1

In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off?

Or, more specifically, I'm wondering: Why is Facebook data reappearing in Safari (14.1.2) without me visiting or having any Facebook web pages open? Is this a bug?

Or, is Facebook data reappearing in Safari (14.1.2) without me visiting or having any Facebook web pages open a bug?

Scenario:

After closing all Facebook property tabs, (but leaving many other tabs open) and going under [Privacy] into [Manage Website Data] (and clearing so there's nothing Facebook.com, instagram.com, WhatsApp.com, fbcdn.com etc. I went back in about a minute later and

  1. I'm seeing fbcdn.com has (√) Cache again.
  2. I'm seeing Facebook.com has Cache, Cookies, Local Storage, and HSTS Policy again[2].
  3. I'm seeing oversightboard.com has Local Storage again.

I'm wondering what to make of this Facebook data reappearing.

Shouldn't having "Prevent cross-site tracking" ON make this not happen without me visiting or having any Facebook web pages open?

(I notice that just loading Facebook.com - while logged out - results in Cache, Cookies, Local Storage, and HSTS Policy.)

[2]: This morning, I'm seeing Facebook.com has all four - Cache, Cookies, Local Storage, and HSTS Policy again. Though I've visited no Facebook properties. (At first I was going by my recollection that I (IIRC) saw Cache, Cookies, and HSTS Policy again.)

Improve this question
4
  • Are you using Private Browsing? If so, I'm not sure that ITP is used. Simply use a new private tab for each new site. It's an arms race. Apple will continue to try to protect user privacy without sacrificing too much security or convenience. You can bet that Facebook will push the boundaries of what's possible in order to track. ITP alone isn't enough, blocking is the only way to be certain.
    – pseudon
    Sep 18, 2021 at 5:23
  • 2
    Check out webkit.org/tracking-prevention ...various defenses have different time intervals. Also check out the challenges of defense against HSTS tracking webkit.org/blog/8146/protecting-against-hsts-abuse
    – pseudon
    Sep 18, 2021 at 5:40
  • Thanks. The former says, "The default cookie policy for WebKit on Apple’s iOS, macOS, ... is to disallow a third-party to set new cookies unless it already has cookies. This means that to be able to use cookies at all as third-party, the domain first has to become first-party and set its initial cookie(s) there. This default cookie policy has been in effect since Safari 1.0 and is still in effect today as part of the “Prevent cross-site tracking” setting." 1/2
    – WHO'sNoToOldRx4Covid-CENSORED
    Sep 19, 2021 at 6:54
  • So, since Facebook.com cookies keep getting set, while I don't have any open Facebook tabs, and XST is on, I say Safari must be broken. Except that the language is unclear, for example, "Home Screen Web Application" isn't defined. I think I know what this is on iOS. But on macOS??? Apple doesn't tell us. ZERO google hits on: "Home Screen Web Application" site:apple.com
    – WHO'sNoToOldRx4Covid-CENSORED
    Sep 19, 2021 at 7:08

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .