ad-tracking" was wildly misunderstood and overblown by the privacy nuts, but started a slew of these "WELLFFDIDTHISTHINGBLETRRGGHWAAAHHHHHHH"

    It's all overblown in my opinion.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 17 points 2 years ago (1 child)

    "flavor of the month" browser

    "flavor of the month" browser Chromium

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    Well I would have just said Chromium then, but that's not what I said.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -1 points 2 years ago (1 child)

    If you've lost your entire user base except the privacy nuts, you should be very careful about your messaging because they're your only demographic left.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 11 points 2 years ago

    It's not clear who you are referring to. Privacy nuts seem to hate every browser that exists at the moment. I even see people pissed an Librewolf for one thing or another.

    Fact of the matter is that the browser is less the problem, and the contents they consume are, yet people are unwilling to just stop interacting with the sites that cause their concerns. There's no way to win with everyone.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 69 points 2 years ago (3 children)

    Don't log into their services.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 26 points 2 years ago (1 child)

    Don't visit the websites.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 28 points 2 years ago (1 child)

    Don't even use HTTP, only Gopher and BBS.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] 15 points 2 years ago* (last edited 1 year ago) (1 child)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 26 points 2 years ago (1 child)

    Don't even use a computer, talk to your friends in person.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 33 points 2 years ago (2 children)

    Don't even have friends, talk to the voices in your head.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
    • [–] 66 points 2 years ago

    If they wouldn't allow this, signing into YouTube wouldn't work

  • permalink
  • fedilink
  • source
    •
    [–] 17 points 2 years ago (2 children)

    If you access Google sites only in a special Firefox container, that still isolates your Google cookies from the rest of your tabs? Or does it just add a “you don’t get this from me” flag when it gives Google your user cookie, so it can pretend to not recognise you as it adds your web-browsing history to your ad-targeting profile (flagged appropriately as to keep it deniable, of course)?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 10 points 2 years ago (1 child)

    Yes.
    I have a google container for one account.
    If I open a google site in another container it will be as if the account didn't exist.
    The containers are all partitioned.
    You can also partition off the cookie/storage per site by proxy used (in about:config).
    So, you could create a container for google account 1 using proxy 1 and another container for google account 2 using proxy 2 and they will never have access to the data stored by either.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    Out of curiosity, do you know if these containers also obfuscate browser and device fingerprinting? Separating cookies is important but unless it also blocks fingerprinters (in a different way for each container) the site will instantly know the same person is using both accounts.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago* (last edited 2 years ago)

    FF doesn't really enable full fingerprint resistance by default. But it can.

    These settings are some of what I usually use. All fingerprint values (that are able to be are randomised on every reload of a page.

    Set secutity setting to custom, select known AND suspected fingerprinting > select from dropdown 'In ALL tabs'

    Also: Because it's of no value / use to me, and (IMHO) a giant gaping privacy and security issue, I also disable webgl and webrtc, and navigator completely in about:config

    Set the following:

    WebGL webgl.disabled true
    WebGL2 webgl.enable-webgl2 false
    WebRTC media.peerconnection.enabled false
    Navigator media.navigator.enabled false
    RFP privacy.resistFingerprinting true

    RFP options like bounce protection etc can also be enabled in config.

    Check fingerprints on browserleaks.com, coveryourtracks.EFF.org, etc

    Should be 100% unique fingerprint every time.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago*

    I think the "rest of your tabs" would have to be sites that already include google js (e.g. for "sign in with google" type stuff) to even know you have a google cookie (otherwise what's the point of FPI/ETP/TCP/network partitioning/no-3rd-party-cookies/etc.), but I could be wrong.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 2 years ago

    Is it sufficient to set the Enhanced Tracking Protection to "Strict" (which claims to block cross-site cookies in all windows), or is there something else you have to do?

  • permalink
  • fedilink
  • source
    •
    [+] -15 points 2 years ago (1 child)

    So google is a privacy nightmare. Google pays firefox. There’s not a lot more dots to connect here. How is anyone surprised at things like this?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] -3 points 2 years ago (1 child)

    I don't know why you're getting downvotes.

    All of the incentives line up. That's why you always examine incentives.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •