Firefox. Cookies. Privacy.

Mozilla proudly trumpet from the rooftops that they more than any other browser protect your privacy because they tell sites not to track you. All you need to do is tick one little box and you can’t be tracked. Anywhere.

Hanlon’s Razor: Never attribute to malice that which is adequately explained by stupidity.

But they utterly – and they aren’t stupid – fail to explain cookies and do a terrible job of letting you choose which sites can and cannot track you. See that? Mozilla say sites cannot track you but sites do track you regardless of that silly little box. Malice? That is probably too harsh but they are certainly working to an agenda that puts privacy low on the list.

The above list of cookies would be much larger if I wasn’t also using Ghostery which does care about privacy. As does the BetterPrivacy extension because Flash cookies are evil.

So here is how you let certain sites keep cookies in Firefox.
Get to the Firefox Preferences

Click Exceptions (from the image above)

Click Settings (from the large image above)

and when you restart you will have just those cookies you want.

and you just did more for your Privacy than that ridiculous little box. Mozilla could make that process much much easier and explain each step but they choose not to. They don’t really care about your privacy because cookies are a major part of that. Just me that thinks this?

With recent browsers, the cookie setting that offers users the most pragmatic tradeoff between cookie-dependent functionality and privacy is to only allow cookies to persist until the user quits the browser (also known as only allowing “session cookies”). says the EFF.

but Firefox defaults to letting all tracking and all cookies happen. It does nothing to educate users either in their browser or on their site. Makes all that noise about the tracking box just that – noise. Mozilla has a site just for Do Not Track – http://dnt.mozilla.org/ and here are some words from there (you might want to count how many times they use the word cookie):

How does Do Not Track work with other privacy tools?
Do Not Track is one of many privacy solutions. Do Not Track does not replace your anti-virus software, will not encrypt data, and is not a security mechanism. There are several other privacy and security features within Firefox.

Will Do Not Track affect the rest of my Web experience?
Do Not Track may interfere with some personalized services you enjoy. For example, a Do Not Track request might mean you would have to type in your zip code each time you want to view a weather report, rather than seeing the weather automatically displayed. Personalization on websites can save you time and repetitive typing, but it requires data.

How do I enable Do Not Track in Firefox?
This feature is not enabled by default. You can find the Do Not Track request on the Privacy pane. On Windows, go to Tools > Options… > Privacy.
Click to check the box next to “Tell websites I do not want to be tracked”. For more information, see the help file on how to stop websites from tracking you.

and in the last quote there is a link to this page which has this image.

which implies that Do Not Track is all you need to protect your privacy. Mozilla do have a page on how to Enable and Disable cookies but it does a poor job of explaining and does not at all mention the Clear History which I’d say was an important part of your privacy.

Mozilla could do more but they choose not to – and I doubt it’s bedfellow Chrome is much better.

And you worry about the government knowing?

A federal magistrate has awarded Sony a subpoena allowing the company to obtain the IP addresses of everyone who visited the personal website of PlayStation 3 jailbreaker George Hotz for the past 26 months.

Together, the subpoenas allow Sony to obtain a wealth of information about people who aren’t named in the complaint and have been accused of no wrongdoing. That includes the IP address of everyone who has visited www.geohot.com since January 2009 and the account names of anyone who has accessed a private video relating to the jailbreak on Hotz’s YouTube account.

Sony wins subpoenas revealing visitors to PS3 jailbreaker site • The Register.

Don’t you think that’s scary? Look at that 26 months – so you go visit a site and 25 months later someone finds child porn on it. And your IP gets handed over even though when YOU looked at it all was good. Nice.
And the ONLY reason you went to his site was because every damn gaming site linked to it? And now Sony know what you did. And they think you too are hacking cracking and stealing. Now they have this, what next?

I know you read this.

Sometimes something happens which confirms what you thought but had no proof of. On the way back from Sunderland yesterday I told J that a phone call would be received by us, what that phone call would be about and the request that would be made. I had an idea that this blog was being read by or communicated to the person who made the call but I had no proof. The entry I wrote last night followed by the call confirmed in an absolute fashion that this blog is being read. There is now proof.

How I am going to address that is something I have yet to work out.

Cocomment has no privacy – and they know.

I don’t comment anywhere near as much as I’d like to. On blogs though I can usually remember enough to find a blog to follow up and if there is a ‘Subscribe to comments’ I’ll use that or get the comments feed. But I’m starting to comment more on other sites – The Register, Daily Telegraph, Guardian, Times etc and they are horrible to navigate back to. So I again went looking for something that could track comments and landed back at Cocomment. I’ve used it before when it launched and I forgot why I stopped but I signed up for it again.

At work we – unsurprisingly – use blogs to communicate with each other. The blogs are – unsurprisingly – private. So I don’t actually want those urls and my comments appearing anywhere else. It’s private and I would consider some other blogs where I comment to also be ‘off limits’ to tracking what I write on them. So I went to one of the staff blogs and as I’m making a comment I tell the Cocomment extension to blacklist the site. But what I write in the comment I leave appears on the cocomment site. I blacklist another site, make a comment and that comment also appears at their domain.

http://www.cocomment.com/myBlacklist
I want to use coCOmment everywhere except on the following Urls

I have 4 work blogs listed there and every comment I make will appear in the public view of my Cocomment account.

I did test this by logging out of wordpress.com, out of cocomment and using browsers that had logged in to neither – and my comments on a blacklisted site still appeared.

I contacted Cocomment on Twitter: @cocomment – Why have a site blacklist when it does not work? It’s false privacy.
The reply: @69105 I do not fully understand your question. Shoot me an email and lets talk about it.
I sent an email explaining the situation and my expectation that blacklisting should mean no information is revealed. And I just got a reply:

we know the problem with blacklist functionality..
but it’s not the primary issue for us at the moment….
we’re working for new concept and design so may be next year blacklist
processing becomes better..
thanx for your patience..

This makes a nonsense of the twitter reply I got.
It makes a nonsense of the fact they say nothing about their blacklist actually being broken when you try to use it
And that reply means “Hey we are doing fun stuff, screw your privacy needs because we just don’t care”.