5 ms·

Yes, you can follow the meta-bug here to see the current issues we're working on resolving in a better way: https://bugzilla.mozilla.org/show_bug.cgi?id=1537702

Yes, you can follow the meta-bug here to see the current issues we're working on resolving in a better way: https://bugzilla.mozilla.org/show_bug.cgi?id=1537702 https://bugzilla.mozilla.org/show_bug.cgi?id=1537702 Perhaps unsurprisingly, Microsoft logins are the most glaring exceptions right now (Teams, Logins, Office, Live), and we're working with MS to see if we can find an acceptable fix (or work-around while it's fixed). There are also exceptions for github.dev and history.com right now. It's worth mentioning that these aren't simply exceptions which blanket enable tracking for those sites, it's just to work around specific breakage. We're also working around some other specific site logins or features breaking, which would not break if sites called the new requestStorageAccess API appropritately. We're using SmartBlock to shim those cases until the sites can fix it themselves.

daveoc64 4y ago
What is the "better way" here? There is a legitimate use case for having login/identity stuff on a different domain - many of the largest companies in the world are doing this. How can this issue be solved without either confusing users through the requestStorageAccess API, or forcing everyone to use a single domain for everything?
- wisniewskit 4y ago
  Right, Total Cookie Protection has been baking for a while to try to minimize that kind of breakage, and we're already in discussions with other browser vendors and companies to get everyone onboard on the Privacy CG. In a nutshell, adding new case-specific web APIs seems to be the likely way forward here. There are proposals floating around like an "is logged in" API, the Federated Credential Management API, and so on. I'm not sure there's ever going to be a perfect solution for everything, but I would certainly rather have users more informed and empowered about their privacy than they currently are (even if some folks prefer to just "allow all"). I guess we'll just have to wait and see which proposals win out, and in the meantime rely on heuristic-based solutions like Total Cookie Protection to iteratively get us to a better place.
- mk81 4y ago

daveoc64 4y ago

What is the "better way" here? There is a legitimate use case for having login/identity stuff on a different domain - many of the largest companies in the world are doing this. How can this issue be solved without either confusing users through the requestStorageAccess API, or forcing everyone to use a single domain for everything?

wisniewskit 4y ago
Right, Total Cookie Protection has been baking for a while to try to minimize that kind of breakage, and we're already in discussions with other browser vendors and companies to get everyone onboard on the Privacy CG. In a nutshell, adding new case-specific web APIs seems to be the likely way forward here. There are proposals floating around like an "is logged in" API, the Federated Credential Management API, and so on. I'm not sure there's ever going to be a perfect solution for everything, but I would certainly rather have users more informed and empowered about their privacy than they currently are (even if some folks prefer to just "allow all"). I guess we'll just have to wait and see which proposals win out, and in the meantime rely on heuristic-based solutions like Total Cookie Protection to iteratively get us to a better place.
mk81 4y ago