6 ms·

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determime user preferences.

inetknght 8y ago
Once upon a day, twenty years ago, site feature selection were exactly what cookies were used for.
tbranyen 8y ago
This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.
- pixellab 8y ago
  100% exactly. Cookies are device and moment specific. Whereas a user account can easily save and transport the saved experience/setting anywhere the user wants to access them.
  - gkya 8y ago
    Firefox (and Chrom{e,ium} AFAIK) can sync up your cookies, among other things.
    - trumped 8y ago
      but if you go this route, you have to share them with a third party (Mozilla or Google)?
      - gkya 8y ago
        Yes, but Firefox's Sync is open source [1], so you should be able to set up a private instance. IDK how easy or hard it is though. [1] https://wiki.mozilla.org/CloudServices/Sync https://wiki.mozilla.org/CloudServices/Sync
        Anthony-G 8y ago
        Thanks for the suggestion. That wiki page brought me to https://mozilla-services.readthedocs.io/en/latest/howtos/run-sync.html https://mozilla-services.readthedocs.io/en/latest/howtos/run... which I intend to try out. I want to migrate my a Firefox profile from Windows to Linux and synching seems to be the easiest way to transfer bookmarks and saved passwords.
  - inetknght 8y ago
    I specifically do not want to have the same experience on multiple devices. I do not want to have the same experience on my work computer vs my home computer. I do not want to have the same experience on my home computer vs my personal phone. I do not want to have the same experience on my personal phone vs my work phone. I do not want to have the same experience on my work phone vs my work computer.
- trumped 8y ago
  You could backup your cookies and share them across devices? ... I don't think "bogging down" requests is a very big issue nowadays...
- gkya 8y ago
  I don't think a gzipped header with some hundreds of bytes of JSON (or BSON) for preferences is that much bigger than one with a session id string in a cookie.
  - deleted 8y ago
    [deleted]
- inetknght 8y ago
  I am struggling to understand how it is bogging down requests with data that are "unrelated" to the session. Cookies are delivered with the request. If it has feature selections, great, no more work necessary on your part. If the feature selection is hidden behind a user ID, then you need to look up the user ID in a database and then request the user's features. Indeed, it seems to me that requiring a login in order to customize the viewing experience is what bogs down requests.
- rqs 8y ago
  It can be worked around. For example, you can use those cookies just to initialize the client web browser. Once it's done, the data can be cached inside the localStorage, and the cookie itself can be deleted (Or changed to a marker that tells the server that the client has been customized). Of course this may require some heavy changes on the client-side code, as the client now must have the ability to apply user's customization locally, but there are benefit: After you done that, then you don't have to read user's customization data from any of your infrastructure every time user reloads your page.
ReidZB 8y ago
"User-interface customization" cookies are actually explicitly exempt from EU consent requirements: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm I believe they should not be affected by GDPR either, since they're not actually identifying a person.
- solarkraft 8y ago
  Yet you could use them to do that once there is a significantly high amount of customised settings ...
  - ilyanep 8y ago
    Wasn't there some website where you could pull a relatively small number of easily accessible prefs from the browser (OS, list of fonts, browser, etc.) and get a nearly uniquely identifying set of facts about someone?
    - noisem4ker 8y ago
      https://panopticlick.eff.org/ https://panopticlick.eff.org/ ?
      - ilyanep 8y ago
        Yup, the fingerprinting portion of that was what I had in mind.
Boulth 8y ago
An example of what you describe is duckduckgo.com, cookie contain preferences without any user identifiers.
Bromskloss 8y ago
Then, there are those who go in the opposite direction and store all session information in the URL!
daphneokeefe 8y ago
A cookie is such a transient data source. Some people regularly purge them all. Some people use more than one device. I wouldn't bother changing any preferences that disappear every time I clear out my cookies. For starters, I'd have to figure out where on the website the preferences are set -- and if it's in the user profile, well, just save my preferences there.

inetknght 8y ago

Once upon a day, twenty years ago, site feature selection were exactly what cookies were used for.

tbranyen 8y ago

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

pixellab 8y ago
100% exactly. Cookies are device and moment specific. Whereas a user account can easily save and transport the saved experience/setting anywhere the user wants to access them.
- gkya 8y ago
  Firefox (and Chrom{e,ium} AFAIK) can sync up your cookies, among other things.
  - trumped 8y ago
    but if you go this route, you have to share them with a third party (Mozilla or Google)?
    - gkya 8y ago
      Yes, but Firefox's Sync is open source [1], so you should be able to set up a private instance. IDK how easy or hard it is though. [1] https://wiki.mozilla.org/CloudServices/Sync https://wiki.mozilla.org/CloudServices/Sync
      - Anthony-G 8y ago
        Thanks for the suggestion. That wiki page brought me to https://mozilla-services.readthedocs.io/en/latest/howtos/run-sync.html https://mozilla-services.readthedocs.io/en/latest/howtos/run... which I intend to try out. I want to migrate my a Firefox profile from Windows to Linux and synching seems to be the easiest way to transfer bookmarks and saved passwords.
- inetknght 8y ago
  I specifically do not want to have the same experience on multiple devices. I do not want to have the same experience on my work computer vs my home computer. I do not want to have the same experience on my home computer vs my personal phone. I do not want to have the same experience on my personal phone vs my work phone. I do not want to have the same experience on my work phone vs my work computer.
trumped 8y ago
You could backup your cookies and share them across devices? ... I don't think "bogging down" requests is a very big issue nowadays...
gkya 8y ago
I don't think a gzipped header with some hundreds of bytes of JSON (or BSON) for preferences is that much bigger than one with a session id string in a cookie.
- deleted 8y ago
  [deleted]
inetknght 8y ago
I am struggling to understand how it is bogging down requests with data that are "unrelated" to the session. Cookies are delivered with the request. If it has feature selections, great, no more work necessary on your part. If the feature selection is hidden behind a user ID, then you need to look up the user ID in a database and then request the user's features. Indeed, it seems to me that requiring a login in order to customize the viewing experience is what bogs down requests.
rqs 8y ago
It can be worked around. For example, you can use those cookies just to initialize the client web browser. Once it's done, the data can be cached inside the localStorage, and the cookie itself can be deleted (Or changed to a marker that tells the server that the client has been customized). Of course this may require some heavy changes on the client-side code, as the client now must have the ability to apply user's customization locally, but there are benefit: After you done that, then you don't have to read user's customization data from any of your infrastructure every time user reloads your page.

ReidZB 8y ago

"User-interface customization" cookies are actually explicitly exempt from EU consent requirements: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm I believe they should not be affected by GDPR either, since they're not actually identifying a person.

solarkraft 8y ago
Yet you could use them to do that once there is a significantly high amount of customised settings ...
- ilyanep 8y ago
  Wasn't there some website where you could pull a relatively small number of easily accessible prefs from the browser (OS, list of fonts, browser, etc.) and get a nearly uniquely identifying set of facts about someone?
  - noisem4ker 8y ago
    https://panopticlick.eff.org/ https://panopticlick.eff.org/ ?
    - ilyanep 8y ago
      Yup, the fingerprinting portion of that was what I had in mind.

Boulth 8y ago

An example of what you describe is duckduckgo.com, cookie contain preferences without any user identifiers.

Bromskloss 8y ago

Then, there are those who go in the opposite direction and store all session information in the URL!

daphneokeefe 8y ago

A cookie is such a transient data source. Some people regularly purge them all. Some people use more than one device. I wouldn't bother changing any preferences that disappear every time I clear out my cookies. For starters, I'd have to figure out where on the website the preferences are set -- and if it's in the user profile, well, just save my preferences there.