allo- / ffprofile

A tool to create firefox profiles with personalized defaults.
GNU Affero General Public License v3.0
776 stars 56 forks source link

Disabling dom.storage.enabled breaks LOTS of sites. #254

Open Jieiku opened 2 years ago

Jieiku commented 2 years ago

With this feature checked I could not log in to reddit, grafana, Cloudflare, Nextcloud also would not load some assets, the UPS site could not load a tracking number, etc.

The notes for the option says:

Disables DOM storage, which enables so called "supercookies". Some modern sites will not work (i.e. missing "save" functions).

I think the note for this option should be:

Disables DOM storage, which enables so called "supercookies". Many modern sites will not work (i.e. missing "save" functions, sites affected include: reddit,cloudflare, grafana, ups, nextcloud and many others).

This wording might not be perfect either, but even just changing the word "Some" to "Many" would be better than it is now.

I appreciate this project, it did save me a TON of time, just gave it a star, thanks again.

allo- commented 2 years ago

This is getting a serious problem for quite a few settings. Many sites just silently expect such features to be there and don't care about breaking older browsers and so on. Even missing IndexedDB breaks sites in unexpected ways.

The whole "supercookies" wording may be a bit outdated, from a time when the features were new and people did not expect them to be used as "cookies" when they were defined for other things. And it was harder to delete theses storages back then, now the "Clear Cookies" function of Firefox should work on most relevant types of storages.

I think today the better options are a fake storage (like in private mode) or addons like CookieAutodelete. This setting is still interesting for really hardening the browser, but no good idea for a profile used for everyday browsing.

Also another use-case for #215. Providing metadata what a setting breaks would allow to keep the description short and have a own section what are the risks of disabling the feature.

Jieiku commented 2 years ago

I did install the temporary containers extension, if there were a way to disable dom.storage.enabled except for sites that I whitelist to use it then that would be great. Thanks for the note on IndexedDB, I went through all my bookmarks and that one has not caused me a problem yet, but if I do run into issues I will remember to try removing that setting. (I did install and configure cookie autodelete as well)

allo- commented 2 years ago

The best choice are currently addons that clear the storage after closing the tabs. There are probably some addons that fake the storage API and someone could probably write an addon that does this only in certain containers, but I do not know an addon I could recommend at the moment.

STPKITT commented 2 years ago

Did Mozilla remove the option to ask the user everytime a website tries to use DOM storage? On my old Firefox 56.0.2 install I still keep on one machine that is an option out of the box in Firefox's settings.

allo- commented 2 years ago

I am not sure, you can report if you tried something. I think Mozilla unified long ago most of the storage API backends which results in disallowing or deleting "Cookies" to delete other types of storage as well.

The whole thing is quite intransparent and I think from the exposed UI they do not make clear at all what's affected by their settings / cleanup dialog. It's especially hard to tell how it might work together with container tabs, which have storages that are not shared among each other.

If you know any good documentation that would be very helpful. I am also interested in how different CookieAutodelete addons may or may not work correctly with container tabs.