5 ms·

I imagine an alternative history where browsers simply never had the feature of cookies and similar tracking mechanisms available to servers or domains other th

I imagine an alternative history where browsers simply never had the feature of cookies and similar tracking mechanisms available to servers or domains other than the primary one in the URL bar. Or even more severely, where all assets and scripts had to be loaded from the same domain. That would have various downsides but would also have created a much less tracking prone web.

ianai 7y ago
I wish there were a way to enforce this client side.
- nerdponx 7y ago
  uBlock Origin and uBlock Matrix can both enforce it. But you won't be able to read the news or check the weather.
  - cik 7y ago
    That's why you use AdNauseum instead. I read news, check the weather, and generally live my life. Combine it with ExplodingCookies and life is better than it was.
    - nerdponx 7y ago
      In my understanding, it's trivially easy to identify and filter out those fake clicks. Also I don't want to screw with advertisers' perception of who I am. If anything, I really like how ads are actually relevant to me -- it's a lot better than the days of penis pill banners. I just want them to stop following me around so closely and putting my "anonymized" data at risk of exfiltration by hackers or governments.
  - buckminster 7y ago
    I block all Javascript, cookies and third party sites by default. I still get news and weather. Even nytimes.com works.
- fullstop 7y ago
  uMatrix on firefox might be a good start
- _corym 7y ago
  Pretty sure the Brave Browser can do this if you change a couple of settings :)
Osiris 7y ago
Opera Browser (Presto engine) used to default to "Block third-party cookies", rather than "Accept all cookies". If I remember correctly, this subtly broken enough sites that they relented and changed the default. I think that would be a good option. Allow first-party cookies for session tracking (logins, etc) but block third-party cookies. Another way is to not use cookies at all and rely on local storage to store an authorization token. In fact, a site that I work on does this. We don't store your session in a cookie at all. Your token gets passed to API calls which return data for your user.
jerf 7y ago
The most likely scenario for that is that the browser would not allow any form of cross-domain linking. And in that parallel universe, what ends up happening is that the ad companies provide you proxies to run on your server, and tracking is accomplished via the variety of "no-cookie" tracking options that already exist. It's slightly better, because the bar for tracking would be raised a bit, but since there's money as a motivation for getting over it, mostly it would be passed. The alternate reality I'm interested in is the one where the net was slightly less idealistic in the beginning and offered fewer free services, and people got used to paying for things rather than expecting them for free. I've banged this drum before, but one of the most shocking things to me is in general just how little money advertising is making per person, and how little money it would take to make it so that advertising wasn't even remotely worth it to anybody on the net if we paid directly for things. (I worked out earlier this year that at most, Facebook makes $17/year/per user, and that's revenue, not profit: https://news.ycombinator.com/item?id=19459604#19462402 https://news.ycombinator.com/item?id=19459604#19462402 That means if you paid them $5/month, or $50 as a bundle for a year, you'd be increasing more than doubling their revenue for you. And who knows what Facebook could be if you were paying for it, and all those engineers were working on making Facebook better for you, instead of working so hard on tracking you and serving ads. You'd be paying $5/month for that Facebook instead of this one.)
- AlanSE 7y ago
  I think that most people, if offered $17/year for Facebook, would quit. I don't think the value to the user is that great. That's not a problem for the company as it exists today. It feels like a flawed assumption that users have a committed interest in sites where they share content. People have a passing interest, and different parts on their brain conflict. Their lizard brain might want cat gifs, while the planning part of their brain knows they should stop procrastinating and get to work. The planning part is the one who gets out the credit card. The last thing that Facebook or ANY content-oriented site is to deal with the responsible parent, as opposed to the distracted child. Having the parent make the decisions is better for us. Much of the internet depends on that never happening.
  - 7y ago
daxterspeed 7y ago
I know it doesn't help "the 99%", but you can set up your browser to block cookies by default and always block third party cookies. What I've found is that a small subset of sites don't work without third party cookies (PlayStation store login being the only one I care about) and that a lot of sites don't expect localStorage access to ever fail (eg Codepen, I've had to fix some of my own sites that assumed localStorage access never throws). The oddest issue I've come across was that LiveJournal would use JavaScript to immediately reload the site if a cookie wasn't detected so I had to disable JavaScript for all of LiveJournal to stop it from getting stuck in a reload loop.

ianai 7y ago

I wish there were a way to enforce this client side.

nerdponx 7y ago
uBlock Origin and uBlock Matrix can both enforce it. But you won't be able to read the news or check the weather.
- cik 7y ago
  That's why you use AdNauseum instead. I read news, check the weather, and generally live my life. Combine it with ExplodingCookies and life is better than it was.
  - nerdponx 7y ago
    In my understanding, it's trivially easy to identify and filter out those fake clicks. Also I don't want to screw with advertisers' perception of who I am. If anything, I really like how ads are actually relevant to me -- it's a lot better than the days of penis pill banners. I just want them to stop following me around so closely and putting my "anonymized" data at risk of exfiltration by hackers or governments.
- buckminster 7y ago
  I block all Javascript, cookies and third party sites by default. I still get news and weather. Even nytimes.com works.
fullstop 7y ago
uMatrix on firefox might be a good start
_corym 7y ago
Pretty sure the Brave Browser can do this if you change a couple of settings :)

Osiris 7y ago

Opera Browser (Presto engine) used to default to "Block third-party cookies", rather than "Accept all cookies". If I remember correctly, this subtly broken enough sites that they relented and changed the default. I think that would be a good option. Allow first-party cookies for session tracking (logins, etc) but block third-party cookies. Another way is to not use cookies at all and rely on local storage to store an authorization token. In fact, a site that I work on does this. We don't store your session in a cookie at all. Your token gets passed to API calls which return data for your user.

jerf 7y ago

The most likely scenario for that is that the browser would not allow any form of cross-domain linking. And in that parallel universe, what ends up happening is that the ad companies provide you proxies to run on your server, and tracking is accomplished via the variety of "no-cookie" tracking options that already exist. It's slightly better, because the bar for tracking would be raised a bit, but since there's money as a motivation for getting over it, mostly it would be passed. The alternate reality I'm interested in is the one where the net was slightly less idealistic in the beginning and offered fewer free services, and people got used to paying for things rather than expecting them for free. I've banged this drum before, but one of the most shocking things to me is in general just how little money advertising is making per person, and how little money it would take to make it so that advertising wasn't even remotely worth it to anybody on the net if we paid directly for things. (I worked out earlier this year that at most, Facebook makes $17/year/per user, and that's revenue, not profit: https://news.ycombinator.com/item?id=19459604#19462402 https://news.ycombinator.com/item?id=19459604#19462402 That means if you paid them $5/month, or $50 as a bundle for a year, you'd be increasing more than doubling their revenue for you. And who knows what Facebook could be if you were paying for it, and all those engineers were working on making Facebook better for you, instead of working so hard on tracking you and serving ads. You'd be paying $5/month for that Facebook instead of this one.)

AlanSE 7y ago
I think that most people, if offered $17/year for Facebook, would quit. I don't think the value to the user is that great. That's not a problem for the company as it exists today. It feels like a flawed assumption that users have a committed interest in sites where they share content. People have a passing interest, and different parts on their brain conflict. Their lizard brain might want cat gifs, while the planning part of their brain knows they should stop procrastinating and get to work. The planning part is the one who gets out the credit card. The last thing that Facebook or ANY content-oriented site is to deal with the responsible parent, as opposed to the distracted child. Having the parent make the decisions is better for us. Much of the internet depends on that never happening.
- 7y ago

daxterspeed 7y ago

I know it doesn't help "the 99%", but you can set up your browser to block cookies by default and always block third party cookies. What I've found is that a small subset of sites don't work without third party cookies (PlayStation store login being the only one I care about) and that a lot of sites don't expect localStorage access to ever fail (eg Codepen, I've had to fix some of my own sites that assumed localStorage access never throws). The oddest issue I've come across was that LiveJournal would use JavaScript to immediately reload the site if a cookie wasn't detected so I had to disable JavaScript for all of LiveJournal to stop it from getting stuck in a reload loop.