5 ms·

While I agree on it from a logical Engineering point of view, the problem is that IMHO it'd follow the way of Do Not Track; browsers will by default set it to "

While I agree on it from a logical Engineering point of view, the problem is that IMHO it'd follow the way of Do Not Track; browsers will by default set it to "1" (meaning do not track the user), so then with the power of defaults the vast majority of browsers signal do not track, and so websites ignore it and track it anyway. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

hansvm 4y ago
Cookies are different since the browser is the party creating them. They don't need to rely on compliant webmasters.
- jonas21 4y ago
  How's the browser supposed to know which cookies are necessary for the site to function? If it blocks all cookies, then things like sign in break.
  - pessimizer 4y ago
    Then you click yes on the cookie request that your own browser makes to you.
  - 8organicbits 4y ago
    You'd create a web standard for categorizing cookies (required, performance, login/session, metrics, etc). Meta tags? Naming scheme? .well-known? Lots of ways to do it. If the website conforms to the standard, then the browser could use its own UI to ask the user for their preference. Importantly, the user would be able to state global preferences like: "only required and login cookies, don't ask about others", and then they wouldn't need to be prompted by every new site. If the website doesn't conform, then they'd need custom UI to comply with existing cookie laws, same a today. So, the website could lie and say that their tracking cookies are in the required category, but they can do that already by not using a cookie banner, or miscategorizing the cookie in the banner. I think the users who hate cookie banners and the sites that don't want custom cookie banner UI would like this approach. Sites desperate to trick users into allowing tracking cookies: they'll still find a dark pattern and we'll hate them for it.
    - salawat 4y ago
      Then people will converge on implementation patterns that couple the tracking cookie to a necessary cookie. You cannot keep one without opening the door to the other.
  - hansvm 4y ago
    An easy compromise is for the default behavior to be to drop cookies when the session ends and to disallow third-party cookies. That gets you most of the privacy benefits while breaking a low percentage of sites.
- Rygian 4y ago
  The opposite is true. A browser never creates a cookie or of thin air. A browser stores a cookie only when it's sent by the server, or set by JavaScript code sent by the server.
  - hansvm 4y ago
    Right, but the browser is code you control on a machine you control. If the serve says "please store a cookie" and the browser is configured to drop all cookies when the session ends then the cookies are going to be dropped, and there's nothing short of a CVE that's going to allow the webmaster to change that behavior.
    - Rygian 4y ago
      Considering that: - some cookies are essential for the website to work, - some others are not, and - the browser can't ever tell the difference, then it doesn't really matter what config is set in the browser.
      - hansvm 4y ago
        That's a moved goalpost though. We started by saying that cookies are fundamentally different from "do not track" because in the case of the latter the browser doesn't have the technical means to enforce anything and in the former it does. Your point is something rather different -- as best as I can tell you're arguing that any attempt to do something browser-side will break too many things to be useful. I think the original point still stands (that this is fundamentally different from "do not track"), and moreover I disagree with the contents of that moved goalpost: As a compromise solution, the vast majority of sites work fine if you delete their cookies when you're done with a session. If the browser did that by default we'd have a significant improvement in privacy and a negligible amount of breakage. The most obvious counterpoint is login flows. That's not antithetical to the idea for a couple reasons. First, we'd all be a bit more secure if we logged out more frequently. Second, if you do want persistent sessions you've already given up exactly the same amount of privacy as if all cookies were blindly allowed since you're manually tying your visits together with that login information. With that in mind, there's no harm in having a setting somewhere for allowing cookies from the few sites you actually login to frequently. For convenience that could be tied to the existing password box detection, and otherwise it'd be something you have to dive into a menu and fiddle with to keep it from turning into the same kind of annoyance as browsers asking for notification privileges. That would break a few things, but browsers have had a trend lately of breaking a few things for privacy gains. I don't think it's obvious that we couldn't meaningfully reduce cookie setting.
vrfvr 4y ago
"cookie" consent exists because of laws. If it's gonna happen at all, there will be a law enforcing that, because it's not in the interest of website owners (which also leads to the dark patterns in the dialogues). If there is law, people can sue, which usually is enough for companies to (usually) follow it This isn't the case for do not track afaik

hansvm 4y ago

Cookies are different since the browser is the party creating them. They don't need to rely on compliant webmasters.

jonas21 4y ago
How's the browser supposed to know which cookies are necessary for the site to function? If it blocks all cookies, then things like sign in break.
- pessimizer 4y ago
  Then you click yes on the cookie request that your own browser makes to you.
- 8organicbits 4y ago
  You'd create a web standard for categorizing cookies (required, performance, login/session, metrics, etc). Meta tags? Naming scheme? .well-known? Lots of ways to do it. If the website conforms to the standard, then the browser could use its own UI to ask the user for their preference. Importantly, the user would be able to state global preferences like: "only required and login cookies, don't ask about others", and then they wouldn't need to be prompted by every new site. If the website doesn't conform, then they'd need custom UI to comply with existing cookie laws, same a today. So, the website could lie and say that their tracking cookies are in the required category, but they can do that already by not using a cookie banner, or miscategorizing the cookie in the banner. I think the users who hate cookie banners and the sites that don't want custom cookie banner UI would like this approach. Sites desperate to trick users into allowing tracking cookies: they'll still find a dark pattern and we'll hate them for it.
  - salawat 4y ago
    Then people will converge on implementation patterns that couple the tracking cookie to a necessary cookie. You cannot keep one without opening the door to the other.
- hansvm 4y ago
  An easy compromise is for the default behavior to be to drop cookies when the session ends and to disallow third-party cookies. That gets you most of the privacy benefits while breaking a low percentage of sites.
Rygian 4y ago
The opposite is true. A browser never creates a cookie or of thin air. A browser stores a cookie only when it's sent by the server, or set by JavaScript code sent by the server.
- hansvm 4y ago
  Right, but the browser is code you control on a machine you control. If the serve says "please store a cookie" and the browser is configured to drop all cookies when the session ends then the cookies are going to be dropped, and there's nothing short of a CVE that's going to allow the webmaster to change that behavior.
  - Rygian 4y ago
    Considering that: - some cookies are essential for the website to work, - some others are not, and - the browser can't ever tell the difference, then it doesn't really matter what config is set in the browser.
    - hansvm 4y ago
      That's a moved goalpost though. We started by saying that cookies are fundamentally different from "do not track" because in the case of the latter the browser doesn't have the technical means to enforce anything and in the former it does. Your point is something rather different -- as best as I can tell you're arguing that any attempt to do something browser-side will break too many things to be useful. I think the original point still stands (that this is fundamentally different from "do not track"), and moreover I disagree with the contents of that moved goalpost: As a compromise solution, the vast majority of sites work fine if you delete their cookies when you're done with a session. If the browser did that by default we'd have a significant improvement in privacy and a negligible amount of breakage. The most obvious counterpoint is login flows. That's not antithetical to the idea for a couple reasons. First, we'd all be a bit more secure if we logged out more frequently. Second, if you do want persistent sessions you've already given up exactly the same amount of privacy as if all cookies were blindly allowed since you're manually tying your visits together with that login information. With that in mind, there's no harm in having a setting somewhere for allowing cookies from the few sites you actually login to frequently. For convenience that could be tied to the existing password box detection, and otherwise it'd be something you have to dive into a menu and fiddle with to keep it from turning into the same kind of annoyance as browsers asking for notification privileges. That would break a few things, but browsers have had a trend lately of breaking a few things for privacy gains. I don't think it's obvious that we couldn't meaningfully reduce cookie setting.

vrfvr 4y ago

"cookie" consent exists because of laws. If it's gonna happen at all, there will be a law enforcing that, because it's not in the interest of website owners (which also leads to the dark patterns in the dialogues). If there is law, people can sue, which usually is enough for companies to (usually) follow it This isn't the case for do not track afaik