-
-
Notifications
You must be signed in to change notification settings - Fork 380
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Privacy Badger blocks CDN, although no cookies etc #2003
Comments
Action map, after having installed Privacy Badger in Firefox and visited a few blogs with the embedded comments:
|
This is related to #963. |
Privacy Badger sees the |
If Talkyard is able and willing to abide by the EFF Do Not Track policy's requirements on all |
Does this make sense? Let me know if you have any questions. |
Hi @ghostwords! Thanks for the reply & for looking into this :- ) 1. I'm curious about what's the rationale for blocking There's a I'm wondering, maybe this particular embedded-comments case wasn't taken into account, when Privacy Badger came up with the rules for what to block? 2. About the DNT policy: To me, the DNT policy seems to conflict a bit, with security. The DNT policy seems to require Talkyard to forget people quite quickly — and I'm thinking this could make it easier to do certain DoS attacks and astroturfing things. Some governments' internet troll armies, create astroturfing accounts years in advance. To be able to investigate if a bunch of accounts were created from roughly the same place, a few years later, I think it'd be helpful to remember at least the first parts of the ip address. Not sure what DNT thinks about that — remembering e.g. 3. Anyway, I should avoid setting the XSRF and browser id cookies, until they're needed for sure (or maybe I can remove them, and include the XSRF token in a But what about the session cookie — if someone signs up and posts comments at 3 different blogs, will P.B. then start believing that the comments are a tracker, and block them? Because of the session cookie? (Actually, also Safari on iOS reportedly start blocking the embedded comments. I suppose these cookies is why.) 4. The CDN. Maybe it'd be safer if I moved it to a completely diffrent domain (what do you think?). So, even if |
@ghostwords What about transient cookies a.k.a. session cookies? I.e. with no max age, that disappear when the browser closes? Does P.B. react to such cookies and consider them maybe tracking, or is P.B. ok with them? (I searched a bit for P.B + transient cookies / session cookies. Here I found a comment about those cookies: #1539 (comment) (by you b.t.w. :- )) — it doesn't clarify how things work though. ) |
1: It is very possible we overlooked this use case. Privacy Badger treats three different cookies (one per site) set by three different subdomains of the same third-party domain the same way Privacy Badger treats a single cookie set by one domain. 2: @alanton Could you chime in regarding balancing our DNT policy's privacy demands with service provider security considerations? 3: We are going to look into taking cookie duration into consideration (#1545), but we don't at this time. 4: Yes! Using a distinct, cookie-less domain for content delivery is also good from security and performance perspectives. Sorry for not replying earlier! |
I'm developing an embedded commenting system, like Disqus but open source, no ads, no tracking. There's SaaS hosting and a CDN.
Privacy Badger blocks the CDN — not immediately, but later, after I've visited a few (three?) different blogs, with the comments embedded. The CDN sets no cookies. The scripts from the CDN, reads from, but haven't written to, localStorage (they could do, though). No canvas fingerprinting. Still the CDN gets blocked.
Does the CDN need to be added to the yellowlist? (i.e.: https://github.com/EFForg/privacybadger/blob/master/src/data/yellowlist.txt )
Some other similar software (Discourse) is on the yellowlist. (e.g.
cdn.discourse.org
anddisqus.com
)(Here's one place where the embeded comments are being used, in case you'd like to understand better what it is: https://www.kajmagnus.blog/new-embedded-comments. Scroll down to see the embedded comments. (it uses a different older & deprecated CDN CNAME though so won't get blocked))
Tech details:
The blog post HTML page loads an iframe for comments, and another iframe with a text editor. Both iframes have origin
comments-for-(blog-addr).talkyard.net
. And these two iframes, load scripts fromcdn.talkyard.net
. Here's how it looks, for this Jekyll demo blog post:Problem
So, PB thinks the CDN is a tracker, because 1) the CDN is present at many differen websites (blogs), plus 2) some other reason(s) that I don't understand? (or is 1) enough?).
The embedded HTML comments pages, on the
comments-for-(blog-addr).talkyard.net
domain, currently do set cookies, always: a XSRF security cookie, and a browser id cookie for assisting with rate limiting and blocking bad people, and a session cookie if one logs in. But this shouldn't matter? The embedded comments HTML pages (comments-for...
) are reachable only via one website (i.e. the blog where the comments get embedded). So the [seen at 3 different places so it's a tracker] rule then cannot be broken? ...... Nevertheless, the
comments-for...
requests also get blocked by Privacy Badger. So, it's both the CDN (although no script, no localStorage, no fingerprinting), and the embedded HTML pages (they do set cookies, but are only embedded at one singe blog, each.) — I'm surprised that any of them get blocked?Going to
chrome://settings/siteData
in Chrome, there're lots of cookies when I search fortalkyard.net
— but they are all on subdomains likecomments-for-...talkard.net
. (And no cookies oncdn.talkyard.net
.)What do you think? What are the next steps to take, to fix this problem? or to continue trouobleshooting? I ran an "action map" script, see my comment below.
(Thanks for reading all this b.t.w. :- ))
The text was updated successfully, but these errors were encountered: