iOS 12.2 and Safari 12.1 for macOS Include Updated Intelligent Tracking Prevention Feature

safari iconSafari in the iOS 12.2 beta and Safari 12.1 for macOS High Sierra and Mojave includes an updated version of Intelligent Tracking Prevention, according to details shared on Apple's WebKit blog.

ITP 2.1, as Apple is calling it, caps client-side cookie storage to seven days. After this time period, cookies expire. As outlined by Apple, this offers improvements in privacy, security, and performance. From Apple's WebKit blog:

- Cross-site trackers have started using first-party sites' own cookie jars for the purpose of persistent tracking. The first-party storage space is especially troublesome for privacy since all tracker scripts in the first-party context can read and write each other's data. Say social.example writes a user tracking ID as a news.example first-party cookie. Now analytics.example, adnetwork.example, and video.example can leverage or cross pollinate that user tracking ID through their scripts on news.example.

- Cookies available in document.cookie can be stolen by speculative execution attacks on memory. Therefore, they should not carry sensitive information such as credentials.

- Cookies available in document.cookie can be stolen by cross-site scripting attacks. Again, therefore, they should not carry sensitive information such as credentials.

- The proliferation of cookies slows down page and resource loads since cookies are added to every applicable HTTP request. Additionally, many cookies have high entropy values which means they cannot be compressed efficiently. We come across sites with kilobytes of cookies sent in every resource request.

- There is a size limit on outgoing cookie headers for performance reasons, and websites risk hitting this limit when cross-site trackers add first-party cookies. We've investigated reports of news site subscribers getting spuriously logged out, and found that trackers were adding so many cookies that the news site's legitimate login cookie got pushed out.

The cookie storage limits will not log users out as long as websites are using the appropriate authentication cookies because it only affects cookies created through document.cookie.

ITP 2.1 also allows for just a single set of cookies per site rather than multiples, and third party tools with cross-site tracking capabilities need to use the Storage Access API to get cookie access.

Apple says this change simplifies cookie behavior for developers, lowers the memory footprint of Safari, and makes Intelligent Tracking Prevention compatible with more platforms.

A verified partitioned cache for cutting down on cache abuse for tracking purposes is also included, and as we covered earlier this month, support for Do Not Track has been disabled.

Apple says that it is removing Do Not Track because most websites never paid any attention to it since it was opt-in and could be ignored.

The DNT project recently ended without the publication of a standard, in part "because there has not been sufficient deployment of these extensions (as defined) to justify further advancement." Given the lack of deployment of DNT and Safari's on by default privacy protections such as ITP, Safari removed support for DNT so that users are not presented with a misleading and ineffective privacy control that, if anything, only offered additional browser fingerprinting entropy.

Additional details on the Intelligent Tracking Prevention updates being introduced are available via Apple's full WebKit blog post.

Tag: Safari

Popular Stories

Apple Vision Pro 2 Feature 2

Apple Reportedly Suspends Work on Vision Pro 2

Tuesday June 18, 2024 8:17 am PDT by
Apple has suspended work on the second-generation Vision Pro headset to singularly focus on a cheaper model, The Information reports. Apple was widely believed to have plans to divide its Vision product line into two models, with one "Pro" model and one lower-cost standard model. The company is said to have been deprioritizing the next Vision Pro headset over the past year, gradually...
Apple WWDC24 Apple Intelligence hero 240610

Apple Explains iPhone 15 Pro Requirement for Apple Intelligence

Wednesday June 19, 2024 4:48 am PDT by
With iOS 18, iPadOS 18, and macOS Sequoia, Apple is introducing a new personalized AI experience called Apple Intelligence that uses on-device, generative large-language models to enhance the user experience across iPhone, iPad, and Mac. These new AI features require Apple's latest iPhone 15 Pro and iPhone 15 Pro Max models to work, while only Macs and iPads with M1 or later chips will...
M4 Real Feature Red

M4 MacBook Pro Models Expected to Launch in Late 2024

Tuesday June 18, 2024 10:50 am PDT by
MacBook Pro models with an M4 chip are expected to launch in the fourth quarter of 2024, according to display analyst Ross Young. In a tweet for subscribers, Young said that panel shipments for new 14-inch and 16-inch MacBook Pro models are set to begin in the third quarter of 2024, which suggests a launch toward the end of the year. Apple started its M4 chip refresh in May with the launch...
2022 back to school apple feature

Apple's 2024 Back to School Sale Launching This Week

Monday June 17, 2024 12:27 pm PDT by
Apple will launch its annual Back to School promotion for university students in the United States and Canada this week, according to Bloomberg's Mark Gurman. Apple's back to school sales provide students with a free Apple gift card when purchasing a Mac or an iPad, and this year's promotion could help Apple push the new M2 iPad Air and M4 iPad Pro models. Last year, Apple offered U.S....
iOS 18 Calendar Feature

iOS 18: Calendar App Design Changes and Reminders Integration

Tuesday June 18, 2024 6:16 am PDT by
Apple in iOS 18 has given the Calendar app a major update, adding some welcome interface design changes, not to mention long-awaited integration with Reminders. In the month-by-month calendar view, the month now appears in large bold font in the top left, while the Events list toggle has been replaced by a new button that lets you choose between Compact, Stacked, Details, and List views. ...
watchOS 11 Thumb 2 1

watchOS 11 Supports Automatic Nap Detection

Monday June 17, 2024 4:05 pm PDT by
watchOS 11 appears to include a new feature that allows an Apple Watch to automatically detect and record when you're taking a nap. As shared on Reddit, an Apple Watch owner took a nap and was able to see the sleep data recorded in the Health app, despite not putting the device in Sleep Mode. Right now, the Apple Watch only tracks and records sleep when it is in Sleep Mode, and there is no...

Top Rated Comments

AngerDanger Avatar
70 months ago
Eh, I never liked that tracking prevention stuff. Just be smart, and advertisers won't learn a thing about you.



Attachment Image
Score: 39 Votes (Like | Disagree)
IRockThat828pScreen Avatar
70 months ago
Can you elaborate? Your screenshot doesn't seem to illustrate much other than you being interested in Singles sites.

Some ideas for people:
[LIST=1]
* Use Private Browsing for sites you don't want tracking you. This loads the site into a blank slate, with no existing cookies in place.
* Use /etc/hosts to block common ad-serving hosts. These load from 127.0.0.1 (localhost) and the requests will never leave your computer.

wooosh
Score: 16 Votes (Like | Disagree)
techguy9 Avatar
70 months ago
Can you elaborate? Your screenshot doesn't seem to illustrate much other than you being interested in Singles sites.

Some ideas for people:
[LIST=1]
* Use Private Browsing for sites you don't want tracking you. This loads the site into a blank slate, with no existing cookies in place.
* Use /etc/hosts to block common ad-serving hosts. These load from 127.0.0.1 (localhost) and the requests will never leave your computer.

It’s a joke comment.
Score: 10 Votes (Like | Disagree)
keysofanxiety Avatar
70 months ago
Eh, I never liked that tracking prevention stuff. Just be smart, and advertisers won't be able to learn a thing about you.

This made my evening. Thank you.

Can you elaborate? Your screenshot doesn't seem to illustrate much other than you being interested in Singles sites.

Some ideas for people:
[LIST=1]
* Use Private Browsing for sites you don't want tracking you. This loads the site into a blank slate, with no existing cookies in place.
* Use /etc/hosts to block common ad-serving hosts. These load from 127.0.0.1 (localhost) and the requests will never leave your computer.

I know of two things that can break the speed of sound: the Concorde, and that joke flying over your head.
Score: 9 Votes (Like | Disagree)
swanseaboy Avatar
70 months ago
If only we could have a functional cookie manager...
Score: 7 Votes (Like | Disagree)
smithrh Avatar
70 months ago
I completely wipe cookies every time I think of it - say, every 1-3 days.

It's never been a negative.

Cookies aren't for users, they're for advertisers and people who want to track you.

Passwords aren't an issue with password fill.
Score: 5 Votes (Like | Disagree)