In Outlook Live browser cookie issues, I discussed the issues surrounding cookie usage and the Outlook Live service. As you may remember, one of the problems surrounding turning off the blind support of third-party cookies is the check that is performed at logout. If the check doesn’t pass then you will get a warning message.
The fix for this from the MS perspective is to enable third-party cookies. One of the main reasons to not follow this is for better privacy while browsing the Internet. As with most computer security, web browser security is often a trade-off between usability and security. You have to know what to set things to to achieve a balance between good security and acceptable annoyance. Many users install ad-blockers, flash blockers, disable Javascript, etc. These are good tactics, but they also introduce browsing annoyances since the very technologies these plug-ins disable are what makes the web experience interesting and fun. For more on browser security check out Securing Your Web Browser at CERT.
Fortunately, in this particular case the solution is relatively easy. Since Mozilla gives us the ability to configure the browser directly, we can change how Firefox handles cookies.
First you will need to open Firefox and go to the site about:config to edit the settings. This is not really a website, but a method provided to directly configure some browser settings. You will be presented with a warning box, just click the button.
Next, in the filter box type network.cookie, this will narrow the list displayed down to only the ones dealing with cookies. One of the settings to be changed already exists, the other will have to be added.
The setting that you want to change is:
- network.cookie.cookieBehavior
Change network.cookie.cookieBehavior to have a setting of 3, enabling the change, by double clicking on the number in the Value column and entering the new value in the dialog box.
To add the new preference, right click in the window and select Integer from the New submenu.
Enter network.cookie.p3plevel in the dialog box that appears. Set the value to be 3 in the second dialog box. There is no save function, the changes take effect immediately, just close you browser tab/window.
After making these changes you will now be able to successfully navigate the Outlook Live site and logout without getting the warning message. You will also be better protected from nefarious third-party cookies.
If you want to change the preferences back to the defaults, simply open the preferences for Firefox and click the checkbox next to Accept third-party cookies.
Apparently this functionality was part of Firefox 2 but was subsequently removed after someone complained about the size of the code required to implement it (a total of 60k in what is now a 56.9MB, at least that’s the size of the application on Mac OS X). In reading through the comments in the Bugzilla post, I fail to see where anyone makes a decent argument for reducing end-user security. For more on all of this, check out the references section of this post.
These changes were implemented on Mac OS X 10.6.4 using Firefox 3.6.11, but it should be pertinent to Windows and Linux as well.
References