Firefox tracking protection docs

[wbamberg]

I'm working on updating the documentation under https://developer.mozilla.org/en-US/docs/Web/Privacy relating to tracking. As part of this I am trying to understand the documentation on the tracking protections built into Firefox. There are 5 articles in total. I'm only going to cover three of them here, but might need to come back for the others.

The three articles are:

• Storage access policy: Block cookies from trackers
• State Partitioning
• Firefox tracking protection

First I'm going to try to summarise the articles as I understand them. Then I'm going to have some questions.

The articles

Storage Access Policy (SAP)

(https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Storage_Access_Policy)

This describes a Firefox feature which prevents third-party resources that have been identified as trackers from accessing site storage (including but not limited to cookies).

It uses the Disconnect list to see if a resource is a tracker (by its URL).

If the resource is a tracker, and it was loaded in a third party context, then the resource can't access storage (cookies, localStorage, etc).

Note that for the restriction to apply, the resource must be loaded in a third-party context (e.g. an iframe). If a third-party script is loaded into the main document context, it's not restricted.

Additionally, the restriction is sometimes lifted, based on some criteria (essentially related to user interaction).

State Partitioning (SP)

(https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/State_Partitioning)

(AKA Total Cookie Protection?)

This describes a Firefox feature in which third-party cookies (and other client-site storage APIs) are "double-keyed", by the third-party origin and the top-level site. So if top-level site A embeds an iframe with content from T, and top-level site B also embeds an iframe with content from T, then these are treated as distinct storage containers - code in T(A) can't access cookies that were set in T(B), and vice versa. So T can't correlate between A and B.

This applies to all third-party cookies, not just trackers.

Again, unpartitioned access is sometimes allowed, based on some user-interaction criteria. Also, a resource can ask for unpartitioned access using document.requestStorageAccess().

Firefox tracking protection (FTP)

(https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Firefox_tracking_protection)

(AKA Enhanced Tracking Protection?)

In Private Browsing windows (tabs, in Firefox for Android), Firefox will block content loaded from domains that track users across sites

...so in PB mode only, if a resource is identified (by URL) as a tracker, Firefox will block it

Unlike SAP, this also blocks resources loaded into the top-level document, and unlike SAP, this blocks the resource from loading totally, not just from accessing storage.

Content is blocked based on the domain from which it is to be loaded.

...the article does not say how Firefox determines this, but a Sumo article suggests that it is the same Disconnect list .

This article spends a lot of time on out of date Firefox screenshots.

It only talks about the protection applying in PB windows, but one of the screenshots of the Firefox preferences indicates that this is only for the default "Standard" FTP, and the "Strict" one blocks trackers in all windows. However, the current Firefox preferences doesn't say anything about PB windows, it just talks in vague terms about "Standard" being "Strong, reliable protections that work smoothly with most web sites." and "Strict" being "Stronger protections that block more trackers, but may cause some sites to break.". So I'm not sure if this is still the truth??

Questions

First, I suppose: have I understood these features correctly? Second, what's the relationship between them? Are they all shipping together?

There are some weird bits, like the SP article has a section on Past approaches to blocking cross-site tracking that seems to indicate that SAP is a "past approach", does this mean it is no longer current? Similarly, the intro to the SAP article says that SAP is "designed as an alternative to the older cookie policies, which have been available in Firefox for many years" - does that mean it is a replacement for FTP?

It's also odd because all the articles sort of refer to the thing they're doing as "tracking protection". For example, the FTP article is called "Tracking protection" but the SAP article has its own section called Tracking protection explained that doesn't acknowledge the FTP article at all.

So what's the story? Are these three features all shipping together in Firefox, and do they - together - constitute "tracking protection"? If so, should we try to integrate them?

[Josh-Cena]

Just came here to say that the content issue with the longest time of no activity, mdn/content#12205, is about tracking protection being entirely out of date. No one seems to be taking care of it.

[wbamberg]

Thanks for the response! This is what I was getting at with:

It[the article] only talks about the protection applying in PB windows, but one of the screenshots of the Firefox preferences indicates that this is only for the default "Standard" FTP, and the "Strict" one blocks trackers in all windows. However, the current Firefox preferences doesn't say anything about PB windows, it just talks in vague terms about "Standard" being "Strong, reliable protections that work smoothly with most web sites." and "Strict" being "Stronger protections that block more trackers, but may cause some sites to break.". So I'm not sure if this is still the truth??

There is a meta-question here, which is how far should MDN try to document these very browser-specific policies. It is surely helpful for web developers for us to talk about the fact that different browsers implement various anti-tracking policies, and to describe their broad outlines (e.g. double-keying cookies, blocking known trackers), but the level of detail in pages like https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Storage_Access_Policy#tracking_protection_explained seems a bit excessive.

Similarly for documentation that rests very heavily on the specific of a browser's devtools, like https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Storage_Access_Policy#developer_tools_notifications.

This is especially relevant to the question of what exactly "Strict" and "Standard" mean, because in current Firefox, as noted above, you are not told exactly what they mean, which presumably makes it easier for Firefox to change the details of it, but makes it more challenging for us to document it!

[Josh-Cena]

I think we almost always err on the side of "no proprietary documentation, ever", for the reason you mentioned. But for privacy that seems a bit counter-productive because browsers do take very different philosophical stances on privacy, so to not be proprietary is to not say anything at all.

I can imagine that the MDN-way of approaching this page is to find the union of features that each browser's private mode disables, because these are all features that developers cannot confidently rely on. But I don't know if that's practical.

[mb]

Hi, feel free to ask follow-up questions. I'll try to answer the questions you've laid out in this post:

Storage access policy: Block cookies from trackers

We stopped doing this. With State Partitioning (including TCP) we consider this not worth doing considering the breakage. We've unshiped tracker cookie blocking: Bug 1918342 - Flip the pref to stop blocking third-party tracker cookies.

State Partitioning (SP) (AKA Total Cookie Protection?)

Yes, seems like they are the same: https://hacks.mozilla.org/2021/02/introducing-state-partitioning/. Although the name TCP focuses more on the cookie part (which is Firefox specific) and less on the static partitioning part (which is shared across browsers), such as network cache partitioning, network connection partitioning, see first section of https://privacytests.org/ for comparison (sorry don't have a better one).

Firefox tracking protection (FTP) (AKA Enhanced Tracking Protection?)

They are different things (as far as I can tell).

(Firefox) Tracking Protection is one part of Enhance Tracking Protection. It is the part which blocks third party requests when they appear on our tracking lists. This is why I would prefer to call it Tracker Blocking.

The Enhanced Tracking Protection (ETP) also includes other prefs/features related to privacy: The page https://firefox-source-docs.mozilla.org/toolkit/components/antitracking/anti-tracking/etp-matrix/ covers the various prefs (including TCP: cookieBehavior). ETP is a living definition in the sense that we do add/remove prefs from there from time to time.

• ETP-Strict is both used for protection that has higher breakage and stops us from enabling for everyone (we only enable fingerprinter/cryptominer lists for everyone, tracking/emailtracking are only enabled when enabling strict or in private browsing windows).
• ETP-Strict is also used for roll-outs of new protections to observe breakage and then roll out for everyone (ETP-Standard) later on (e.g. Bounce Tracking Protection, Local Network Access, TCP). After rolling out we do remove them from the list again after some time.