6 ms·

> after seven days of Safari use without user interaction on the site If it's a PWA that's regularly used you should be fine. But if not, yeah, that's going to

by untog 7y ago

> after seven days of Safari use without user interaction on the site If it's a PWA that's regularly used you should be fine. But if not, yeah, that's going to be very annoying.

cageface 7y ago
If this is really about protecting users and not about kneecapping web apps shouldn't Apple also wipe user data in native apps that haven't been used in a week?
- untog 7y ago
  Native apps don't really have the problem of third-party ad networks storing data intermixed with app data in this way, though.
  - pspeter3 7y ago
    Why not though? It seems like third-party SDKs could be included by the developer and stored on my local device.
    - cageface 7y ago
      Every iOS app I ever built for a client had Facebook's SDK and tracking installed, at the client's request. Often Google's and Twitter's too and the user has no awareness of this.
  - detaro 7y ago
    The regular reports about tracking in random advertising/... SDKs suggest otherwise
  - sroussey 7y ago
    They are much worse.
- progval 7y ago
  Outside privacy issues; visiting a website once shouldn't be enough for a website to store as much data as it wants on someone's computer. Installing a native app is a stronger form of opt-in than simply clicking an URL to a new website.
  - jessaustin 7y ago
    Chromium (and derivatives such as Edge) allows users to install web apps. You're right that such a facility could be used as a signal for webkit that a particular site's IDB data should be retained for longer than a week.
    - zamalek 7y ago
      > install web apps That's what a PWA is :). Browsers should lift these restrictions for installed PWAs, and probably do.
      - jessaustin 7y ago
        The browser under discussion in TFA doesn't have PWAs as such. [0] Of course I agree with your restatement of what I said browsers should do upthread. b^) [0] https://caniuse.com/#search=beforeinstallprompt https://caniuse.com/#search=beforeinstallprompt
        untog 7y ago
        Safari still lets you add a web app to the homescreen, though. It could be used as a signal.
        mtedwards 7y ago
        Yeah it seems they are encouraging that as a solution. Unless I’m misunderstanding. “ Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. We do not expect the first-party in such a web application to have its website data deleted. If your web application does experience website data deletion, please let us know since we would consider it a serious bug. It is not the intention of Intelligent Tracking Prevention to delete website data for first parties in web applications.”
pspeter3 7y ago
Yeah, that seems potentially destructive for apps that want users to have a local only copy. You would need to provide a full import / export option in case someone goes on vacation.
quotemstr 7y ago
The seven day wipe is going to encourage further adoption of Facebook or Google centralized logins, since this flow makes state restoration after a cookie wipe least painful. (Even saved login-passwords combinations can become de-synchronized between devices.) I don't think the theoretical benefits of enhanced privacy are worth the concrete costs of internet centralization.
- progval 7y ago
  First-party cookies aren't on the list of affected storage, are they?
  - jefftk 7y ago
    https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/ https://webkit.org/blog/8613/intelligent-tracking-prevention... already limited 1st party cookies set from JS to 7d. This post is about them extending it to all storage set from JS.
    - shakna 7y ago
      However any cookies set via HTTP, like http secureonly cookies that tend to be used for logging in, are exempt from that seven day limit.
      - jefftk 7y ago
        Correct. I expect companies will start working around this with CNAMEing and proxying, and I'm curious how Apple will handle it.
        saagarjha 7y ago
        I would expect the end game of this would be advertising networks injecting content directly into the page as it's rendered on the webserver. If they want tracking, at some point they'll just ask companies to hand over their logs…
Dylan16807 7y ago
95% of my regularly used websites and applications have had usage gaps that have reached a week.

by untog 7y ago

> after seven days of Safari use without user interaction on the site If it's a PWA that's regularly used you should be fine. But if not, yeah, that's going to be very annoying.

cageface 7y ago

If this is really about protecting users and not about kneecapping web apps shouldn't Apple also wipe user data in native apps that haven't been used in a week?

untog 7y ago
Native apps don't really have the problem of third-party ad networks storing data intermixed with app data in this way, though.
- pspeter3 7y ago
  Why not though? It seems like third-party SDKs could be included by the developer and stored on my local device.
  - cageface 7y ago
    Every iOS app I ever built for a client had Facebook's SDK and tracking installed, at the client's request. Often Google's and Twitter's too and the user has no awareness of this.
- detaro 7y ago
  The regular reports about tracking in random advertising/... SDKs suggest otherwise
- sroussey 7y ago
  They are much worse.
progval 7y ago
Outside privacy issues; visiting a website once shouldn't be enough for a website to store as much data as it wants on someone's computer. Installing a native app is a stronger form of opt-in than simply clicking an URL to a new website.
- jessaustin 7y ago
  Chromium (and derivatives such as Edge) allows users to install web apps. You're right that such a facility could be used as a signal for webkit that a particular site's IDB data should be retained for longer than a week.
  - zamalek 7y ago
    > install web apps That's what a PWA is :). Browsers should lift these restrictions for installed PWAs, and probably do.
    - jessaustin 7y ago
      The browser under discussion in TFA doesn't have PWAs as such. [0] Of course I agree with your restatement of what I said browsers should do upthread. b^) [0] https://caniuse.com/#search=beforeinstallprompt https://caniuse.com/#search=beforeinstallprompt
      - untog 7y ago
        Safari still lets you add a web app to the homescreen, though. It could be used as a signal.
        mtedwards 7y ago
        Yeah it seems they are encouraging that as a solution. Unless I’m misunderstanding. “ Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. We do not expect the first-party in such a web application to have its website data deleted. If your web application does experience website data deletion, please let us know since we would consider it a serious bug. It is not the intention of Intelligent Tracking Prevention to delete website data for first parties in web applications.”

pspeter3 7y ago

Yeah, that seems potentially destructive for apps that want users to have a local only copy. You would need to provide a full import / export option in case someone goes on vacation.

quotemstr 7y ago

The seven day wipe is going to encourage further adoption of Facebook or Google centralized logins, since this flow makes state restoration after a cookie wipe least painful. (Even saved login-passwords combinations can become de-synchronized between devices.) I don't think the theoretical benefits of enhanced privacy are worth the concrete costs of internet centralization.

progval 7y ago
First-party cookies aren't on the list of affected storage, are they?
- jefftk 7y ago
  https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/ https://webkit.org/blog/8613/intelligent-tracking-prevention... already limited 1st party cookies set from JS to 7d. This post is about them extending it to all storage set from JS.
  - shakna 7y ago
    However any cookies set via HTTP, like http secureonly cookies that tend to be used for logging in, are exempt from that seven day limit.
    - jefftk 7y ago
      Correct. I expect companies will start working around this with CNAMEing and proxying, and I'm curious how Apple will handle it.
      - saagarjha 7y ago
        I would expect the end game of this would be advertising networks injecting content directly into the page as it's rendered on the webserver. If they want tracking, at some point they'll just ask companies to hand over their logs…

Dylan16807 7y ago

95% of my regularly used websites and applications have had usage gaps that have reached a week.