1526812 - ikea.com content not displayed with tracking protection / fingerprinting blocking

Status: RESOLVED FIXED

(Firefox :: Protections UI, defect, P2)

Description

[Adam Stevenson [:adamopenweb]]

Attachment: Ikea screenshot

STR:

1. Enable tracking protection basic or strict
2. Navigate to ikea.com
3. Select language if required
4. Notice the main section of content is not displayed

Tested on Firefox 65-67 with MacOS. Happening on Canadian and US version of the site.

https://www.ikea.com/us/en/ and https://www.ikea.com/ca/en/

Comment 1

[(no longer active)]

This happens because we block tags.tiqcdn.com (fingerprinting domain): https://github.com/mozilla-services/shavar-prod-lists/blob/2610c48fa62837569d8270bef5367102f9b8fe70/disconnect-blacklist.json#L5987

Steven, do we have a fingerprinting breakage tracking bug?

Comment 2

[Steven Englehardt [:englehardt]]

Ehsan: I just filed https://bugzilla.mozilla.org/show_bug.cgi?id=1527013 for that.

One thing to note about this domain: it's a tag management script, meaning that the contents will vary depending on what first parties choose to include in the script.

Comment 3

[Steven Englehardt [:englehardt]]

This is not strictly breakage related to fingerprinting. tiqcdn.com is also on the basic Disconnect list, so it will be blocked by normal tracking protection regardless.

Regarding the fingerprinting classification: Ikea's version of the script (https://tags.tiqcdn.com/utag/ikea/global-splash-page/prod/utag.js) does not appear to contain any fingerprinting code. The tiqcdn.com hostname was likely classified as fingerprinting due to the inclusion of fingerprinting code on another first party. We should see if Disconnect is willing to include full paths for tag management scripts to avoid problems like this in the future.

Comment 4

[(no longer active)]

From pdol:

Found some breakage with fingerprinter blocking. https://www.amextravelinsurance.rsagroup.ca/j_travel3/app/quote/#/home?lang=en&product=AMEX&promosource=AMEXENWEB. Tried to fill out form and submit, and nothing happens unless I disable fingerprinter blocking

Comment 5

[Peter Dolanjski [:pdol]]

Another example: Search button on https://www.zdnet.com/ doesn't work with the same fingerprinting domain as above.

Comment 6

[Steven Englehardt [:englehardt]]

The was fixed in https://github.com/mozilla-services/shavar-prod-lists/pull/56, which has now been merged and deployed as detailed in Bug 1534453.