Block Third Party Cookies in Firefox 2

In Firefox 1.5, there was a simple preference to tell Firefox to accept cookies for the main site but not for web bugs and advertisers on the site. This was a nice compromise that blocked a lot of privacy-invasive uses of cookies while still allowing most poorly-implemented, cookie-based sites to function. That’s why I was quite surprised when I happened to look at my cookies in Firefox 2 and noticed lots of cookies from sites like ads.pointroll.com and 4.adbrite.com.

Tools -> Options -> Privacy -> Cookies -> “Allow sites to accept cookies” and “for the originating site only”

No big deal. The preference must have been nuked when I upgraded, so I opened up the privacy tab and looked for the right option. It wasn’t there! Maybe in security? Nope. Not there either, nor anywhere else I could find. It seems Firefox has given in to the howling of incompetent developers who never understood HTTP in the first place and were annoyed that their sites broke when users turned off third party cookies. Consequently they eliminated the preference. Don’t worry, however. There is a workaround.

You can restore the old behavior using the hidden preferences. Here’s how.

1. Type about:config in the location bar
2. Type “cookie” in the Filter field
3. Right-click network.cookie.cookieBehavior and select “Modify” from the pop-up menu
4. Change the value to 1
5. Click OK.
6. Close the window

Everything’s good, right? Well, no. It turns out that some evil sites have figured out how to get around this, and that’s where my bad cookies were sneaking in from. Firefox really needs to fix this, and it shouldn’t be that hard to do. Just change the behavior so it only allows cookies for what’s actually shown in the location bar, not any weirdness from frames or iframes or redirects.

In the meantime, the only built-in solution is to go back to site-by-site cookie preferences. Bleah. Firefox allows you to do this by going to Tool/Options (or Firefox/Preferences on the Mac), selecting the Privacy Tab, and then selecting “Ask Me Every Time” from the Keep Until choice menu.

Then you’ll constantly be bombarded by popups like this one:

Worse yet, if you accidentally block a cookie from a site that requires it, you’ll have to find that site in a dialog three levels deep and unblock it. The user interface is rather poor. A somewhat better UI is provided by Ron Beckman’s CookieSafe plugin.
This extension places an icon in your status bar you can use to accept, block, or temporarily accept cookies from the site. This gives you best privacy by blocking all cookies by default and then quickly enabling them only when a site absolutely refuses to work without cookies.

This entry was posted on Friday, November 3rd, 2006 at 7:13 AM and is filed under Privacy. You can follow any responses to this entry through the Atom feed. You can make a comment, Digg this story, or trackback from your own site.