Firefox 86 features several images, “Total Cookie Protection”

Mozilla released Firefox 86 yesterday, and the browser is now available for download and installation for all major operating systems, including Android. Along with the usual round of bug fixes and internal updates, the new build offers some high-profile features – support for watching multiple Picture-in-Picture videos and stricter (optional) cookie separation, which Mozilla is Total branded Cookie Protection.

Trying Firefox 86

Firefox 86 became the default download on mozilla.org on Tuesday – but as an Ubuntu 20.04 user, I didn’t want to leave the repositories managed by Canonical just to test the new version. This is a scenario where snaps really are excellent – providing you with a containerized version of an application, easily installed, but guaranteed not to mess with your “real” operating system.

It turns out that the Firefox instant channel did not receive the message about build 86 being the new standard – the latest/default snap is still at version 85. To get the new version, I needed to snap refresh firefox --channel=latest/candidate.

With the new version installed quickly, the next step was to actually run it – which could be much easier. The snap produces a separate Firefox icon in the Ubuntu launcher, but there is no way I know to readily distinguish between the system icon firefox and the new snap-installed firefox. After some frustration of success and error, I finally jumped to the terminal and executed it directly by issuing the command fully forwarded /snap/firefox/current/firefox.

Multi Picture-in-Picture mode

In December 2019, Firefox introduced Picture-in-Picture mode – an additional overlay control on videos embedded in the browser that allows the user to separate the video from the browser. Once detached, the video has no window – no title bar, min. / Max. / Close, etc.

PiP mode allows users who organize their windows – automatically or manually – to watch the video while consuming minimal screen space.

Firefox 86 introduces the concept of multiple simultaneous Picture-in-Picture instances. Before building 86, setting the PiP control on a second video would simply reconnect the first video to its parent tab and detach the second. Now, you can have as many floating, disconnected video windows as you like – potentially turning any monitor into something that resembles a security DVR screen.

The main thing to realize about multi-PiP is that the parent tabs must remain open – if you navigate away from the parent tab of an existing PiP window, the PiP window itself also closes. After I realized this, I had no difficulty in surrounding my Firefox 86 window with five separate video windows, playing simultaneously.

Total Cookie Protection

In December, we reported the introduction of cache partitioning in Firefox 85 – a scheme that makes it harder for others to find out where you have been and where you have not been on the Internet. Firefox 86 raises the stakes again, with a scheme that Mozilla is calling “Total Cookie Protection”.

In short, Total Cookie Protection restricts the ability of third parties to monitor your movement over the Web using embedded elements, such as scripts or iframes. This avoids tracking cookies from Facebook, Amazon, et al. to “follow you around the web”.

In theory, cookies were already strictly per site – so contoso.com cannot set or read cookies belonging to facebook.com and vice versa. But in practice, if contoso.com voluntarily incorporates active Facebook elements into its website, the user’s browser will treat those elements as belonging to Facebook itself. This means that Facebook can set the value of a cookie while you are browsing contoso.com and then read that value again later, when you are actually on Facebook (or when you are on other totally unrelated sites that also incorporate Facebook content).

Total Cookie Protection overrides this feature by creating separate “jar of cookies” based on the identity of the URL actually present in the address bar. With this feature enabled, a Facebook script running on contoso.com can still set and read a Facebook cookie – but that cookie resides only in the contoso.com cookie jar. When the same user browses directly on facebook.com, afterwards, Facebook cannot read, write or even detect the presence of a Facebook cookie in the contoso.com cookie jar or vice versa.

This is not a panacea against tracking in any way – for example, it does nothing to prevent scripts from Facebook, Amazon, et al. from uploading data about your travels on the web to your to have servers to profile you there. But at least it prevents them from using their own computer’s storage to do the dirty work for them.

Not the other TCP

If you want to enable Full Cookie Protection (and we really would like Mozilla to have chosen a name that does not boot as TCP), you will first need to set Advanced Tracking Protection for the Strict profile. To do this, click on the shield icon to the left of the address bar (visible when browsing any real website, not visible on the New Blank Tab screen) and click Protection Settings. From there, you can change your ETP profile from Standard to Strict.

Total Cookie Protection has some (apparently coded) exemptions for third party login providers – for example, logging into YouTube with a personal Gmail account still allowed a visit to Gmail.com on another tab to instantly load the correct inbox without you need to log back in separately.

Mozilla warns that the Strict Enhanced Tracking Profile can break some websites completely – and we believe in Mozilla – but in our own quick tests, we found no problem. We had no difficulty uploading and signing in to Gmail, YouTube, Facebook, Twitter and several other important sites.

List image by Airwolfhound / Flickr