It would be nice to have the option to not just block your data from being accessible to a 3rd party but also feedback junk data into the system. Pollute the data stream until it’s no longer useful to the powers that be while still retaining functionality for the user.
Yeah it’s called data poisoning and you can do it with extensions like AdNauseum and TrackMeNot but I’m very confused why this strategy is not more popular.
I’m on a.com, that is what’s shown in the address bar.
The page includes a resource a.com/image.png. A request the server will include cookies from a.com. That’s a 1st party cookie. Correct?
The page includes a resource b.com/image.png. The request will not include cookies from a.com; this was always the case. b.com can however set their own cookies. Since we are on a.com, cookies from b.com are ‘third party’. Correct?
It gets interesting when we navigate to c.com and c.com includes b.com/image.png, a tracking pixel we have seen before on a.com.
Without 3rd party cookie protection, b.com sees the cookie they set previously while on a.com. This will now be blocked. Correct?
I am not sure, but I think browsers will block access to third party cookies from javascript. In your example, c.com/script.js will not be able to access b.com cookies. Now, when the browser sends the request to b.com/image.png, browsers will NOT send the cookies associated with b.com when visiting other domains than b.com. BUT, the request might contains a “referer” info set by the browser, hence b.com can still track you. This is something that some browsers block already, but as a web developer, I always see referers in the logs, so it’s either not working, or it is opt-in in the options, and normies don’t change it…
You’re correct about first-party cookies being from the domain in the address bar, like a.com in your example. When a page from a.com includes a resource from b.com, and b.com sets cookies, those are considered third-party cookies.
In a scenario where you navigate to c.com, which includes a resource (e.g., tracking pixel) from b.com, without third-party cookie protection, b.com would indeed have access to the cookies it set previously while you were on a.com. However, with 3rd party cookie protection measures, the browser restricts this access. This can impact user tracking and privacy.
In the JavaScript world, this is often managed through mechanisms like the SameSite attribute for cookies and technologies like ITP (Intelligent Tracking Prevention) in browsers. Developers need to adapt their code to these privacy measures to ensure compliance and user privacy.
Open up developer tools and look at the network requests just about any website you visit makes. Logged in to facebook.com and then went to visit a.com? Well, a.com has a Facebook like button and script delivered to your browser when you load their page that allows Facebook to figure out that your logged in Facebook user id visited a.com. Not only did you do that, but you hovered over a button to buy boots for 3 seconds and didn’t click. Now, Facebook calls home with the knowledge user 827027 is a potential boot buyer and can spam them with boot ads.
Interestingly, a.com also loads about 30 other scripts from other ad networks and trackers, including Google, and similarly lets them call home with info stored in their respective third party cookies.
Yeah they analyze your browser history and then generate labels of things you’re presumably interested in and then share it with any website that asks. Privacy friendly alright.
I know people are passionate about their love / hated of Brave, but it along with LibreWolf (and Firefox) all offer strong fingerprinting protection out of the box. With Firefox, just make sure you add uBlock Origin.
Ehhh there’s really no such thing as “fingerprinting info”. Your browser sends info about your PC to every webpage you visit so the page can load properly. Some of them just send more info than others, which makes it easier to fingerprint you.
Check out deviceinfo.me to see what kind of info your browser is sending.
Firefox does not “send” it, fingerprinting is done by tagging your hardware configuration from various values and create a unique key from that - independent of being logged in or any cookies - which can be used to track you. Things like browser & device user agent, browser window size, feature support (to determine browser version), etc. All of which are passively gathered by anything you could send a request to. There are ways to reduce this that Firefox and others do (such as reducing unique values in user agent, etc) but they’re not opting in to some privacy invading reporting mechanism.
That’s the tricky part. If you just don’t send anything then they’ll use THAT information to profile you, because no one else is doing that.
Also it can cause the page not to load properly.
So what most browsers do is spoof the information such that every user of that browser is sending the same information, when possible, regardless of whether it’s accurate.
If google is doing this, they have a much better way to track them.
They do. It’s the new “Ad Privacy” features built into Chrome that tracks every webpage you visited (locally) and then sends your profile out to advertisers when you visit a page.
I thought privacy as per Google meant that it will trade your data with everyone interested, just will not show them your name/phone number/address (which also quite conveniently makes Google the single point of contact with you and allows to charge more)
Add comment