Privacybadger: Blocking cookies/referrer breaks embedded private Vimeo players (restricted to certain websites)

[ndarville]

Privacy Badger makes the video “private”. Whitelisting Vimeo in Privacy Badger fixed the problem.

The edge case here is probably that the video has been set up to only allow embedding on an explicit list of domains, which interferes with Privacy Badger’s protection.

[cooperq]

That makes sense. When a domain gets cookie blocked we strip the referrer header which probably causes vimeo to not display the video if it is set up to only show on certain sites. Unfortunately right now in privacy badger we do not have any default 'white list' only a list of sites to cookie block instead of entirely block. There is a way that sites can get themselves to be unblocked by default though and that is to agree to our DNT privacy policy here: https://www.eff.org/dnt-policy

[ghostwords]

We should be able to fix this by adding a replacement widget for Vimeo players (and removing Vimeo from the yellowlist).

[alexandru]

Dropping a note in support of fixing this — Vimeo is being used a lot for videos behind paywalls, private videos, being in general a cheap hosting solution that isn't YouTube.

I noticed people on forums complaining about videos not working on certain diet-related websites, unaware that it's Privacy Badger that breaks those websites.

And because the videos are kept private, unlisted on Vimeo for Vimeo visitors, there's no way to give them a link to those videos.

[ghostwords]

Stripping the referrer header also breaks some (?) akamaihd.net-powered videos. This came up before as #1969.

For a current example, see https://www.nasa.gov/multimedia/nasatv/#public where nasa-i.akamaihd.net needs to be "green" (not "yellow") for the video to work.

Update: See #2405 for akamaihd breakages.

[bcyphers]

Does anyone have a current example of a site with a Vimeo embed that PB breaks?

[ghostwords]

We have lots from error reports but most of them are for online courses gated by logins. I found three for the Vimeo replacement widget PR, I'm sure there are others there if you go back farther/query smarter.

[bcyphers]

Ah missed those, thanks!
Pasted here for convenience:

• https://www.bringyourownlaptop.com/courses/Animated-Infographic-aVideo-and-Data-Visualisation/animated-infographics-data-visualization-introduction
• https://aeon.co/videos/not-quite-ashore-the-in-between-world-of-a-cargo-ship-rest-stop
• https://www.theyeshivaworld.com/news/israel-news/1648608/shocking-footage-child-falls-out-of-moving-vehicle-in-beitar-walks-away-unharmed.html

[shapiro125]

Because this issue isn't closed yet, I'd rather post here than create a new issue. The new Vimeo replacement widget is breaking autoplay background Vimeo videos for me (Firefox 65/Chrome 72, MacOS 10.14.3, Privacy Badger 2019.1.30).

Two examples:

• https://brand.duke.edu/
• http://knpdesign.co/

Happy to open a new issue if preferred.

[ghostwords]

Yes, could you please open a new issue? Here is one more: https://www.bethelu.edu/

[bcyphers]

This also appears to affect some embedded YouTube players (#2305)

Another broken streaming plugin: vidible.tv https://www.huffingtonpost.com/entry/amy-klobuchar-abuse-staff-2020_us_5c5a1cb1e4b0871047588649?j7 (#1467)

[Anutrix]

vodhls-vh.akamaihd.net is blocked at Gaana Music Streaming Site which prevents songs from playing/streaming.
Making slider green fixes the issue almost instantly.
Issue seems similar because akamahd.net was mentioned her before. Hence didn't make a new issue.

[ghostwords]

Hi @Anutrix, would you mind opening a new issue? These issues are related but are not the same.

[Anutrix]

@ghostwords Created new issue #2405

[ghostwords]

Restored Vimeo to the yellowlist (3e5833485529591bc20838393bead0f74b5e72df) for now.