5 ms·

Web Browsers Reject About Two-Thirds of Cookies

19 points by cpeterso 9y ago

pmoriarty 9y ago
I like a Firefox extension called "Self-Destructing Cookies".[1] It will accept cookies, but then delete them when you close the tab. Unfortunately, it (like many other useful extensions) was permanently broken by recent changes to Firefox. I wonder if there are any good alternatives. [1] - https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/en-US/firefox/addon/self-destruct...
- zeta0134 9y ago
  You can get close with a built in browser setting. Firefox can erase all cookies as soon as you close the browser: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences https://support.mozilla.org/en-US/kb/enable-and-disable-cook... You can also open up a Private Browsing tab if you want to visit a site you don't trust, or simply maintain a separate environment from your main stuff. Private windows have their own cookie store separate from the main store, and also clear their history upon close.
  - hansen 9y ago
    > You can get close with a built in browser setting. And you can still keep cookies from specific sites by defining an exception. They should better document this feature. For me it would be a good default behavior. There aren’t that many sites where I want to stay logged in.
- AdmiralAsshat 9y ago
  Cookie AutoDelete was explicitly written to be an E10-compatible alternative to SDC: https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
- blakesterz 9y ago
  This post has a bunch of good replacements: https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxQuantumAddons https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxQuantumA... "Cookie AutoDelete is my current replacement for Self-Destructing Cookies (which I adopted in my primary Firefox due to switching to uMatrix). I enable autocleaning, turn off showing the number of cookies for the domain and notification, and turn on cleaning Localstorage."
- z_open 9y ago
  Try ``Cookie AutoDelete''. It's very user friendly with whitelists, blacklists, and such.
- vmarsy 9y ago
  I used to use it, I now use Cookie AutoDelete [1]. It's especially a nice on-boarding experience: at first the cookie Auto-clean deletion is disabled so you have time to whitelist the sites you want, and then you turn it on. It also support Multi-Account containers[2], so you can whitelist a particular site only in a particular container. This is obviously a new feature compared to Self-Destructing Cookies since Mutli-Account containers didn't exist back in the time. [1] https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... [2] https://blog.mozilla.org/firefox/introducing-firefox-multi-account-containers/ https://blog.mozilla.org/firefox/introducing-firefox-multi-a...
- moosingin3space 9y ago
  This extension's functionality is definitely possible with the new APIs. Cookie manipulation APIs are exposed, including APIs for the separate cookie stores enabled by Multi-Account Containers.
barnabee 9y ago
"Cookies were originally designed to track users across the web on browsers" No, they weren't. They were designed to store small bits of data (such as a login or session token, or form data) between page requests within one site. It was only later that they were repurposed to track users around the web.
- teleclimber 9y ago
  Came here to say exactly that. Cookies are only capable of tracking users across the web because giant companies have managed to dupe site owners into adding code to their site.
  - plopz 9y ago
    I don't think anyone was duped into adding google analytics.
    - yuhong 9y ago
      Well, it was bought from Urchin and then they discontinued the original software. I mentioned this in the essay too.
  - deleted 9y ago
    [deleted]
- yuhong 9y ago
  Yea, I added a mention of this history (including RFC 2109 and RFC 2965) in the final essay too, including that DoubleClick was one of the first ones to track via cookies. Here is a link if you are interested: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...
devmunchies 9y ago
So if i have a product that uses 3rd party cookies to try and enhance the user experience (saving user progress in a 3rd party service for user convenience), whats the alternative to 3rd party cookies? Bad actors are making it harder for people who want to use cookies for enhancing the experience rather than analytics and marketing.
- hansen 9y ago
  > enhance the user experience Sorry, but this made me laugh. > whats the alternative to 3rd party cookies? Don't use a 3rd party service.
  - devmunchies 9y ago
    yes, saving user progress is enhancing their experience. you hear 3rd party and immediately think its bad. > Don't use a 3rd party service. I knew someone would say this, as if I had unlimited dev time.
    - hansen 9y ago
      You shouldn't use the term enhancing user experience. It’s a synonym for doing something against the interest of the user.
    - mcpherrinm 9y ago
      The third party service can provide you with some JavaScript you inject into your website. It stores cookies on your domain instead of a third party one.
      - yetanother1980 9y ago
        Which of course begs the question should third party scripts be allowed to run?
        mcpherrinm 9y ago
IBM 9y ago
#TBT to when Google bypassed Safari blocking third party cookies and paid an immaterial amount to settle the case [1]. [1] https://www.zdnet.com/article/google-pays-17m-to-settle-safari-cookie-privacy-bypass-charge/ https://www.zdnet.com/article/google-pays-17m-to-settle-safa...
John_KZ 9y ago
Man I wish we can go back to browsing the web without cookies.

19 points by cpeterso 9y ago

I like a Firefox extension called "Self-Destructing Cookies".[1] It will accept cookies, but then delete them when you close the tab. Unfortunately, it (like many other useful extensions) was permanently broken by recent changes to Firefox. I wonder if there are any good alternatives. [1] - https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/en-US/firefox/addon/self-destruct...

zeta0134 9y ago
You can get close with a built in browser setting. Firefox can erase all cookies as soon as you close the browser: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences https://support.mozilla.org/en-US/kb/enable-and-disable-cook... You can also open up a Private Browsing tab if you want to visit a site you don't trust, or simply maintain a separate environment from your main stuff. Private windows have their own cookie store separate from the main store, and also clear their history upon close.
- hansen 9y ago
  > You can get close with a built in browser setting. And you can still keep cookies from specific sites by defining an exception. They should better document this feature. For me it would be a good default behavior. There aren’t that many sites where I want to stay logged in.
AdmiralAsshat 9y ago
Cookie AutoDelete was explicitly written to be an E10-compatible alternative to SDC: https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
blakesterz 9y ago
This post has a bunch of good replacements: https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxQuantumAddons https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxQuantumA... "Cookie AutoDelete is my current replacement for Self-Destructing Cookies (which I adopted in my primary Firefox due to switching to uMatrix). I enable autocleaning, turn off showing the number of cookies for the domain and notification, and turn on cleaning Localstorage."
z_open 9y ago
Try ``Cookie AutoDelete''. It's very user friendly with whitelists, blacklists, and such.
vmarsy 9y ago
I used to use it, I now use Cookie AutoDelete [1]. It's especially a nice on-boarding experience: at first the cookie Auto-clean deletion is disabled so you have time to whitelist the sites you want, and then you turn it on. It also support Multi-Account containers[2], so you can whitelist a particular site only in a particular container. This is obviously a new feature compared to Self-Destructing Cookies since Mutli-Account containers didn't exist back in the time. [1] https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... [2] https://blog.mozilla.org/firefox/introducing-firefox-multi-account-containers/ https://blog.mozilla.org/firefox/introducing-firefox-multi-a...
moosingin3space 9y ago
This extension's functionality is definitely possible with the new APIs. Cookie manipulation APIs are exposed, including APIs for the separate cookie stores enabled by Multi-Account Containers.

barnabee 9y ago

"Cookies were originally designed to track users across the web on browsers" No, they weren't. They were designed to store small bits of data (such as a login or session token, or form data) between page requests within one site. It was only later that they were repurposed to track users around the web.

teleclimber 9y ago
Came here to say exactly that. Cookies are only capable of tracking users across the web because giant companies have managed to dupe site owners into adding code to their site.
- plopz 9y ago
  I don't think anyone was duped into adding google analytics.
  - yuhong 9y ago
    Well, it was bought from Urchin and then they discontinued the original software. I mentioned this in the essay too.
- deleted 9y ago
  [deleted]
yuhong 9y ago
Yea, I added a mention of this history (including RFC 2109 and RFC 2965) in the final essay too, including that DoubleClick was one of the first ones to track via cookies. Here is a link if you are interested: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...

devmunchies 9y ago

So if i have a product that uses 3rd party cookies to try and enhance the user experience (saving user progress in a 3rd party service for user convenience), whats the alternative to 3rd party cookies? Bad actors are making it harder for people who want to use cookies for enhancing the experience rather than analytics and marketing.

hansen 9y ago
> enhance the user experience Sorry, but this made me laugh. > whats the alternative to 3rd party cookies? Don't use a 3rd party service.
- devmunchies 9y ago
  yes, saving user progress is enhancing their experience. you hear 3rd party and immediately think its bad. > Don't use a 3rd party service. I knew someone would say this, as if I had unlimited dev time.
  - hansen 9y ago
    You shouldn't use the term enhancing user experience. It’s a synonym for doing something against the interest of the user.
  - mcpherrinm 9y ago
    The third party service can provide you with some JavaScript you inject into your website. It stores cookies on your domain instead of a third party one.
    - yetanother1980 9y ago
      Which of course begs the question should third party scripts be allowed to run?
      - mcpherrinm 9y ago

IBM 9y ago

#TBT to when Google bypassed Safari blocking third party cookies and paid an immaterial amount to settle the case [1]. [1] https://www.zdnet.com/article/google-pays-17m-to-settle-safari-cookie-privacy-bypass-charge/ https://www.zdnet.com/article/google-pays-17m-to-settle-safa...

John_KZ 9y ago

Man I wish we can go back to browsing the web without cookies.