[Oni]

Don't use Firefox anymore, but this is good news. Curious if this would stop cookie-logging or XSS-specific problems.

Cookies, those well-known morsels of data that web browsers store on a website’s behalf, are a useful technology, but also a serious privacy vulnerability. That’s because the prevailing behavior of web browsers allows cookies to be shared between websites, thereby enabling those who would spy on you to “tag” your browser and track you as you browse. This type of cookie-based tracking has long been the most prevalent method for gathering intelligence on users. It’s a key component of the mass commercial tracking that allows advertising companies to quietly build a detailed personal profile of you.

In 2019, Firefox introduced Enhanced Tracking Protection by default, blocking cookies from companies that have been identified as trackers by our partners at Disconnect. But we wanted to take protections to the next level and create even more comprehensive protections against cookie-based tracking to ensure that no cookies can be used to track you from site to site as you browse the web.

Our new feature, Total Cookie Protection, works by maintaining a separate “cookie jar” for each website you visit. Any time a website, or third-party content embedded in a website, deposits a cookie in your browser, that cookie is confined to the cookie jar assigned to that website, such that it is not allowed to be shared with any other website.

Read More: https://blog.mozilla.org/security/2021/0...rotection/

[Drako]

That's good to see. Cookies can be a real privacy nuisance. All you need is a password manager to automate logging in. Cookies aren't a necessity.

I never liked the enhanced privacy protection feature in Firefox. The interface isn't very intuitive, and it's impossible to completely disable. So I find it a bad feature.

[Oni]

That's good to see. Cookies can be a real privacy nuisance. All you need is a password manager to automate logging in. Cookies aren't a necessity.

I never liked the enhanced privacy protection feature in Firefox. The interface isn't very intuitive, and it's impossible to completely disable. So I find it a bad feature.

Cookies are almost all-encompassing actually. For example, if you're logged in to Sinisterly right now you're guaranteed to have an "sid" cookie (as well as others).

In the instance of this vulnerability, you could hypothetically cookie log the admin of a forum and replicate their session.

[mothered]

In the instance of this vulnerability, you could hypothetically cookie log the admin of a forum and replicate their session.

Absolutely spot-on.

With cookie/session hijacking, you'd have full access thereafter.