12 ms·

Purge site data when site identified via old tracking cookies

158 points by cryogenic_soul 7y ago

majkinetor 7y ago
And in v80 in alternate universe, Firefox will purge the sites from the Internet, after the data. Somebody please point me to the portal...
- BubRoss 7y ago
  That's called pi-hole and having it network wide is a game changer. 30% of all dns requests are blocked.
  - majkinetor 7y ago
    Pi-hole is on my TODO list for quite some time. Yeah, its definitelly a portal I should get to fast (summon, not get to, hence the TODO entry). Currently using uMatrix and friends but its not network wide and that sux a lot.
    - sneak 7y ago
      NextDNS works well without setting up anything new, too. I use it instead of pi-hole.
  - saagarjha 7y ago
    I fail to understand the widespread appeal of a Raspberry Pi (slow?) that only blocks requests on your homework network.
    - BubRoss 7y ago
      It is a DNS server that makes every ad and tracking domain route to nothing. It speeds everything up and uses an almost undetectable amount of resources. It could be done in the router with different software I'm guessing, but I use tomato firmware which isn't great for huge DNS block lists.
      - saagarjha 7y ago
        I mean, yes, I know what Pi-Hole does. I just fail to see why it's better than a hosts list on your computer, for example: that works wherever you are and you don't need fancy software for it. Plus it's "infinitely worse" than a normal adblocker when browsing the internet.
        cj 7y ago
        - It blocks tracking / ads on devices where you can’t edit a hosts list (your phone) - It works for your entire network (everyone in your household)
        saagarjha 7y ago
        > It blocks tracking / ads on devices where you can’t edit a hosts list (your phone) Right, but you can use adblockers on them. > It works for your entire network (everyone in your household) Fair, but as I mentioned it stops working the moment you step out, which I assume you do with your phone?
        Bootvis 7y ago
        >> It blocks tracking / ads on devices where you can’t edit a hosts list (your phone) > Right, but you can use adblockers on them. The iPhone doesn't support ad blocking.
        saagarjha 7y ago
        It very much does.
        cj 7y ago
        Elaborate? I'm not aware of a way to block in-app ads, or ads served when using Chrome / Safari / Firefox on iOS without using a DNS based ad blocker.
JMTQp8lwXL 7y ago
I wouldn't mind going back to a JavaScript-less web experience. I know not all tracking is based on JS, but the browser provides so many heuristics this way: screen size, cursor location, installed plugins. Give me reasonably formatted HTML, and something a little bit more powerful than curl.
- reificator 7y ago
  If "reasonably formatted" means CSS comes along for the ride, prepare for tracking pixels behind onhover rules, and on and on we go...
  - JMTQp8lwXL 7y ago
    By reasonably formatted, I would actually exclude onhover. To clarify, I meant a document that would be readable without any interaction. You've got me wondering if privacy-focused browsers like Brave have the ability to disable potential tracking mechanisms like onhover.
    - ficklepickle 7y ago
      Disabling CSS :hover and :active states might break sites. Tracking pixels could be as simple as a background image set for either of those CSS states.
      - JMTQp8lwXL 7y ago
        Agreed, but it would likely break things that don't matter much to me. A well defined semantic document should say what it has to say, without the use or necessity of :hover or :active states.
      - matheusmoreira 7y ago
        Browsers could disable downloading of external resources for CSS :hover and :active. When the user interacts with the interface, the CSS will still get applied but the tracking URL won't be accessed.
mgbmtl 7y ago
It's rather neat to be able to read a short diff, including a test, to see exactly what that means. From my limited understanding: it purges cookies and localStorage, if the storage access API permission was not granted?
jackjeff 7y ago
I have been using “Cookies Autodelete” for years. Except for a short list of 20 sites, nothing can store data on my Firefox. These tracking sites would not be able to show me ads anyway because I have “uBlock origin” And finally “I don’t care about cookies” to automatically dismiss these stupid GDPR “we’re going to use cookies” prompts. Without these the Internet feels broken.
- gruez 7y ago
  >I have been using “Cookies Autodelete” for years. Except for a short list of 20 sites, nothing can store data on my Firefox. Not really. It doesn't delete indexeddb for instance.
  - Drdrdrq 7y ago
    And cache, local storage, basically anything that changes state.
  - rasz 7y ago
    delete indexedDB; in userjs is all it takes in Chrome to disable indexedDB permanently
    - smitop 7y ago
      It is still possible for websites to access indexedDB by using Web Workers: new Worker("data:application/javascript,console.log('indexedDB: ', indexedDB)") This works since userscripts only run in top-level websites and frames, but the above code runs JS code in a seperate thread with no attached DOM.
      - rasz 7y ago
        if ('serviceWorker' in window.navigator) navigator.serviceWorker.register = () => new Promise( function(resolve, reject) {} ); disables webworkers from ever working.
floatingatoll 7y ago
The relevant code comment from the bug-linked changes is: > This loops through all cookies saved in the database and checks if they are a tracking cookie, if it is it checks that they have an interaction permission which is still valid. If the Permission is not valid we delete all data associated with the site that owns that cookie.
tinus_hn 7y ago
So the next race is going to be pinging all these cookies to keep them alive
- JohnFen 7y ago
  Nah. The adtech people are already talking about persistent identification mechanisms to allow the same identification in the absence of third party cookies. If you're privacy-minded, it's worth keeping an eye on these efforts, as some of them involve getting publishers to require a login and an email address or phone number from their users, then using that as the persistent identifier. If that idea takes root, then we'll probably want to cancel accounts and avoid making new ones.
  - l31g 7y ago
    Or a sign-in with Apple-like system so tracking is limited to each site.
    - kamyarg 7y ago
      Best decision I have made so far is setting up a catch-all polic for my domain. any_random_address@mydomain.com is saved in a "dummy" inbox, I check it from time to time and give different emails for different services to identify who sold my email. instagram is insta@mydomain.com, netflix is nflx@mydomain.com etc. If someone needs pointers: I use webfaction for MX, setup mailboxes with catch-all policy and setup a rule to forward these email to my gmail and have a filter on gmail to skip inbox and save in "dummy" category. p.s. if someone has a better alternative to webfaction for email only stuff, please let me know, not sure if I can do it with an other provider that is cheaper.
      - osamagirl69 7y ago
        I use fastmail, and there is no additional setup needed. Just point the catchall at an account and use the filters to sort as appropriate. Mail from my legacy gmail, yahoo, and hotmail accounts get forwarded to respective aliases at mydomain.com and sorted into appropriate folders as well. Best online hygiene decision I have ever made. Ranks up there with installing ubock origin on desktop/mobile.
xenator 7y ago
So, another popup notification to add site's cookies to whitelist.
BaitBlock 7y ago
Try Baitblock https://baitblock.app https://baitblock.app Baitblock has tracking resistance that also deletes first party cookies/other tracking mechanisms when it detects that you're not logged into a website.
- foo_in_bar 7y ago
  It's a pity it's chrome only.

And in v80 in alternate universe, Firefox will purge the sites from the Internet, after the data. Somebody please point me to the portal...

BubRoss 7y ago
That's called pi-hole and having it network wide is a game changer. 30% of all dns requests are blocked.
- majkinetor 7y ago
  Pi-hole is on my TODO list for quite some time. Yeah, its definitelly a portal I should get to fast (summon, not get to, hence the TODO entry). Currently using uMatrix and friends but its not network wide and that sux a lot.
  - sneak 7y ago
    NextDNS works well without setting up anything new, too. I use it instead of pi-hole.
- saagarjha 7y ago
  I fail to understand the widespread appeal of a Raspberry Pi (slow?) that only blocks requests on your homework network.
  - BubRoss 7y ago
    It is a DNS server that makes every ad and tracking domain route to nothing. It speeds everything up and uses an almost undetectable amount of resources. It could be done in the router with different software I'm guessing, but I use tomato firmware which isn't great for huge DNS block lists.
    - saagarjha 7y ago
      I mean, yes, I know what Pi-Hole does. I just fail to see why it's better than a hosts list on your computer, for example: that works wherever you are and you don't need fancy software for it. Plus it's "infinitely worse" than a normal adblocker when browsing the internet.
      - cj 7y ago
        - It blocks tracking / ads on devices where you can’t edit a hosts list (your phone) - It works for your entire network (everyone in your household)
        saagarjha 7y ago
        > It blocks tracking / ads on devices where you can’t edit a hosts list (your phone) Right, but you can use adblockers on them. > It works for your entire network (everyone in your household) Fair, but as I mentioned it stops working the moment you step out, which I assume you do with your phone?
        Bootvis 7y ago
        >> It blocks tracking / ads on devices where you can’t edit a hosts list (your phone) > Right, but you can use adblockers on them. The iPhone doesn't support ad blocking.
        saagarjha 7y ago
        It very much does.
        cj 7y ago
        Elaborate? I'm not aware of a way to block in-app ads, or ads served when using Chrome / Safari / Firefox on iOS without using a DNS based ad blocker.

JMTQp8lwXL 7y ago

I wouldn't mind going back to a JavaScript-less web experience. I know not all tracking is based on JS, but the browser provides so many heuristics this way: screen size, cursor location, installed plugins. Give me reasonably formatted HTML, and something a little bit more powerful than curl.

reificator 7y ago
If "reasonably formatted" means CSS comes along for the ride, prepare for tracking pixels behind onhover rules, and on and on we go...
- JMTQp8lwXL 7y ago
  By reasonably formatted, I would actually exclude onhover. To clarify, I meant a document that would be readable without any interaction. You've got me wondering if privacy-focused browsers like Brave have the ability to disable potential tracking mechanisms like onhover.
  - ficklepickle 7y ago
    Disabling CSS :hover and :active states might break sites. Tracking pixels could be as simple as a background image set for either of those CSS states.
    - JMTQp8lwXL 7y ago
      Agreed, but it would likely break things that don't matter much to me. A well defined semantic document should say what it has to say, without the use or necessity of :hover or :active states.
    - matheusmoreira 7y ago
      Browsers could disable downloading of external resources for CSS :hover and :active. When the user interacts with the interface, the CSS will still get applied but the tracking URL won't be accessed.

mgbmtl 7y ago

It's rather neat to be able to read a short diff, including a test, to see exactly what that means. From my limited understanding: it purges cookies and localStorage, if the storage access API permission was not granted?

jackjeff 7y ago

I have been using “Cookies Autodelete” for years. Except for a short list of 20 sites, nothing can store data on my Firefox. These tracking sites would not be able to show me ads anyway because I have “uBlock origin” And finally “I don’t care about cookies” to automatically dismiss these stupid GDPR “we’re going to use cookies” prompts. Without these the Internet feels broken.

gruez 7y ago
>I have been using “Cookies Autodelete” for years. Except for a short list of 20 sites, nothing can store data on my Firefox. Not really. It doesn't delete indexeddb for instance.
- Drdrdrq 7y ago
  And cache, local storage, basically anything that changes state.
- rasz 7y ago
  delete indexedDB; in userjs is all it takes in Chrome to disable indexedDB permanently
  - smitop 7y ago
    It is still possible for websites to access indexedDB by using Web Workers: new Worker("data:application/javascript,console.log('indexedDB: ', indexedDB)") This works since userscripts only run in top-level websites and frames, but the above code runs JS code in a seperate thread with no attached DOM.
    - rasz 7y ago
      if ('serviceWorker' in window.navigator) navigator.serviceWorker.register = () => new Promise( function(resolve, reject) {} ); disables webworkers from ever working.

floatingatoll 7y ago

The relevant code comment from the bug-linked changes is: > This loops through all cookies saved in the database and checks if they are a tracking cookie, if it is it checks that they have an interaction permission which is still valid. If the Permission is not valid we delete all data associated with the site that owns that cookie.

tinus_hn 7y ago

So the next race is going to be pinging all these cookies to keep them alive

JohnFen 7y ago
Nah. The adtech people are already talking about persistent identification mechanisms to allow the same identification in the absence of third party cookies. If you're privacy-minded, it's worth keeping an eye on these efforts, as some of them involve getting publishers to require a login and an email address or phone number from their users, then using that as the persistent identifier. If that idea takes root, then we'll probably want to cancel accounts and avoid making new ones.
- l31g 7y ago
  Or a sign-in with Apple-like system so tracking is limited to each site.
  - kamyarg 7y ago
    Best decision I have made so far is setting up a catch-all polic for my domain. any_random_address@mydomain.com is saved in a "dummy" inbox, I check it from time to time and give different emails for different services to identify who sold my email. instagram is insta@mydomain.com, netflix is nflx@mydomain.com etc. If someone needs pointers: I use webfaction for MX, setup mailboxes with catch-all policy and setup a rule to forward these email to my gmail and have a filter on gmail to skip inbox and save in "dummy" category. p.s. if someone has a better alternative to webfaction for email only stuff, please let me know, not sure if I can do it with an other provider that is cheaper.
    - osamagirl69 7y ago
      I use fastmail, and there is no additional setup needed. Just point the catchall at an account and use the filters to sort as appropriate. Mail from my legacy gmail, yahoo, and hotmail accounts get forwarded to respective aliases at mydomain.com and sorted into appropriate folders as well. Best online hygiene decision I have ever made. Ranks up there with installing ubock origin on desktop/mobile.

xenator 7y ago

So, another popup notification to add site's cookies to whitelist.

BaitBlock 7y ago

Try Baitblock https://baitblock.app https://baitblock.app Baitblock has tracking resistance that also deletes first party cookies/other tracking mechanisms when it detects that you're not logged into a website.

foo_in_bar 7y ago
It's a pity it's chrome only.