5 ms·

In Chrome: Settings > Privacy > Content Settings > Tick 'Block third-party cookies and site data' Also set 'Send a "Do Not Track" request with your browsing tr

In Chrome: Settings > Privacy > Content Settings > Tick 'Block third-party cookies and site data' Also set 'Send a "Do Not Track" request with your browsing traffic' And install uBlock Origin, ofc.

JasonSage 10y ago
At a minimum, though, please block third-party cookies and site data. I have pretty minimal customizations and plugins on browsers—very few plugins, no ad-blocking, no security or privacy enhancements. I've had third-party cookies blocked for a long time now and there aren't any sites or logins that break down with them disabled (that I've encountered). On the plus side, though, you don't have to worry about this crap. I'm logged into several of these sites and none of them show as leaked.
zerognowl 10y ago
Keep in mind, uBlock Origin does not block social media widgets by default, and you have to enable it in settings. Widgets like Facebook like buttons, and Tweet buttons have to be blocked manually.
Retr0spectrum 10y ago
Personally, I don't set the DNT header. You have no way of knowing if any sites are actually going to comply, and it actually provides an extra datapoint to fingerprint you with.
- sp332 10y ago
  But isn't it better to at least ask instead of not asking at all?
  - Retr0spectrum 10y ago
    As I said, simply asking for it will actually reduce your privacy for any service that doesn't comply, by making you more fingerprintable.
    - sp332 10y ago
      But there is some pressure on companies to comply. Plus they can't use the defense that you could have enabled it and chose not to.
  - posterboy 10y ago
    Its pretty obvious the default should be the opposite to avoid a race condition like that.
    - Retr0spectrum 10y ago
      Are you suggesting a "please track me" header? Nobody would ever use it...
    - admax88q 10y ago
      It was proposed that DNT be the default, but then ad companies said if that were the case, then they would just ignore the header. They want users to explicitly opt out of tracking otherwise they will assume they agree to being tracked.
- diegorbaquero 10y ago
  There are 100s of ways to fingerprint the browser and more exactly. I think is better to set it for the few that comply.
  - Retr0spectrum 10y ago
    That's true, but they usually require running javascript etc. Looking at the request headers is the simplest way of fingerprinting.
driverdan 10y ago
3rd party cookies should be disabled by default in all browsers. It significantly improves your privacy with minimal impact. After many years of blocking 3rd party cookies the only thing that's broken for me is my bank's bill pay system, which is an iframe of a 3rd party service.
- esaym 10y ago
  heh, same here. I can't use my banks ebilling website.
  - Tepix 10y ago
    Try opening the iframe directly. Also, complain to your bank.
    - zymhan 10y ago
      Or just whitelist that one.
- matejn 10y ago
  I whitelisted bandcamp because some bands use custom domains.
JTon 10y ago
Very nice. Here's how to do it on Firefox [1] [1] https://support.mozilla.org/en-US/kb/disable-third-party-cookies https://support.mozilla.org/en-US/kb/disable-third-party-coo...
city41 10y ago
How many people browsing the web would know to do this? Would even 0.5% of users know?
- nateberkopec 10y ago
  I didn't know about either of these things and I consider myself fairly security savvy (for a programmer). uBlock Origin looks way better than Ghostery, which I was using until now.
pwenzel 10y ago
As somebody who tried to build code respecting "Do Not Track" preferences, I have to say that feature, while well-intended, is a complete farce. Chrome, Safari, Firefox, IE9, IE10, and IE11 all use different APIs for Do Not Track [1], so a front-end developer has to do a lot of extra leg work to check if the user has the preference set. I find it highly unlikely that most companies would go through the effort of respecting Do Not Track. [1] https://developer.mozilla.org/en-US/docs/Web/API/Navigator/doNotTrack https://developer.mozilla.org/en-US/docs/Web/API/Navigator/d...
- cpeterso 10y ago
  Wow. I am surprised at how many different ways Firefox, Safari, and IE9/10/11 implement an API as simple as navigator.doNotTrack.
  - amelius 10y ago
    This almost seems like a case of defective by design.
- minitech 10y ago
  The main behaviour is to add the DNT: 1 HTTP header. The JavaScript APIs are just a bonus to perhaps avoid sending unnecessary information. (But yes, it’s still a silly feature, because having to go out of your way at all to respect DNT isn’t really worth it.)
redwards510 10y ago
Checking the box to block 3rd party cookies is great advice, but I would not tell my Mom or any other casual user to do it. Why? You wind up with a lot of very weird, hard-to-track down bugs in web pages. I've seen failures in OAUTH and SSO pages, buttons that don't click, etc. Things you might not expect to break, break. And it's hard to track it back to that checkbox.
ufmace 10y ago
I suppose the "block third-party cookies and site data" must be why this is mostly broken at home (doesn't show logins to 5-6 sites that I'm logged in to), but works properly at work (didn't bother to set that option there). Never toyed with exactly what the "site data" part means, though.

In Chrome: Settings > Privacy > Content Settings > Tick 'Block third-party cookies and site data' Also set 'Send a "Do Not Track" request with your browsing traffic' And install uBlock Origin, ofc.

JasonSage 10y ago

At a minimum, though, please block third-party cookies and site data. I have pretty minimal customizations and plugins on browsers—very few plugins, no ad-blocking, no security or privacy enhancements. I've had third-party cookies blocked for a long time now and there aren't any sites or logins that break down with them disabled (that I've encountered). On the plus side, though, you don't have to worry about this crap. I'm logged into several of these sites and none of them show as leaked.

zerognowl 10y ago

Keep in mind, uBlock Origin does not block social media widgets by default, and you have to enable it in settings. Widgets like Facebook like buttons, and Tweet buttons have to be blocked manually.

Retr0spectrum 10y ago

Personally, I don't set the DNT header. You have no way of knowing if any sites are actually going to comply, and it actually provides an extra datapoint to fingerprint you with.

sp332 10y ago
But isn't it better to at least ask instead of not asking at all?
- Retr0spectrum 10y ago
  As I said, simply asking for it will actually reduce your privacy for any service that doesn't comply, by making you more fingerprintable.
  - sp332 10y ago
    But there is some pressure on companies to comply. Plus they can't use the defense that you could have enabled it and chose not to.
- posterboy 10y ago
  Its pretty obvious the default should be the opposite to avoid a race condition like that.
  - Retr0spectrum 10y ago
    Are you suggesting a "please track me" header? Nobody would ever use it...
  - admax88q 10y ago
    It was proposed that DNT be the default, but then ad companies said if that were the case, then they would just ignore the header. They want users to explicitly opt out of tracking otherwise they will assume they agree to being tracked.
diegorbaquero 10y ago
There are 100s of ways to fingerprint the browser and more exactly. I think is better to set it for the few that comply.
- Retr0spectrum 10y ago
  That's true, but they usually require running javascript etc. Looking at the request headers is the simplest way of fingerprinting.

driverdan 10y ago

3rd party cookies should be disabled by default in all browsers. It significantly improves your privacy with minimal impact. After many years of blocking 3rd party cookies the only thing that's broken for me is my bank's bill pay system, which is an iframe of a 3rd party service.

esaym 10y ago
heh, same here. I can't use my banks ebilling website.
- Tepix 10y ago
  Try opening the iframe directly. Also, complain to your bank.
  - zymhan 10y ago
    Or just whitelist that one.
matejn 10y ago
I whitelisted bandcamp because some bands use custom domains.

JTon 10y ago

Very nice. Here's how to do it on Firefox [1] [1] https://support.mozilla.org/en-US/kb/disable-third-party-cookies https://support.mozilla.org/en-US/kb/disable-third-party-coo...

city41 10y ago

How many people browsing the web would know to do this? Would even 0.5% of users know?

nateberkopec 10y ago
I didn't know about either of these things and I consider myself fairly security savvy (for a programmer). uBlock Origin looks way better than Ghostery, which I was using until now.

pwenzel 10y ago

As somebody who tried to build code respecting "Do Not Track" preferences, I have to say that feature, while well-intended, is a complete farce. Chrome, Safari, Firefox, IE9, IE10, and IE11 all use different APIs for Do Not Track [1], so a front-end developer has to do a lot of extra leg work to check if the user has the preference set. I find it highly unlikely that most companies would go through the effort of respecting Do Not Track. [1] https://developer.mozilla.org/en-US/docs/Web/API/Navigator/doNotTrack https://developer.mozilla.org/en-US/docs/Web/API/Navigator/d...

cpeterso 10y ago
Wow. I am surprised at how many different ways Firefox, Safari, and IE9/10/11 implement an API as simple as navigator.doNotTrack.
- amelius 10y ago
  This almost seems like a case of defective by design.
minitech 10y ago
The main behaviour is to add the DNT: 1 HTTP header. The JavaScript APIs are just a bonus to perhaps avoid sending unnecessary information. (But yes, it’s still a silly feature, because having to go out of your way at all to respect DNT isn’t really worth it.)

redwards510 10y ago

Checking the box to block 3rd party cookies is great advice, but I would not tell my Mom or any other casual user to do it. Why? You wind up with a lot of very weird, hard-to-track down bugs in web pages. I've seen failures in OAUTH and SSO pages, buttons that don't click, etc. Things you might not expect to break, break. And it's hard to track it back to that checkbox.

ufmace 10y ago

I suppose the "block third-party cookies and site data" must be why this is mostly broken at home (doesn't show logins to 5-6 sites that I'm logged in to), but works properly at work (didn't bother to set that option there). Never toyed with exactly what the "site data" part means, though.