1
I use Firefox 68.0 (as packaged by Fedora Linux 30). I have selected "Custom" content blocking, and enabled blocking "Cookies" from "Third-party trackers".
Does it also affect third-party tracking using LocalStorage, or not?
Assume that I do not use a Javascript blocking extension, because that takes a relatively large amount of effort.
sourcejedi
Posted 2019-07-13T09:22:39.527
Reputation: 2 292
0
Yes.
What does the storage access policy block?
The storage access policy blocks resources identified as trackers from accessing their cookies and other site storage when they are loaded in a third-party context. This prevents those resources from retrieving tracking identifiers stored in cookies or site storage and using them to identify users across visits to multiple first parties. Specifically, Firefox does this by imposing the following restrictions:
Cookies:
- Block Cookie request headers and ignore Set-Cookie response headers.
- Return an empty string for calls to Document.cookie and ignore requests to set cookies via Document.cookie.
DOM Storage:
- localStorage: Window.localStorage is null. Thus, attempts to read and write using this object will throw a TypeError exception.
- sessionStorage: read and write attempts are permitted.
At first I was confused about why sessionStorage is allowed. But it looks fairly harmless, at least with regard to protecting your privacy against third party advertising trackers.
session storage is really limited to the context of one particular session. Non-persistent HTTP cookies on the con-trary are shared between multiple tabs of the same website and thus not limited to one session. For tracking purposes Session Storage can only be used to track a user within one website during one specific session. Therefore this particular technique is not that useful as a stand-alone tracking technique. Because of this we from now on only pay attention to Local Storage.
This thesis was written before Firefox added the specific option to block known tracking cookies. Ivar Derksen goes on to show that, at the time, Firefox treated these other storage techniques very similarly to HTTP cookies. Derksen points out this similarity was recommended in the W3C specification:
sourcejedi
Posted 2019-07-13T09:22:39.527
Reputation: 2 292