8 ms·

IMO, focusing on better UX is the wrong approach. This should be handled at the browser level. There's no reason for most users to ever be burdened with even a

IMO, focusing on better UX is the wrong approach. This should be handled at the browser level. There's no reason for most users to ever be burdened with even a fantastically designed cookie consent window.

david_draco 4y ago
It was. That was the original design, to ask the user for each site. Then people downloaded browsers that did not ask them ... and browser developers switched it off by default.
- kragen 4y ago
  Not for each site, for each HTTP request. So if you loaded a page with ten inline images Netscape would ask you eleven times if you wanted to accept cookies, unless you said "yes" at some point, and then it would stop asking you for that site.
  - dredmorbius 4y ago
    At which point you'd link the cookies file to /dev/null Browsers would hold cookies for a session, but not between them. This is no longer a viable option as: - There are those who keep browser sessions alive for long periods of time (days, weeks, months, ...) - Cross-site cookies. (Thanks, Doubleclick, and by Doubleclick, I of course mean Google which produces the most widely-used browser in the world.) Make the Web Stateless Again.
    - kragen 4y ago
      You can run everything in Incognito.
      - dredmorbius 4y ago
        And I do, particularly on Android. The main motivator there is actually Google Chrome's abysmal tab management and navigation, as it is all but impossible to clear out tabs in a reasonable manner. On Firefox, with Tree-Style Tabs, the problem still exists, though it is less severe. There's still ample opportunity for tracking, unfortunately. I consider both Chrome and Android to be actively user-hostile and privacy-hostile, for what I hope are evident and well-founded reasons. Google's advertising motiviation is powerful.
        kragen 4y ago
        I agree. Have you tried palemoon?
        dredmorbius 4y ago
        No. First I've heard of it.
franciscop 4y ago
While I agree on it from a logical Engineering point of view, the problem is that IMHO it'd follow the way of Do Not Track; browsers will by default set it to "1" (meaning do not track the user), so then with the power of defaults the vast majority of browsers signal do not track, and so websites ignore it and track it anyway. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
- hansvm 4y ago
  Cookies are different since the browser is the party creating them. They don't need to rely on compliant webmasters.
  - jonas21 4y ago
    How's the browser supposed to know which cookies are necessary for the site to function? If it blocks all cookies, then things like sign in break.
    - pessimizer 4y ago
      Then you click yes on the cookie request that your own browser makes to you.
    - 8organicbits 4y ago
      You'd create a web standard for categorizing cookies (required, performance, login/session, metrics, etc). Meta tags? Naming scheme? .well-known? Lots of ways to do it. If the website conforms to the standard, then the browser could use its own UI to ask the user for their preference. Importantly, the user would be able to state global preferences like: "only required and login cookies, don't ask about others", and then they wouldn't need to be prompted by every new site. If the website doesn't conform, then they'd need custom UI to comply with existing cookie laws, same a today. So, the website could lie and say that their tracking cookies are in the required category, but they can do that already by not using a cookie banner, or miscategorizing the cookie in the banner. I think the users who hate cookie banners and the sites that don't want custom cookie banner UI would like this approach. Sites desperate to trick users into allowing tracking cookies: they'll still find a dark pattern and we'll hate them for it.
mdekkers 4y ago
I generally don't want cookies, except for when I do on some sites...
bruce511 4y ago
You infer that the browser makers, and the content suppliers are not aligned. But this is not the case. The biggest browser maker is also the biggest cookie tracker. In theory this would be a point of differentiation for say Firefox, but then again the biggest funder of Firefox is also.... Da dum.... That's right, the biggest beneficiary of cookie tracking... I imagine there are browsers out there that offer what you want, but you'd have to go looking for them.
- cheriot 4y ago
  Google wants people to use Chrome so they're not disintermediated like on iOS. If something drives people away they won't do it. Disagree about Firefox. They'd do a good job.
  - bruce511 4y ago
    Google gets no money from people using Chrome, what they get is the ability to track you directly. They turn that tracking into adverts, which is ultimately their revenue stream. They absolutely _could_ do a good job to prevent you being tracked - they absolutely have no incentive to do so. Likewise Firefox. They _could_ implement tracking protection. But they (so far) clearly choose not to. You say they'd do a good job, and I agree, but it's not like they haven't thought of it, or they're waiting for approval from the HN forums before implementing it. Given they have chosen not to do it, it makes you think maybe there's a reason for that. And maybe that has to do with the wishes of their biggest benefactor... Of course I might be wrong. Perhaps they're just thinking that tracking everyone is good for the end user, and so they want to provide a browser which offers users the best possible experience. That's obviously a possibility as well.
    - cheriot 4y ago
      > Google gets no money from people using Chrome Google avoids losing money by having a large Chrome user base. It's the same as making money. They have to write checks to Firefox and Apple to maintain access to those users, but not with Chrome. > Likewise Firefox. They _could_ implement tracking protection. Curious what you want Firefox to do? https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...
mrjin 4y ago
Totally agree. This is as simply as discarding non-identity (even all) cookies on closing the browser by default. But the thing is that all mainstream browsers are controlled by giants and unfortunately all of which have huge interests in advertisement industry. So unless we can create a browser ourselves or we are going to have such scratching the boot solutions again and again.
- onion2k 4y ago
  Discarding cookies wouldn't work. Browsers have many ways to store data locally - cookies is the simplest, but there's localstorage, IndexDB, and webdb too. It's trivial to put a tracking ID in any of them, and send it to a third party when a user loads a page. It's one line of JS code. To solve this problem in the browser you'd need to discard all locally stored information when the user closes it. Thia comes with two prpblems - first, users rarely close their browsers. They may close a tab, or a window, but the app is still running. I'm pretty sure Chrome has been running on my Macbook for months. - second, this mechanism would break every app that actually respects user privacy. Apps that don't upload data or track people need the users content and prefs to be held locally between sessions. By wiping it you'd force app developers to implement mechanisms to put that data in the cloud, which is the opposite of your intent.
  - KronisLV 4y ago
    I feel like we should probably have the concept of an "intent" for any bit of data that we'd like to store in a browser and partition the storage by that: Intents: - REQUIRED_FOR_SITE_FUNCTIONALITY (translation "Required For Site Functionality") - FIRST_PARTY_ANALYTICS (translation "First Party Analytics") - THIRD_PARTY_ANALYTICS (translation "Third Party Analytics") - FIRST_PARTY_MARKETING (translation "First Party Marketing") - THIRD_PARTY_MARKETING (translation "Third Party Marketing") Let the browsers themselves provide UI for accepting or denying these (maybe the users should be able to choose their own defaults per intent): Message: https://some.site would like to use your browser to store data for these intents: Required For Site Functionality [X] Yes [ ] No First Party Analytics [X] Yes [ ] No Third Party Analytics [ ] Yes [X] No Unspecified [ ] Yes [X] No [ Submit ] Which could then correspond to how everything is stored in the browser: Storage: https://some.site REQUIRED_FOR_SITE_FUNCTIONALITY (accepted) Cookies - ... LocalStorage - ... IndexDB - ... FIRST_PARTY_ANALYTICS (accepted) Cookies - ... LocalStorage - ... THIRD_PARTY_ANALYTICS (rejected) FIRST_PARTY_MARKETING (rejected) THIRD_PARTY_MARKETING (rejected) UNSPECIFIED (rejected automatically after 01.01.2030) And extend the JavaScript API for cookies (and also all other mechanisms for storage, this is an example): document.cookie = "user_id=1234"; // this would go under Unspecified document.cookie = "intent=REQUIRED_FOR_SITE_FUNCTIONALITY; user_id=1234"; // this would go in the proper group document.cookie = "intent=THIRD_PARTY_MARKETING; uid=1234"; // this would throw something like an IntentViolationError And ideally something for checking these intents as well: let canUseRequired = document.intents["REQUIRED_FOR_SITE_FUNCTIONALITY"].accepted; // true let canUseTPAnalytics = document.intents["THIRD_PARTY_ANALYTICS"].accepted; // false Who would define these types? Well, i think that there are two ways: - have some international body decide on these types - allow custom types per site, maybe with different UI for that And then just prosecute those who don't follow the convention and abuse the mechanisms. Of course, that will never be done.
cheriot 4y ago
Yes, the regulators screwed this up. It's the browser that decides to store a cookie or not. And if the browser UI sucks people can switch and go on with their lives.
- atoav 4y ago
  This is not about storing cookies or not alone, it is about consent to do so. And to give this consent the site has to tell me what it does and for which purposes it does that. Good, there could have been a standardized way to ask for that consent — but to me the way a site tries to trick you into consenting is yet another data point whether I want to be on this site.
  - zarzavat 4y ago
    If you are not using incognito then you are getting tracked. These consent popups are close to useless because only good actors will obey the law, and as we’ve seen the vast majority of websites are somewhere between grey hat (asking but in a way that breaks the law) and black hat (not asking at all). What we need is better isolation at the browser and web protocol level. This is a technical problem, not a regulatory problem. You cannot regulate actors who don’t obey the law in the first place.
    - atoav 4y ago
      Those who disobey the law can be sued. People just need to start doing it. The goal of the law is partly to make people who run websites aware of what they do with the data of their visitors. And that means for one part that they need to know what happens with things they embed in thwir site like google analytics and google fonts (for which someone has been sued already). But it also means that once website owners are informed they can decide wheter they want to ask people for their consent or whether they just remove those third party options. In reality many don't inform themselves at all and just slap a cookie thing onto their page, because that's what all the others are doing — just like they did with google analytics et al. Not knowing the law is not an excuse which will help you once someone sues you tho.
tjoff 4y ago
No thanks. Stop normalizing this bullshit. First, every shady website that despite the UX detriments decide that they want to sell their users must publicly state that. That is a feature. I want to know that, I want to see how far in dark patterns they are willing to go to absolutely ruin any trust they imagine they could exploit. Second, while (most of) these popups are illegal it is so abundantly clear what and how they are trying to get away with it. If the "browser" did this for me I wouldn't know what absolute illegal nonsense they would try to sneak in via "legitimate interest". Third, normal decently behaved sites/operators obviously don't have cookie-banners at all. That is also a feature, it is an edge. If you see two sites for X one with a cookie-banner and one without it is clear as day which one you'd close and forget. The times I've backed out of sites because of cookie banners is uncountable. And it is liberating.
- divan 4y ago
  I believe by "handling at the browser level" people generally mean the option in the Settings that allow autoaccept "necessary" or "all" cookies. If you care, just leave it unchecked.
  - deleted 4y ago
    [deleted]
  - wewxjfq 4y ago
    There is no such thing as blanket consent and necessary cookies don't require consent.
    - salawat 4y ago
      Watch as magically all cookies become "necessary". Software engineering: the last bastion of legitimacy for people who still seem to have a fundamental issue with the idea of consent.
- froh 4y ago
  You decline "legitimate interest", too, in your browser presets, of course you do. And if it goes via browser you can deliberately choose advertisers you trust, centrally in one place. Of course I want this in the browser.
LocalH 4y ago
Do you want another useless feature in your browser? Because they tried that with Do Not Track, and it is absolutely useless, because a website can ignore it.

david_draco 4y ago

It was. That was the original design, to ask the user for each site. Then people downloaded browsers that did not ask them ... and browser developers switched it off by default.

kragen 4y ago
Not for each site, for each HTTP request. So if you loaded a page with ten inline images Netscape would ask you eleven times if you wanted to accept cookies, unless you said "yes" at some point, and then it would stop asking you for that site.
- dredmorbius 4y ago
  At which point you'd link the cookies file to /dev/null Browsers would hold cookies for a session, but not between them. This is no longer a viable option as: - There are those who keep browser sessions alive for long periods of time (days, weeks, months, ...) - Cross-site cookies. (Thanks, Doubleclick, and by Doubleclick, I of course mean Google which produces the most widely-used browser in the world.) Make the Web Stateless Again.
  - kragen 4y ago
    You can run everything in Incognito.
    - dredmorbius 4y ago
      And I do, particularly on Android. The main motivator there is actually Google Chrome's abysmal tab management and navigation, as it is all but impossible to clear out tabs in a reasonable manner. On Firefox, with Tree-Style Tabs, the problem still exists, though it is less severe. There's still ample opportunity for tracking, unfortunately. I consider both Chrome and Android to be actively user-hostile and privacy-hostile, for what I hope are evident and well-founded reasons. Google's advertising motiviation is powerful.
      - kragen 4y ago
        I agree. Have you tried palemoon?
        dredmorbius 4y ago
        No. First I've heard of it.

franciscop 4y ago

While I agree on it from a logical Engineering point of view, the problem is that IMHO it'd follow the way of Do Not Track; browsers will by default set it to "1" (meaning do not track the user), so then with the power of defaults the vast majority of browsers signal do not track, and so websites ignore it and track it anyway. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

hansvm 4y ago
Cookies are different since the browser is the party creating them. They don't need to rely on compliant webmasters.
- jonas21 4y ago
  How's the browser supposed to know which cookies are necessary for the site to function? If it blocks all cookies, then things like sign in break.
  - pessimizer 4y ago
    Then you click yes on the cookie request that your own browser makes to you.
  - 8organicbits 4y ago
    You'd create a web standard for categorizing cookies (required, performance, login/session, metrics, etc). Meta tags? Naming scheme? .well-known? Lots of ways to do it. If the website conforms to the standard, then the browser could use its own UI to ask the user for their preference. Importantly, the user would be able to state global preferences like: "only required and login cookies, don't ask about others", and then they wouldn't need to be prompted by every new site. If the website doesn't conform, then they'd need custom UI to comply with existing cookie laws, same a today. So, the website could lie and say that their tracking cookies are in the required category, but they can do that already by not using a cookie banner, or miscategorizing the cookie in the banner. I think the users who hate cookie banners and the sites that don't want custom cookie banner UI would like this approach. Sites desperate to trick users into allowing tracking cookies: they'll still find a dark pattern and we'll hate them for it.

mdekkers 4y ago

I generally don't want cookies, except for when I do on some sites...

bruce511 4y ago

You infer that the browser makers, and the content suppliers are not aligned. But this is not the case. The biggest browser maker is also the biggest cookie tracker. In theory this would be a point of differentiation for say Firefox, but then again the biggest funder of Firefox is also.... Da dum.... That's right, the biggest beneficiary of cookie tracking... I imagine there are browsers out there that offer what you want, but you'd have to go looking for them.

cheriot 4y ago
Google wants people to use Chrome so they're not disintermediated like on iOS. If something drives people away they won't do it. Disagree about Firefox. They'd do a good job.
- bruce511 4y ago
  Google gets no money from people using Chrome, what they get is the ability to track you directly. They turn that tracking into adverts, which is ultimately their revenue stream. They absolutely _could_ do a good job to prevent you being tracked - they absolutely have no incentive to do so. Likewise Firefox. They _could_ implement tracking protection. But they (so far) clearly choose not to. You say they'd do a good job, and I agree, but it's not like they haven't thought of it, or they're waiting for approval from the HN forums before implementing it. Given they have chosen not to do it, it makes you think maybe there's a reason for that. And maybe that has to do with the wishes of their biggest benefactor... Of course I might be wrong. Perhaps they're just thinking that tracking everyone is good for the end user, and so they want to provide a browser which offers users the best possible experience. That's obviously a possibility as well.
  - cheriot 4y ago
    > Google gets no money from people using Chrome Google avoids losing money by having a large Chrome user base. It's the same as making money. They have to write checks to Firefox and Apple to maintain access to those users, but not with Chrome. > Likewise Firefox. They _could_ implement tracking protection. Curious what you want Firefox to do? https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...

mrjin 4y ago

Totally agree. This is as simply as discarding non-identity (even all) cookies on closing the browser by default. But the thing is that all mainstream browsers are controlled by giants and unfortunately all of which have huge interests in advertisement industry. So unless we can create a browser ourselves or we are going to have such scratching the boot solutions again and again.

onion2k 4y ago
Discarding cookies wouldn't work. Browsers have many ways to store data locally - cookies is the simplest, but there's localstorage, IndexDB, and webdb too. It's trivial to put a tracking ID in any of them, and send it to a third party when a user loads a page. It's one line of JS code. To solve this problem in the browser you'd need to discard all locally stored information when the user closes it. Thia comes with two prpblems - first, users rarely close their browsers. They may close a tab, or a window, but the app is still running. I'm pretty sure Chrome has been running on my Macbook for months. - second, this mechanism would break every app that actually respects user privacy. Apps that don't upload data or track people need the users content and prefs to be held locally between sessions. By wiping it you'd force app developers to implement mechanisms to put that data in the cloud, which is the opposite of your intent.
- KronisLV 4y ago
  I feel like we should probably have the concept of an "intent" for any bit of data that we'd like to store in a browser and partition the storage by that: Intents: - REQUIRED_FOR_SITE_FUNCTIONALITY (translation "Required For Site Functionality") - FIRST_PARTY_ANALYTICS (translation "First Party Analytics") - THIRD_PARTY_ANALYTICS (translation "Third Party Analytics") - FIRST_PARTY_MARKETING (translation "First Party Marketing") - THIRD_PARTY_MARKETING (translation "Third Party Marketing") Let the browsers themselves provide UI for accepting or denying these (maybe the users should be able to choose their own defaults per intent): Message: https://some.site would like to use your browser to store data for these intents: Required For Site Functionality [X] Yes [ ] No First Party Analytics [X] Yes [ ] No Third Party Analytics [ ] Yes [X] No Unspecified [ ] Yes [X] No [ Submit ] Which could then correspond to how everything is stored in the browser: Storage: https://some.site REQUIRED_FOR_SITE_FUNCTIONALITY (accepted) Cookies - ... LocalStorage - ... IndexDB - ... FIRST_PARTY_ANALYTICS (accepted) Cookies - ... LocalStorage - ... THIRD_PARTY_ANALYTICS (rejected) FIRST_PARTY_MARKETING (rejected) THIRD_PARTY_MARKETING (rejected) UNSPECIFIED (rejected automatically after 01.01.2030) And extend the JavaScript API for cookies (and also all other mechanisms for storage, this is an example): document.cookie = "user_id=1234"; // this would go under Unspecified document.cookie = "intent=REQUIRED_FOR_SITE_FUNCTIONALITY; user_id=1234"; // this would go in the proper group document.cookie = "intent=THIRD_PARTY_MARKETING; uid=1234"; // this would throw something like an IntentViolationError And ideally something for checking these intents as well: let canUseRequired = document.intents["REQUIRED_FOR_SITE_FUNCTIONALITY"].accepted; // true let canUseTPAnalytics = document.intents["THIRD_PARTY_ANALYTICS"].accepted; // false Who would define these types? Well, i think that there are two ways: - have some international body decide on these types - allow custom types per site, maybe with different UI for that And then just prosecute those who don't follow the convention and abuse the mechanisms. Of course, that will never be done.

cheriot 4y ago

Yes, the regulators screwed this up. It's the browser that decides to store a cookie or not. And if the browser UI sucks people can switch and go on with their lives.

atoav 4y ago
This is not about storing cookies or not alone, it is about consent to do so. And to give this consent the site has to tell me what it does and for which purposes it does that. Good, there could have been a standardized way to ask for that consent — but to me the way a site tries to trick you into consenting is yet another data point whether I want to be on this site.
- zarzavat 4y ago
  If you are not using incognito then you are getting tracked. These consent popups are close to useless because only good actors will obey the law, and as we’ve seen the vast majority of websites are somewhere between grey hat (asking but in a way that breaks the law) and black hat (not asking at all). What we need is better isolation at the browser and web protocol level. This is a technical problem, not a regulatory problem. You cannot regulate actors who don’t obey the law in the first place.
  - atoav 4y ago
    Those who disobey the law can be sued. People just need to start doing it. The goal of the law is partly to make people who run websites aware of what they do with the data of their visitors. And that means for one part that they need to know what happens with things they embed in thwir site like google analytics and google fonts (for which someone has been sued already). But it also means that once website owners are informed they can decide wheter they want to ask people for their consent or whether they just remove those third party options. In reality many don't inform themselves at all and just slap a cookie thing onto their page, because that's what all the others are doing — just like they did with google analytics et al. Not knowing the law is not an excuse which will help you once someone sues you tho.

tjoff 4y ago

No thanks. Stop normalizing this bullshit. First, every shady website that despite the UX detriments decide that they want to sell their users must publicly state that. That is a feature. I want to know that, I want to see how far in dark patterns they are willing to go to absolutely ruin any trust they imagine they could exploit. Second, while (most of) these popups are illegal it is so abundantly clear what and how they are trying to get away with it. If the "browser" did this for me I wouldn't know what absolute illegal nonsense they would try to sneak in via "legitimate interest". Third, normal decently behaved sites/operators obviously don't have cookie-banners at all. That is also a feature, it is an edge. If you see two sites for X one with a cookie-banner and one without it is clear as day which one you'd close and forget. The times I've backed out of sites because of cookie banners is uncountable. And it is liberating.

divan 4y ago
I believe by "handling at the browser level" people generally mean the option in the Settings that allow autoaccept "necessary" or "all" cookies. If you care, just leave it unchecked.
- deleted 4y ago
  [deleted]
- wewxjfq 4y ago
  There is no such thing as blanket consent and necessary cookies don't require consent.
  - salawat 4y ago
    Watch as magically all cookies become "necessary". Software engineering: the last bastion of legitimacy for people who still seem to have a fundamental issue with the idea of consent.
froh 4y ago
You decline "legitimate interest", too, in your browser presets, of course you do. And if it goes via browser you can deliberately choose advertisers you trust, centrally in one place. Of course I want this in the browser.

LocalH 4y ago

Do you want another useless feature in your browser? Because they tried that with Do Not Track, and it is absolutely useless, because a website can ignore it.