Google will never deprecate 3rd party cookies, and without cross-vendor support Mozilla will be attacked when sites start breaking.
It's a real shame, I've been blocking all 3rd party cookies and referrers for years and really want to see the web to a more privacy concious model. With all the web features tracking tricks out there now though, I feel it's nigh impossible.
Take for instance, common Javascript libraries hosted on CDNs. Every time you visit a jQuery based page where the js file is on a CDN you reveal to the host of that CDN (e.g. Google) what website you're on. You also put complete faith in that 3rd party CDN provider for your security.
3rd party cookies are just the tip of the iceberg in terms of how broken the web is for the privacy concious.
Mozilla will be attacked when sites start breaking.
I have been browsing with third party cookies blocked for years - the problems have been trivial, like disqus embedded comment boxes not letting me log in. I've never noticed anything important breaking.
You can experience it yourself in Firefox via Preferences -> Privacy -> Third party cookies -> Never
vk.com (one of the top sites in Russia) at least used to break with third party cookies disabled — and breaking one of the largest websites in Russia is a quick way to lose marketshare there.
*Safari blocks third party cookies from sites you haven't previously visited and received cookies for by default. Mozilla experimented with similar behaviour but decided against it.
Decided against merging that default to the Beta channel. I believe "allow visited third party cookies" is the default in the Nightly and Aurora channels.
Mozilla will be attacked when sites start breaking.
That's the thing, blocking 3rd party cookies breaks (in my anecdotal experience) under 5% of sites. In general the only problem I see with it is when a site uses an iframe with a different domain that requires cookies which is a bad practice that shouldn't be done anyway. I can only think of two sites I know break because of this.
Take for instance, common Javascript libraries hosted on
CDNs. Every time you visit a jQuery based page where the
js file is on a CDN you reveal to the host of that CDN
(e.g. Google) what website you're on
Generally that only happens the first time you load the library:
That's easy. Just ask me (the user) for permission and explain why you would like to do so. If your users don't like it then maybe you shouldn't be doing it.
On the server side, companies are bound by data protection laws. Using the browser as a loop-hole for profit is not acceptable. Instead we get these absurd EU 'this site uses cookies' banners that do less than nothing for user privacy.
Just ask me (the user) for permission and explain why you would like to do so.
Unfortunately, it's not that simple.
From a user's point of view, asking questions that interrupt their browsing experience on every other site is usually unwelcome. The "We use cookies (like everyone else in the known universe)" messages in Europe that you mentioned are a great example, where good intentions ran headlong into practical limitations and the result was something that no-one actually likes.
From a business point of view, that same poor experience is a negative because it makes your site less attractive to visitors and ultimately hurts conversion. This remains true even if you're doing something reasonable with innocent intentions that almost all of your visitors would actually be happy for you to do.
I am very much in favour of protecting privacy on the Web and letting users make informed choices about when they are willing to give it up in return for something they value, but I don't see this working in practice until we have some sort of mandatory (with force of law) standards for disclosure by site operators that allow browsers to offer standardised preferences to their users that can be set once and then safely forgotten about. I think we need some sort of standardised, automation-friendly privacy policies, like the credit agreements where providers are required to provide key information up front in a standard format with the same assumptions for everyone, or the way a few open source licence agreements have become established and much of the time both the licensor and the licensee can just say "GPLv2" or "BSD" and everyone knows the deal.
Unfortunately, the wheels of standards turn slowly, the wheels of law more so, and the wheels of laws respected across borders even more so. Meanwhile, the wheels of businesses funded by invading privacy or otherwise exploiting users via modern technologies tend to turn very fast. I'm not sure how we fix this problem as long as the politicians are as technically illiterate and generally open to manipulation by special interest groups as they obviously are in many first world countries today.
Sounds like you're talking about P3P, which at least is a ridiculous useless standard that I'm guessing most server operators copy-paste and tweak a http header without understanding it just to get IE to work as expected.
P3P is a small step in what I'm arguing would be the right direction, but I doubt anything like that would bring any significant improvement in general privacy standards unless it was widely supported (all major browsers), legally mandated (with meaningful enforcement against violations), and most important of all, able to adapt as technologies and the ethics of privacy evolve.
It needs to be able to capture the things that significant numbers of people care about and summarise the main types of behavior encountered on real world web sites, but in a way that everyday users can see and configure in a few moments in their browser. This is a tall order, of course, but even a decent attempt at it would probably be better than the utter contempt for privacy and blatant exploitation of users' ignorance that is widespread today.
As a benchmark, I suggest looking at the way organisations like Facebook have presented privacy settings. Non-technical people understand concepts like sharing data with everyone vs. limited audiences, or allowing their name/photo to be associated with something. Significant numbers of people do set these preferences, and do object when they are violated or when their "preferences" are changed for them. But the choices probably have to be explained and configured at that kind of level of simplicity or it'll all be too much for most people to bother with.
Oh, you mean like all the apps of Facebook that (the users) just get "Accept" clicked so you can share your Cookieland Adventure scores with everyone that doesn't care.
(If there's a real app named Cookieland Adventure, I'm sure it's awesome, this was just a made up example, if you, your spouse or someone you vaguely remember talking to works on a Cookieland Adventure game for FB, I am sorry to associate your app with the scum of the earth)
You could try copy and pasting jquery into the developer console for a one-time trick. If a dependency needs jquery to load, try setting a break point before that script and paste jquery into your console.
Perhaps you could put it on your own server, then redirect all calls to Google's CDN to your own server? This way it works automatically for you. You could also add files and CDN's to your setup as necessary.
Comments
Google will never deprecate 3rd party cookies, and without cross-vendor support Mozilla will be attacked when sites start breaking.
It's a real shame, I've been blocking all 3rd party cookies and referrers for years and really want to see the web to a more privacy concious model. With all the web features tracking tricks out there now though, I feel it's nigh impossible.
Take for instance, common Javascript libraries hosted on CDNs. Every time you visit a jQuery based page where the js file is on a CDN you reveal to the host of that CDN (e.g. Google) what website you're on. You also put complete faith in that 3rd party CDN provider for your security.
3rd party cookies are just the tip of the iceberg in terms of how broken the web is for the privacy concious.
You can experience it yourself in Firefox via Preferences -> Privacy -> Third party cookies -> Never
Oh crap, is THAT why I can usually not log in to disqus even when I disable Disconnect!
Man, that had been a mystery to me forever, I must have disabled third party cookies and not even remembered doing it.
And now Mozilla will hide or get rid of that feature because ignorant users accidentally enable it and break the web. ;-)
vk.com (one of the top sites in Russia) at least used to break with third party cookies disabled — and breaking one of the largest websites in Russia is a quick way to lose marketshare there.
my.t-mobile.com is broken in some significant ways without third-party cookies.
Mozilla doesn't seem to be breaking any new ground here. Safari already blocks third party cookies by default.
*Safari blocks third party cookies from sites you haven't previously visited and received cookies for by default. Mozilla experimented with similar behaviour but decided against it.
Decided against merging that default to the Beta channel. I believe "allow visited third party cookies" is the default in the Nightly and Aurora channels.
That's the thing, blocking 3rd party cookies breaks (in my anecdotal experience) under 5% of sites. In general the only problem I see with it is when a site uses an iframe with a different domain that requires cookies which is a bad practice that shouldn't be done anyway. I can only think of two sites I know break because of this.
(I work at Google on ngx_pagespeed, and sit next to the people who maintain the hosted libraries.)
The real deal is to find a way that user and business can both gain something. And this is hard.
That's easy. Just ask me (the user) for permission and explain why you would like to do so. If your users don't like it then maybe you shouldn't be doing it.
On the server side, companies are bound by data protection laws. Using the browser as a loop-hole for profit is not acceptable. Instead we get these absurd EU 'this site uses cookies' banners that do less than nothing for user privacy.
Just ask me (the user) for permission and explain why you would like to do so.
Unfortunately, it's not that simple.
From a user's point of view, asking questions that interrupt their browsing experience on every other site is usually unwelcome. The "We use cookies (like everyone else in the known universe)" messages in Europe that you mentioned are a great example, where good intentions ran headlong into practical limitations and the result was something that no-one actually likes.
From a business point of view, that same poor experience is a negative because it makes your site less attractive to visitors and ultimately hurts conversion. This remains true even if you're doing something reasonable with innocent intentions that almost all of your visitors would actually be happy for you to do.
I am very much in favour of protecting privacy on the Web and letting users make informed choices about when they are willing to give it up in return for something they value, but I don't see this working in practice until we have some sort of mandatory (with force of law) standards for disclosure by site operators that allow browsers to offer standardised preferences to their users that can be set once and then safely forgotten about. I think we need some sort of standardised, automation-friendly privacy policies, like the credit agreements where providers are required to provide key information up front in a standard format with the same assumptions for everyone, or the way a few open source licence agreements have become established and much of the time both the licensor and the licensee can just say "GPLv2" or "BSD" and everyone knows the deal.
Unfortunately, the wheels of standards turn slowly, the wheels of law more so, and the wheels of laws respected across borders even more so. Meanwhile, the wheels of businesses funded by invading privacy or otherwise exploiting users via modern technologies tend to turn very fast. I'm not sure how we fix this problem as long as the politicians are as technically illiterate and generally open to manipulation by special interest groups as they obviously are in many first world countries today.
Sounds like you're talking about P3P, which at least is a ridiculous useless standard that I'm guessing most server operators copy-paste and tweak a http header without understanding it just to get IE to work as expected.
P3P is a small step in what I'm arguing would be the right direction, but I doubt anything like that would bring any significant improvement in general privacy standards unless it was widely supported (all major browsers), legally mandated (with meaningful enforcement against violations), and most important of all, able to adapt as technologies and the ethics of privacy evolve.
It needs to be able to capture the things that significant numbers of people care about and summarise the main types of behavior encountered on real world web sites, but in a way that everyday users can see and configure in a few moments in their browser. This is a tall order, of course, but even a decent attempt at it would probably be better than the utter contempt for privacy and blatant exploitation of users' ignorance that is widespread today.
As a benchmark, I suggest looking at the way organisations like Facebook have presented privacy settings. Non-technical people understand concepts like sharing data with everyone vs. limited audiences, or allowing their name/photo to be associated with something. Significant numbers of people do set these preferences, and do object when they are violated or when their "preferences" are changed for them. But the choices probably have to be explained and configured at that kind of level of simplicity or it'll all be too much for most people to bother with.
Oh, you mean like all the apps of Facebook that (the users) just get "Accept" clicked so you can share your Cookieland Adventure scores with everyone that doesn't care.
(If there's a real app named Cookieland Adventure, I'm sure it's awesome, this was just a made up example, if you, your spouse or someone you vaguely remember talking to works on a Cookieland Adventure game for FB, I am sorry to associate your app with the scum of the earth)
NoScript will stop the jquery download. If that breaks the whole site then I probably don't need to use your webapp anyway.
Almost every website that loads jQuery from Google breaks down when I refuse to connect to Google's CDN.
Does anyone know how I can load jQuery locally?
You could try copy and pasting jquery into the developer console for a one-time trick. If a dependency needs jquery to load, try setting a break point before that script and paste jquery into your console.
Perhaps you could put it on your own server, then redirect all calls to Google's CDN to your own server? This way it works automatically for you. You could also add files and CDN's to your setup as necessary.
Put it on your server as a regular file. Update your script references to point to the file.