Remove __cfduid exemption

[april]

Eventually CloudFlare will fix the __cfduid cookie. When that happens, we should fix the exemption for it.

[ninjas28]

While I'm glad we no longer get penalized for Cloudflare's issues, I feel that there should be a clear notice about this exemption in the test scores section (perhaps in the cookies information panel that is activated when you hover over the info icon) letting the user know about this.

[april]

I'm hoping to build in a suggestions section in the next quarter or two; I think that would be a great place for it. :)

[vincentbernat]

The comment in #201 says this cookie is bad but it gets an exemption because there is not much to do. It is a odd reasoning. If a small CDN or a hosting provider put such a cookie, would it get an exemption? How would CloudFlare be incited to fix this problem if they can just do nothing and get an exemption?

In other words, CloudFlare seems to get this exemption because they are big. Indirectly, this makes Mozilla promote a centralized web.

[floatingatoll]

It seems less likely we have sold out our core interests than simply seen a lot of reports with it. The original "misspelling" of the Referer header wasn't a conspiracy, and it's still the sub-optimal spelling we're cursed to endure. There's no need to attribute malice towards the mission. We all find this just as unpalatable a band-aid. But if no material harm to web security exists by squashing it temporarily in the open (with an issue to remove it pre-filed!), then perhaps it's less about "promote a centralized web" and more about "it'll be fixed eventually". Grading caps and CSP parsing improvements and referrer policy are all valuable. Moreso, for me; but I see a lot of Cloudflare sites, and think about this issue sometimes, too.

…

On Fri, Feb 10, 2017 at 22:37 Vincent Bernat ***@***.***> wrote: The comment in #201 <#201> says this cookie is bad but it gets an exemption because there is not much to do. It is a odd reasoning. If a small CDN or a hosting provider put such a cookie, would it get an exemption? How would CloudFlare be incited to fix this problem if they can just do nothing and get an exemption? In other words, CloudFlare seems to get this exemption because they are big. Indirectly, this makes Mozilla promote a centralized web. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#202 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAFqDOaKB3LnSDRmnPJZHkS0v1bu1Pv3ks5rbVcpgaJpZM4LXzU2> .

[april]

The reason why it's here is that a) CloudFlare knows about it, b) it's super confusing, as most site owners don't know it even exists, and c) there's nothing they can do about it, short of using somebody besides CloudFlare.

In the meantime, this bug stands as a statement about their bad practices vis-a-vis tracking cookies.

[keks]

@april in #121 you said

I have been talking about this with CloudFlare and trying to find ways to improve it.

That was nearly two years ago. Did the discussions go anywhere?

@floatingatoll The fact that the header is called Referer and not Referrer is a strawman argument and has nothing to do with tracking cookies. The header can have any name, as long as we all agree on it. Tracking cookies track the users and thus are a threat to the user's privacy. Whether that is a security issue depends on your threat model, but I think this should be up to the users to decide.

Anyway, since Cloudflare doesn't seem to have acted on this in the past two years, I propose announcing that the exemption will be removed in, say, six months. If they fix it until then, good for them, and if they don't, though luck. Currently there are zero incentives for them to tackle this.
And, while the affected websites are the ones who suffer from this issue but not really the ones to blame, I guess the only advice I can give them is to switch providers to someone who does respect their users' privacy.

[rspilker]

I understand the reasoning of Cloudflare.

However, I think they could have easily done a better job. They could have served two different cookies, depending the HTTP or HTTPS-ness.

That would mean that if you have HTST, in practice the HTTP cookie will never be used, and the HTTPS cookie can have the Secure flag turned on.

If you agree, maybe you can convince them that this is a good idea, and it allows you to remove the exemption. All cookies served over HTTPS will have the Secure flag set.

You shouldn't've had an exemption in the first place.