Browser Privacy Settings

A cookie is a small name/value the browser stores for a domain, then sends back on later requests to that domain. First-party cookies belong to the site in the address bar. When you log into a shop, that shop sets a session cookie so the next click still knows you. That is often legitimate: a cart, a language preference, a login. Blocking every first-party cookie will log you out of everything. Privacy work is not "delete all cookies forever." A third-party cookie is set by a different domain embedded in the page — an ad iframe, a social Like button, an analytics script. You visit news.example; an iframe from ads.tracker.example sets a cookie for ads.tracker.example. You later visit shop.example, which also embeds ads.tracker.example. The browser sends the same tracker cookie. The tracker now knows those two visits were the same browser. That is cross-site tracking. The news site did not need to sell your name. The shared third party did the joining. Partitioned storage and "block third-party cookies" exist to stop that join, while still allowing the shop you typed to keep its own login cookie.

Browsers have been shutting this down (Intelligent Tracking Prevention, Tracking Prevention, third-party cookie deprecation). The mechanism still matters because (1) not every browser is strict by default, (2) sites still try workarounds, and (3) you can undo the protection with one "Allow all cookies" click. When a site "breaks" after you block third-party cookies, it is often an embedded widget (chat, payment iframe, SSO popup) that expected to share cookies across origins. The right move is to allow that specific site if you trust it — not to flip the global switch back to "track me everywhere" because one checkout failed.

Cookies are one identifier. Scripts are another. A tracker can fingerprint canvas, fonts, timezone, and screen size even when cookies are blocked. Built-in tracking protection (Firefox ETP, Brave shields, Edge, Safari ITP) stops many of those requests before the script runs — the page may look slightly different because the tracker never loaded. This is not antivirus. A blocker does not scan your disk. It reduces untrusted origins executing in the page. Malvertising (hostile ads on otherwise-legit networks) is a real path; fewer third-party scripts means fewer chances. It still does not make a phishing page honest. A clone bank you typed can run first-party scripts with no ad network in sight.

When a site asks for camera, microphone, or location, the browser is offering a hardware or OS capability to that origin. Allow once, and that origin can capture until you revoke it. Allow permanently, and a forgotten tab or a reused origin can listen later. Location is not only GPS: it can be IP geolocation, Wi-Fi positioning, or the precise API. A weather widget does not need continuous precise location. A video call needs camera and mic for that call — not forever, and not for every site that embeds a widget. The mechanism is origin-scoped. https://meet.example and https://ads.example are different origins. A permission granted to one is not automatically the other — unless you click Allow on the wrong prompt, or a look-alike domain asks after a redirect. Review Settings → Privacy → Site settings (Chrome/Edge) or Permissions (Firefox/Safari). Revoke camera/mic/location for sites that are not video calls or maps you actually use. Notifications are a cousin: they are not a sensor, but they are a persistent channel a site can spam or use as a lure. Treat "Allow" as issuing a key. Keys you do not remember still open doors.

HTTP on port 80 sends request lines, cookies, and POST bodies as readable text on the path. HTTPS wraps that HTTP in TLS, usually on port 443. HTTPS-Only (or "Always use secure connections") tells the browser: try HTTPS first; warn or block if a site is only HTTP. That closes a class of mistakes — typing a name and landing on a cleartext login — and it reduces the chance that a captive portal or on-path attacker keeps you on HTTP. HTTPS-Only does not mean the site is honest. A phishing domain can have a valid certificate for its own name. The padlock says "encrypted to this name," not "this is your bank." Certificate warnings (name mismatch, unknown CA, expired) mean the identity check failed. Clicking through on a network you do not control is how an on-path attacker becomes "your bank." In this course you inspect headers with curl -I https://example.com on YOUR machine. You do not capture café HTTP to "show the class cookies." Topic 3 already forbade that; Topic 4 does not reopen it.

Cookies, local storage, and many trackers are scoped to a profile. If banking, social media, and random shopping share one profile, a tracker that survives in one context can still correlate timing and fingerprint with another. A dedicated browser or Chrome/Edge/Firefox profile for banking (no extra extensions, no social logins, bookmarks only to official URLs) keeps that cookie jar away from the everyday jar. Firefox Multi-Account Containers do a similar split inside one window: work, personal, banking as separate cookie boxes. This is isolation, the same idea as not using the same password everywhere. It does not hide you from the bank — you log in; the bank knows you. It reduces the chance that a sketchy extension or a tracker on a news site sits in the same storage as your session cookie. Install extensions only from the official store, check permissions, and keep the banking profile almost empty. Too many extensions increase fingerprint surface and increase the chance one of them is hostile.

This is a configuration lab on a browser you own. You will change three controls, confirm a site you already use still loads, and record what you did. You are not installing random .exe blockers. You are not scanning the LAN. You are not logging into a stranger's machine. If you share a family computer, use your own profile so you do not silently log someone else out.

# Open YOUR main browser. Names vary; hunt Privacy / Cookies / Site settings.

# Chrome / Edge
# Settings → Privacy and security
# 1) Cookies: Block third-party cookies (or "Block third-party cookies in Incognito" is weaker — prefer global block)
# 2) Site settings → Camera / Microphone / Location → review, set Ask or Block except sites you actually use
# 3) Always use secure connections / HTTPS-Only → On

# Firefox
# Settings → Privacy & Security → Enhanced Tracking Protection → Strict
# Permissions: Camera, Microphone, Location → Settings… → remove sites you do not need
# HTTPS-Only Mode → Enable HTTPS-Only Mode in all windows

# Safari (macOS/iOS)
# Settings → Safari → Prevent Cross-Site Tracking
# Camera / Microphone / Location: review per-site
# (HTTPS upgrade is largely built-in; still check the padlock on logins)

# Optional extra: a SECOND profile or browser for banking only
# Chrome: Profile icon → Add → name it Banking → no extra extensions
# Firefox: about:profiles → Create New Profile, or Multi-Account Containers → Banking

# Record what YOU changed (own machine). Do not dump cookies into the file.
mkdir -p "$HOME/cyberlium-lab"
{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "browser:"
  echo "toggle_1_third_party_cookies_or_tracking:"
  echo "toggle_2_camera_mic_location_review:"
  echo "toggle_3_https_only:"
  echo "banking_profile_or_container: yes/no"
  echo "everyday_site_still_loads: yes/no"
} > "$HOME/cyberlium-lab/browser-privacy.txt"
chmod 600 "$HOME/cyberlium-lab/browser-privacy.txt"

# Optional: confirm YOUR client can speak HTTPS (example.com is the documentation name)
curl -I https://example.com

# NEVER: export other people's cookies, capture café Wi-Fi, or "test" a hotspot by sniffing guests
# NEVER: click through a real certificate warning to finish a login
# NEVER: install a blocker from a random download page instead of the official store

You can now explain the join that third-party cookies perform, treat tracker blocking as script control (not antivirus), treat camera/mic/location as issued keys, use HTTPS-Only as a channel upgrade (not a honesty badge), and isolate banking cookies in another profile. Next — VPN — a tunnel that hides your path from the local network and your ISP, and that still does not make you anonymous to the site you log into.