cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cookie settings are confusing and inconsistent

seasnail
Making moves

Selecting the "Custom" blocking level in the Enhanced Tracking Protection settings shows among other things a drop-down for cookie blocking levels. From what I can tell, this controls two things; the direct blocking of cookies and "Total Cookie Protection" ("TCP") cookie isolation, see https://support.mozilla.org/en-US/kb/introducing-total-cookie-protection-standard-mode and https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-user... but the setting is unclear in which option does what.

To add to the confusion, the documentation for this drop down menu at https://support.mozilla.org/en-US/kb/third-party-cookies-firefox-tracking-protection doesn't say what each of the levels do, and the options are different from the menu actually present, and further different between desktop and mobile. The mobile documentation at https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-android doesn't mention this menu. 

Here is the menu from the documentation:

Cookie_settings_documentation.png

It's a little confusing and would benefit from an explanation for each level, but does mention cross-site cookie isolation in the option that enables "TCP", and makes it fairly apparent this is a step up from just blocking cross-site tracking cookies. I do think there should be something to point users to the TCP option like "(default)" or "(recommended)" as it's probably the best for most users (hence why it's used now by both standard and strict ETP blocking levels).

Here is the menu from desktop Firefox (Linux, 147):

Cookie_settings_desktop.png

The only difference here is that the TCP option no longer specifies it blocks cross-site tracking cookies. I'm not sure if this means it doesn't any more, or if it never did, or if it's just a rename. With TCP, blocking cross-site tracking cookies isn't nearly as important I think, but in any case I think it should be more clear that TCP is the more effective solution of these two for most people - currently it sounds a bit weaker to me just from the description there, and the documentation should match what's actually in the browser.

Finally, here is the menu from Android (147 and 149 nightly):

Cookie_settings_mobile.jpg

And this is the main reason I created this issue - the order has changed, and the impression given by the position in the list which is otherwise ordered roughly by strictness and the description which suggests the second option is a straight addition to the first is that TCP (now the first option) is weaker than the second option, which unless something has changed is not the case. I was surprised by this and checked what each of these options do to network.cookie.cookieBehavior in about:config, and the first option is indeed "5" (TCP enabled), while the second option is "4" (TCP disabled). I can't find where about:config is documented (besides mozillazine which is very out of date), but unless TCP has been added to "4" (which I doubt or it would be the same as "5" surely?) this is really misleading.

Ideally, I think TCP should be separate and in addition to direct blocking settings, with it's own checkbox, so people know they are disabling/enabling something important and different from cookie blocking when they change it. Having an obvious checkbox would also be useful for people who want to check it's enabled.

Failing that, I'm not sure if these options really need to be exposed to users now TCP is as functional as it is, particularly on mobile. There are more useful options hidden behind about:config and while I personally block all cookies by default using an extension I wouldn't want to do that without an extension that gives granular control and works alongside the built-in TCP to still work on whitelisted sites. I can imagine someone might want to disable TCP globally and keep cross-site tracker blocking but  that still seems like a really niche use case. Currently I feel like anyone able to make an informed decision on this menu would be more than able to find the option in about:config, so having it here is kind of just leaving something for uninformed people to trip over by accident.

But either of those would be a big change, so I think it would be good if at least the support article was rewritten and the options renamed and reordered on mobile.

0 REPLIES 0