Cookies, Cookies, and Cookies

[April, 2010]Update:

Mozilla removed this functionality from Firefox in version 2 and will not be reviving it. I’m going to leave the text below, as it does describe P3P, but any mention of Firefox should be considered as an example. For more information about Mozilla’s decision to remove P3P functionality from FireFox, please see the Bug Report.

————-

That’s cookies times three… or perhaps Third party cookies. Not the world’s greatest pun, but all the same a decent intro. In this posting I will explain third party cookies and why they are bad as well as provide a method to deal with these pesky cookies without destroying your “website experience.

What are cookies and what are “third party” cookies?

Cookies are small bits of information stored on your computer. Web-sites place tracking information in these cookies to remember who you are, if you’ve logged in, in the case of shopping carts, what you’ve purchased, and all sorts of other useful information. Most of this information is not publicly accessible, even with physical access to the machine because the information is stored server-side; however, the Session ID or other information is stored within the cookie. (This is what allows “session hijacking” with XSS.)

Cookies come in all shapes and forms: first party cookies, third party cookies, session cookies, etc. A first party cookie is issued by the site you are visiting and is only accessible by that website. For example, when you visit my blog, samurainet.org issues you a cookie to keep track of if you’ve logged in and for the “unique visit” counter. Only samurainet.org can access this cookie and it’s information and thus makes it a first party cookie.

A third party cookie can be issued by any web-site and subsequently can be accessed by any web-site. The main purpose of these are for tracking users and advertising. These cookies are not important to the operation of web-site, unlike first party cookies that may be carrying your Session ID.

Managing cookies with FireFox.

Firefox provides settings for cookie management. You will find these settings in Firefox’s advanced configuration. There are three settings that I will discuss here, network.cookie.cookiebehavior, network.cookie.p3plevel, and network.cookie.p3p. Each contains values that can be modified to affect the overall behavior of Firefox when dealing with cookies.

Network.cookie.cookiebehavior – This controls how the browser allows cookies. ( values: 0 – allow all, 1 – allow first party only, 2 – disallow all, 3 – allow cookies based on the P3P policy)

Network.cookie.p3plevel – This specifies the P3P acceptance policy when Network.cookie.cookiebehavior is set to 3. (values: 0 – Low[afafaaaa], 1 – Medium[ffffaaaa], 2 – High[frfradaa], 3 – Custom)

Network.cookie.p3p – This specifies the custom P3P policy. The policy specifies 8 positions with 4 separate values that I will explain below.

Selecting the policy for you.

The P3P (Platform for Privacy Preferences, a W3C project) policy dictates the handling of both first and third party cookies from sites of various levels of trust. The trust is based on what the web-site claims to be doing with your information and cookie information. As a personal rule, I distrust even reputable web-sites and prefer to keep cookies for as short a time period as possible.

P3P gives four possible values ( A – accept, D – downgrade to a session cookie, F – flag, and R – reject) for cookie management as well as 8 various scenarios for the cookie to fall under. The P3P cookie “byte” is structured as followed. (Taken from the Mozillazine.org web-site)

1. First party cookies from sites with no privacy policy
2. Third party cookies from sites with no privacy policy
3. First party cookies from sites that collect personal information without permission
4. Third party cookies from sites that collect personal information without permission
5. First party cookies from sites that collect personal information only with permission
6. Third party cookies from sites that collect personal information only with permission
7. First party cookies from sites that don’t collect personal information
8. Third party cookies from sites that don’t collect personal information

Firefox has built-in cookie management that ranges from blank policies (in the cookiebehavior) for accepting all, rejecting all, or accepting only first-party cookies as well as pre-built P3P policies of Low (accept all and flag suspicious third party), Medium (flag all suspicious first and third party, and accept the rest), and High ( flag suspicious first party, reject suspicious third party, accept all others and downgrade third party that collect personal information.) [I have used suspicious to refer to positions 1-4 since the site either claims no privacy policy or is collecting information without permission.]

That sure is a lot to process, but are those policies good? That really depends on if they suit your needs. My policy is a custom policy, meaning I have set cookiebehavior’s value to 3 as well as p3plevel’s value to 3 (custom). I have then specified the following p3p value: DRDRDRDR. Very simply I downgrade all first party cookies (meaning they will be deleted when I close Firefox) and I reject all third party cookies, regardless of where they came from. This provides me blanket protection against third party cookies, since I don’t care about advertising and I don’t want to be tracked. Also, it provides me the ability to still use all web-sites normally, but stops them from tracking me beyond one session (at least by using cookies.)

References:

http://kb.mozillazine.org/Network.cookie.cookieBehavior

http://kb.mozillazine.org/Network.cookie.p3p

http://forums.mozillazine.org/viewtopic.php?p=2576901

http://kb.mozillazine.org/Network.cookie.p3plevel

http://www.clicktracks.com/insidetrack/articles/first_v_third_cookies.php

http://www.w3.org/P3P/