Firefox 'Cookies' change in CCleaner v5.83

[nukecad]

CCleaner v5.83 'Custom Clean' is reporting something different than previous versions when cleaning Cookies for Firefox.
This is because of the new way that Firefox now handles cookies.

A few users have already noticed this change and asked about it.

Firefox cookies are still being cleaned by CCleaner v5.83, it's just being reported differently by Custom Clean.

Here's an analysis done with CCleaner v5.82, you can see that for Firefox it's finding:- Internet Cache, Cookies, and Session.

Here is the same done straight afterwards with CCleaner v5.83 this time it's finding:- Internet Cache, and Session, but now finding 1 file in 'Site Preferences' instead of 9 'Cookies'.
(Registry Cleaner and Drive Wiper have also swapped places, but that's not relevent to Firefox).

 

As said above Firefox has been changing the way it handles cookies, and it now stores each one relative to the website that it came from.
It does this using what it calls 'Partition Keys'.

The 9 cookies found by CCleaner v5.82 are now actually being stored in one file in the Site Preferences, and so CCleaner v5.83 is simply reflecting that change and lists them as that one 'Site Preferences' file where they are now kept.

If you look at the file  found under 'Site Preferences' for the analysis above it does indeed contain references to 9 Partion Keys which is the new way that Firefox handles cookies.

To check it even further I let CCleaner v5.83 delete the Firefox 'Site Preference', and then ran a new analysis with CCleaner v5.82.
NO Firefox cookies were found, showing that they had been removed CCleaner v 5.83 deleting the 'Site Preference' file.

CCleaner v5.83 is still deleting Firefox cookies - it's just listing that cleaning differently, because Firefox has changed how/where it stores cookies.

PS. You may also notice that the partitioned Firefox cookies are no longer listed as 'Cookies on computer' in Options>Cookies, that's because they are now in Firefox's 'Cookie Jars' referenced by that 'Site Preference' file.

PPS. If you want to know more about how and why Firefox has changed the way it handles cookies:
https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/

ADDITIONAL INFORMATION:
I have noticed that there is still an occasional cookie found by CCleaner v5.83 in 'Firefox - Cookies'.
This appears to be a cookie from Firefox itself, which would explain why it's not tied to a specific website like the others.

 

 

 

[nikki605]

Should I now check the Firefox Site Preferences option in addition to checking Cookies?

[nukecad]

On 28/07/2021 at 17:39, nikki605 said:

Should I now check the Firefox Site Preferences option in addition to checking Cookies?

Good question.

The concern there being that if you do that Custom Clean would clear other site preferences that you may wish to keep.
(I always cleared them anyway, but others may not want to).

TBH I don't think that you need to (unless you want to of course).
The new way that Firefox handles cookies means that they are website specific so not the same security risk as old style cookie storage was. (Still is for other browsers)
ie. Even if you don't clear the Firefox cookies nothing but the website that they came from can use them anyway.
Which is why they are now in that site preferences file.

EDIT see the posts below: https://community.ccleaner.com/topic/60863-firefox-cookies-change-in-ccleaner-v583/?tab=comments#comment-330684

 

[Andavari]

For years having Site Preferences ticked in CCleaner would delete too much in Firefox, thus breaking something. I only used it once years ago, and immediately found myself having to restore my Firefox Portable profile from the regular backup I make.

[nikki605]

That's the kind of issue I was wondering about.  I think I'll leave it unchecked for now until I better understand what gets cleaned.

[Rostia CCleaner]

Hello everyone,

 

I'd like to clarify some details of this change. TLDR: What changed in 5.83 is how CCleaner treats HSTS flags.

 

HSTS (HTTP Strict Transport Security) is a mechanism how a website informs the browser that it can only be accessed via secured HTTPS. The purpose of this mechanism is to improve security by preventing various man-in-the-middle attacks. A nice explanation of why and how is in Firefox webdev documentation. Unfortunately, HSTS has been abused for cross-site tracking, so this security feature became a privacy issue. If you are interested in details, you can read for example this article. The idea is quite interesting, one must really admire ingenuity of these people. :)

 

Firefox stores a list of these websites (i.e. sites to be contacted via HTTPS) in the SiteSecurityServiceState.txt file. Before 5.83, CCleaner treated items in this list as cookies, so if you cleaned cookies, you cleaned this list too. Some time ago, Firefox started to partition HSTS flags by appending partition keys to the websites (these are the "cookie jars" if I may borrow @nukecad's term). This is the reason why weirdly looking cookies started appearing in CCleaner. Thanks to this change however, HSTS has become much less of a privacy issue, so we moved it away from the "Cookies" category to "Site settings" category. This is by the way the same way how Firefox treats HSTS flags.

 

So Firefox cookies (the traditional HTTP cookies) are still cookies and nothing has changed for them. It's only HSTS flags which are no longer cookies and have become site preferences.

[nukecad]

Thanks for that insight Rostia,

If I might just add one more article from Webkit.org which may help users further understand these changes: Intelligent Tracking Prevention 1.1
In particular this:

Quote

Partitioned Cookies No Longer Persisted to Disk
With ITP 1.1, all partitioned cookies are treated as session cookies and are not persisted to disk.

So as it says the 'new style' partitioned cookies are not written to your disk so don't need to be cleaned from it.
And they no longer show up in Options>Cookies as 'Cookies on Computer', because they are not on your computer.

EDIT- Sorry it appears that Firefox partitioned cookies are still on disk but in a different place, see below.

[nukecad]

So distilling from the above 2 posts and going back to the question from @nikki605

Quote

Should I now check the Firefox Site Preferences option in addition to checking Cookies?

You don't need to clear the Firefox Site Preferences, unless you want to.

[Rostia CCleaner]

6 hours ago, nukecad said:

Quote

Partitioned Cookies No Longer Persisted to Disk
With ITP 1.1, all partitioned cookies are treated as session cookies and are not persisted to disk.

So as it says the 'new style' partitioned cookies are not written to your disk so don't need to be cleaned from it.
And they no longer show up in Options>Cookies as 'Cookies on Computer', because they are not on your computer.

This is what WebKit does, I'm not sure if Firefox does the same...

[nukecad]

44 minutes ago, Rostia CCleaner said:

This is what WebKit does, I'm not sure if Firefox does the same...

I believe that you are correct, like I say I'm still looking into it.
(Plus I had Firefox on this machine set to clear cookies on closing, which wasn't helpful when looking at/for cookies).

Checking the files where I know Firefox used to store cookies on disk both 'Cookies.squlite' and 'webappsstore.sqlite' appear to be empty (apart from a header) after I've been using Firefox.
There were also cookies in '..\AppData\Local\Mozilla\Firefox\Profiles\..\OfflineCache\index.sqlite', but the directory 'Offlinecache' is no longer there.

However there does now seem to be partitioned cookies stored in '..\AppData\Roaming\Mozilla\Firefox\Profiles\..\storage\default\https+++{various}\...'

Guess I need to look into it more. (If only for my own Firefox batchfile).