20 ms·
Things not available when someone blocks all cookies
- josephcsible 4y agoWhat if browsers made it so when you turned off cookies, instead of not allowing anything to be written, they instead gave each page you visited its own fresh cookie jar that was cleared when you navigated away?
- frmdstryr 4y agoThere's an extension called cookie autodelete that does that. https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete
- stankface 4y agoWhat if legislators had targeted the ~3 browsers instead of the countless websites to enforce their policy? Things would actually work on a technical level, and we wouldn't be bombarded with dozens of useless cookie warnings. Would have been nice.
- techdmn 4y agoSimilar to suggestions that Android offer the option to provide fake location data to apps that require it without good reason: It's a fantastic idea and seems easy to implement, but might make it less painful for users to opt out of all the tracking that makes the internet so friendly to advertisers and other groups who would like to surveil your activity.
- AlexandrB 4y agoThis feature is long overdue in both Android and iOS. The amount of location data being harvested is outrageous.
- salawat 4y agoThis is absolutely unacceptable. No. The solution to "software authors routinely collecting more info than they should" is not "accept the behavior as irredeemable, and just normalize it". The answer is "make ot way more visible to users when it is done, snd make it harder for software authors to do/maintain." Anything else is just a tacit acknowledgement and grant of legitimacy to the behavior in question.
- powerhour 4y agoGiving app developers bogus data would make it harder to use* and maintain, so that's a clear win, IMO. * use as in use for the intended business purposes, not harder to write the code
- salawat 4y agoThe problem is not just app developers. Telcos sell it to.
- galdosdi 4y agoJust the opposite. What this would normalize is app developers no longer be able to depend on location data being accurate, which would destroy the location data sales market by turning it into a market for lemons. What you propose, simply yelling at developers to stop requesting unneeded permissions, would have no useful effect. They won't change. And most customers won't care and will blindly click accept no matter what if they think they have to to access their game. Never let the perfect be the enemy of the good. Assume that other actors in the world will respond the way they usually do, not the way you think they should. That is the way to get things done.
- yamazakiwi 4y agoOh no, not the location data sales market.
- 4y ago
- yobbo 4y agoYes. And instead of requiring sites to ask "accept cookies", let it be a browser option when the site attempts to store cookies, like "OK for 10 minutes".
- cyborgx7 4y agoExactly. The great thing about cookies is that they are a tool, completely in the hand of the user. The site gives you a piece of text and says "show this to me next time if you want me to remember you". And then the browser can choose to continue to use them or not. Such a weird choice to put the onus on the websites to ask whether to give the cookies, rather than the browser to ask whether to save them. I'm a big supporter of privacy legislation like the GDPR, but this is asinine, as it needs me to trust every website I visit to actually honor my choice. Really, the original sin of cookies is that were designed to be transparent to user. That was a mistake that promptly needs to be rectified.
- account42 4y agoCookies might be in the hands of the user but tracking as a whole is not. If cookies become less reliable then there are many other ways, which is why the GDPR requires consent for any tracking not just cookies.
- cyborgx7 4y agoI absolutely agree. I'm arguing for cookies as an inherently consensual form of tracking and legislation to keep all the other ones in check.
- g_p 4y agoThis is loosely what Firefox's temporary containers [0] extension does. Each tab (with options to control whether a tab spawned from a parent tab should inherit the cookie-jar context of the parent) gets its own temporary context. I don't recall whether it clears the jar on navigating away, but you can have that jar cleared when the tab is closed, and you can configure new jars when opening a new tab to a new site origin (i.e. domain). [0] https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
- jeroenhd 4y agoHow well does this extension work together with the Multi-Account Containers addon (https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...)?
- clsec 4y agoI've been using both for quite some time now. They work very well together and I don't see myself browsing much without them. edit: remove redundant "together"
- jeroenhd 4y agoI'll give it a go, thanks!
- pavon 4y agoIt is designed to work with and supplement the Multi-Account Containers add-on. There a few things that are annoying and could use better integration. First, all the temporary containers show up in the list of containers you have created. Most of the time you can ignore that list, so it isn't a big deal, but if you need to configure a permanent container (and you have 100s of tabs open) the clutter makes them harder to find in the long list. When you tell Multi-Account Containers to always open a domain in a specific container, Temporary Containers knows about this, but for some reason it prompts you for additional confirmation. And sometimes this prompt breaks sites the first time through, adding an additional iteration when trying to configure a container to work with a site that uses multiple domains. Other than that they work together fine. I would also recommend the Cookie Quick Manager extension, which lets you manage cookies on a per-container basis. If you have been using Multi-Account Containers by it self, then any links you open from a page will open in the same container (say reading news sites from HN), and you likely have a bunch of cross-site cookies stored there. This extension will let you clear out any undesired third-party cookies that have gathered in the container. The UI is a bit unclear at first (which of these three trashcan icons scattered across the page delete the subset of cookies I want), so read the tooltips before clicking an icon.
- deleted 4y ago[deleted]
- esprehn 4y agoThat's effectively what Incognito does, except not at that granularity to make it simpler for users to understand. It probably can't be every site being separate since that breaks a number of things sites do (like opening 3p windows to complete transactions), but it could probably be done in some kind of logical group manner. Maybe by using different window colors to signify the partitions.
- dirkf 4y agoFirefox Focus on Android basically does that by default. If you set it as default browser then all links you click will be openend there. Hit the back button when you're done and everything is deleted. Another use case is if you quickly want to open some website to look something up: open the website, maybe click a few links, and when you're done everything is wiped. You can keep a regular Firefox (or Chrome or whatever) for surfing to those websites where you want to keep some state.
- eterevsky 4y agoAssuming the website wants to do something on the first user's visit, it would start doing it on every page load. Letting the website know that the user has disabled cookies can help avoid it and improve user experience.
- hoseja 4y agoLetting the website know anything at all lets it track you, as we learn time and time again.
- hk__2 4y agoIt already has your IP.
- account42 4y agoYou cannot realisticly prevent the website from knowing that you are using a privacy-conscious browser, which is why e.g. TOR Browser and Firefox's enhanced tracking prevention don't attempt to do that but instead only try to make all their users look the same. Trying to emultate the growing number of cookieNG technologies whithout adding more privacy leaks is a waste of time.
- ricardobeat 4y agoThis is the exact use case for sessionStorage or a cookie with expires=0. But correct usage depends on the knowledge & goodwill of website authors. For privacy purposes, Incognito mode achieves the same effect without any of the hassle. Maybe turning off cookies should not even be an option anymore?
- userbinator 4y agoIsn't that basically what a session cookie is?
- josephcsible 4y agoSession cookies usually last until you close your whole browser, rather than just until you navigate away.
- andrewaylett 4y agoA combination of Firefox Enhanced Tracking Protection and Cookie Autodelete works quite well here. Along with I Don't Care About Cookies to hide the inevitable slew of consent banners. I do use Multi-Account Containers and Temporary Containers too, but typically when I want multiple simultaneous sessions, rather than wanting my current session to be cleaned up.
- smallerfish 4y agoThe Atlantic is really annoying in this respect. When you open an article in Firefox Focus, it fully renders for a moment, but then apparently some javascript loads at the end of the cycle which clears the page.
- eointierney 4y agoReadermode fixes this for me
- nerdponx 4y agoI think the problem here is "potentially blocked". How do you know what's potentially blocked? Maybe it's listed clearly somewhere in the browser docs, or maybe it's not. Did they change it between versions? Did you even know about this issue in the first place? I know people like to think of checked exceptions as a failed experiment from the dark past of object oriented programming, but this situation is a great example of statically-typed (or at least statically-checkable) side effects are a huge improvement in code safety.
- paulhodge 4y agoYeah, adding try/catch around those has been a good practice for a while. I think there was a time when, if the site was running in a private window in Safari, localStorage would also throw exceptions.
- jefftk 4y ago> All I am using is some innocent localStorage and IndexedDB to persist user settings like the values of the sliders or the chosen color scheme. When you turn off cookies you're telling the browser not to let sites persist information. Otherwise, whatever goals you had in disabling cookies would just be worked around through these other technologies.
- moffkalast 4y agoThing is though, it can be worked around as long as js is enabled. Client side fingerprinting plus server side data storage and you get the same functionality in a roundabout way.
- 0x0 4y agoSo you get to share preferences with everyone else that matches your fingerprint :)
- moffkalast 4y agoThat's the punishment for blocking local storage. :P
- smoldesu 4y agos/punishment/reward
- treeman79 4y ago/s Even better we could store login information this way. What could go wrong?
- jefftk 4y agoYou don't even need JS: blocking cookies doesn't (but really should) disable the browser cache, which can reasonably reliably store information. Note that you can't use the cache to work around browsers blocking third-party cookies because all the major browsers fragment the cache by site.
- ricardobeat 4y agoI always use a wrapper around local/session storage[1] to avoid this problem. Then you have your app sync settings with storage, never read from it except during startup. It becomes impossible to implement basic UI features like remembering open panes, etc when storage is disabled though. With the current policies around cookies - no cross-domain reads, Safari's ITP - there is no real need to turn them off for privacy reasons, for the average user at least. [1] https://www.npmjs.com/package/localstory https://www.npmjs.com/package/localstory
- the_gipsy 4y agoBasic UI features shouldn't need storage. In-memory or in the URL is enough. If you put it in storage then it is actually a (cookie) session, with some sort of configuration - that's not "basic UI".
- zerocrates 4y agoIf you define "basic" as not including "this remembers how you had it set last time" then, sure. "In the URL" works for that, sort of, though not if you want it to still work for users that are just re-finding you through Google or typing in your address.
- the_gipsy 4y ago> "this remembers how you had it set last time" That is a session.
- ricardobeat 4y agoAnd? All desktop and mobile apps are able to persist data. The purpose of disabling cookies was privacy protection, not a 'storing local data is a crime' stance.
- temporallobe 4y agoSure, in-memory works until the page is refreshed. Storing data in the URL is an option, but also messy and cumbersome to manage especially with bookmarks. localStorage / sessionStorage is clean and dead simple, and it actually allows an app to be truly stateful, so it’s quite unfortunate that the trend is to avoid the “evils” of storing any kind of data on the client. What, should we go back to the days of session IDs and server-side storage for even the most trivial data?
- ckemere 4y agoI naively assumed from the headline that the author would complain about users blocking cookies. I was very pleasantly surprised to see a post written by someone who appreciates that some users will want to do this and is actively working to support delivering them a useful content experience!
- omgmajk 4y agoI assumed the same thing and was indeed happy when it turned out to be the better thing.
- aliqot 4y ago
- jefftk 4y ago> what the heck is so important that folks need to cookie that can't be just tied to the session token in the backend? Storing information on the client makes your site a lot more transparent about what it's keeping. If I have various user preferences in local storage you can tell that's what I'm doing and why, but if I just cookie you with an opaque token you have no idea what I'm tracking with that on the server.
- pessimizer 4y agoIf there were a simple to examine and pick through localstorage, maybe. Of course if there were, localstorage would be intentionally obfuscated.
- jefftk 4y agoIt's relatively straightforward. You open the console, type window.localStorage, and poke around. On the article I see: > window.localStorage Storage {dark-mode-toggle: 'light', cid: '2722...', length: 2} Ignore the "length" (implementation detail) and you can see it's storing whether I've turned on dark mode and some id that's likely per-user. If I switch the page to dark mode I see instead: > window.localStorage Storage {dark-mode-toggle: 'dark', cid: '2722...', length: 2}
- tomxor 4y agoThis feels kinda unscalable though... wouldn't it make more sense to change the browser to make cookies and localstorage non-persistent and isolated, but otherwise available programmatically and to XHRs. i.e so that they can exist in isolation as long as the tab is open. This would be compatible with anything that doesn't require cross frame or cross tab persistence (which is usually all users care about).
- yohannparis 4y agoJust keep your data in memory in that case, if you don't need persistence.
- mcv 4y agoI often think that instead of completely blocking cookies, it would be better to accept them and then throw them away. Same with localStorage. Just store it temporarily.
- admax88qqq 4y agoThat's basically incognito/private browsing mode.
- stickfigure 4y agoThis is the answer. Blocking the APIs is just asking for a broken internet, and I have very little sympathy. Furthermore, blocking the API is a detectable characteristic and increases the surface area of your fingerprint. It has exactly the opposite of the intended effect on privacy.
- npteljes 4y agoI do this with Firefox's Temporary Containers. Every manually opened tab is a new browsing session, with no cookies etc. Closed tabs' data get deleted after 15 mins. Fantastic addon, and the usage is as seamless as it gets. https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
- gameshot911 4y agoWhy is the website failing with unhandled errors, but working when they are try/catch'd? Either way the errors are being thrown, and the functionality isn't available. Is the browser not able to handle the situation itself more gracefully?
- marcosdumay 4y agoBecause the site doesn't need the functionality to work, but an exception terminates the javascript execution of things that the site does need.
- gameshot911 4y agoThx!
- Scoundreller 4y agoLooking forward to the day some webmaster sets the background to pictures of cookies when you block them all.
- user3939382 4y agoI just want to take this opportunity to thank "adtech" and everyone working in it for making local storage way more complex than it otherwise needed to be because you couldn't/can't stop yourselves from abusing users.
- Bewelge 4y agoIn what way is it more complex than it has to be? I don't work in front-end but whenever I've used localstorage for personal projects it's as simple as getting/setting a javascript object with keys & values.
- deleted 4y ago[deleted]
- matthewowen 4y agoIt’s described in the first section of the article.
- Bewelge 4y agoCare to elaborate? I just re-read the article and honestly still don't know what complexity OP was referring to. Do you mean the fact that cookies and LocalStorage (or other APIs able to persist data) are often considered the same thing when using the term "cookies"?
- beebmam 4y agoA technology which leaves the door open for exploitation will certainly be exploited by someone. In a self-governing society, people would turn their backs on the most exploitable technology; in the actual world, I just don't see that happening.
- Justsignedup 4y agoWhere there is an opportunity for exploitation and humans, there will always be an exploit used. It's just how we are, how our brains are built. Until that exploit yields you no benefit socially. Meanwhile we see just how effective targeted advertisement can be for both money and political influence.
- sebazzz 4y agoWeird to throw an exception when localStorage is not available. It is much more logical to have it undefined or null. Code working with localStorage is more likely to check whether it is available (“not falsey”) rather than trying to use it and fall back if it throws.
- the_gipsy 4y agoNo, it's correct. Null checks are for checking that a browser API is supported, but they might be unavailable, like being blocked or full or whatever.
- johncoltrane 4y agoI always accept all cookies because they have never had any negative impact on my surfing experience ever. Cookie banners and Privacy banners are much more of a problem than cookies ever were.
- rthomas6 4y agoJust don't use Chrome if it's user hostile. Use something else that's not.
- ajross 4y agoUh... The point of the article is that Chrome is proactively honoring its promise not to store user-identifiable data, even in ways that aren't ones front end developers would normally expect.
- dawalberto 4y agoSomeone knows if this happens only in Chrome or also in the rest of popular browsers?
- stiray 4y agoI handle cookies on my proxy where I change them to per session cookies and interestingly the sites that have cookies that are "necessary for sites to work", are working flawlessly (/s)
- ur-whale 4y ago> All I am using is some innocent localStorage and IndexedDB to persist user settings Hrm, isn't this the exact definition of a cookie?
- bagacrap 4y agoDifferent APIs, but all in the realm of (client-side) storage.
- johndhi 4y agoGod bless this man for making this -- but you know what's CRAZY to me? That no one has done this before. We all visit websites constantly and governments (particularly in EU) talk endlessly and vaguely about cookies and yet almost NO ONE really gets it. I work on this specific problem and it is SUCH a mess.
- pacifika 4y agoI created an extension that limits the maximum lifetime of cookies, I was surprised to see some have a lifetime of years. https://addons.mozilla.org/en-GB/firefox/addon/fresh-cookies/ https://addons.mozilla.org/en-GB/firefox/addon/fresh-cookies...
- yoyopa 4y agoinstead of blocking cookies, it would be nice if there was something like "Certified Humane" for websites... and you could stick within an internet of websites created by people who are not dicks.
- soperj 4y agoIs there a way to use csrf tokens without cookies?
- WaitWaitWha 4y agoAn interesting facet of this is the implicit trust by the author towards the downstream tooling and libraries. He is not alone. We talk about how we need to make sure dependencies are secure, but I venture to state, it is often just brushed over. Yes, supply chain security (now to rinse my mouth out).
- trasz 4y agoI wonder if instead of blocking cookies we could make a browser extension to share the tracking cookies (and only those) with random people on the web, to confuse trackers?
- 1vuio0pswjnm7 4y ago"(On a tangent, MDN is completely broken with cookies blocked, too. I was about to report this problem (because I care and love MDN), when I discovered a PR is already under way that fixes the Issue. Thanks, @bershanskiy!)" This would imply that "MDN" is under a state of rapid flux, potentially "breaking" and then being "fixed" (or not) over short periods of time. However it appears from the edit history that most of it is actually static and has not changed since 2019 or 2020.^1 Perhaps the "completely broken" catchphrase invoked by the author refers to an issue with "cosmetics" (window dressing) not content. I use a text-only browser and have not found MDN to be either partially or completely "broken". I send an HTTP request for a file and I receive the contents of the file. For me, it works. No cookies or Javascript required. 1. https://raw.githubusercontent.com/mdn/content/main/files/en-us/_wikihistory.json https://raw.githubusercontent.com/mdn/content/main/files/en-... If I want to check browser compatibility, which can change from time to time, I can use Github or the MDN website. For example, https://raw.githubusercontent.com/mdn/browser-compat-data/main/http/headers/Clear-Site-Data.json https://raw.githubusercontent.com/mdn/browser-compat-data/ma... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data/bcd.json https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cl...
- grishka 4y agoWhy throw an exception instead of providing real working versions of these things that only persist data for as long as the page is open?
- draw_down 4y ago
- asddubs 4y agoOne thing that annoys me about firefox's total cookie protection is that I offer some 3rd party embeds. What I did on those is I set a cookie, and probed for its existance to check if the user has third party cookies disabled. Then if they do, it displays things for the case where it's not known whether or not the user is logged in to the service, rather than as if they're definitely not logged in. This worked fine, but now that firefox just containerizes third party resources rather than actually blocking the cookies, so there's no longer a way to detect that the actual site cookies just aren't being delivered in a third party context, rather than not present without user agent sniffing.
- throwaway58670 4y agoI recently read a thread about privacy here. One point was that the one best thing you can do is disable JavaScript. So I decided to try it. I installed Brave on my phone and disabled pretty much everything, including all cookies. My thinking was, all I do is browse HN, hn.algolia, and lobsters. Those should work, right? Well lobsters works perfectly, including collapsing comments. HN loses the ability to collapse comments. But algolia is the worst. Not only does it require JS, being an SPA, but it refuses to work until you enable cookies! My theory is that it reads the settings (popular, 24-hour) from a cookie, and plain dies if they're not there. On another note, and to a pleasant surprise, a lot of the web works perfectly fine, and feels a lot snappier, including even google search. And many of the annoying cookie and paywall popups never appear, since they appear to be implemented in JS. So yes, if you haven't tried it, I recommend you do. You can always whitelist sites you trust or really need to use.
- self_awareness 4y agoHow about, you know, handling error conditions?
- edem 4y agoFun fact: the code example with the glow effect was created with [Carbon](https://carbon.now.sh/ https://carbon.now.sh/)
- mohas 4y agoNot directly related to this article but doesn't aggressively blocking tracking in this way create a tracking monopoly for browsers, extensions and apps?
- Florencees 4y ago[dead]
- londons_explore 4y agoWhy does the browser pretend to have localstorage but then throw an exception when it's used? Surely it would be better to simply pretend to not support localstorage and then all sites built with feature detection would work correctly without needing to special case this?
- wildrhythms 4y agoI can see it both ways. I think there's an opportunity for the developer to identify that localStorage is unavailable at runtime, and turn off certain features in the UI as a result, or write their own wrapper layer that does the 'throw-away' behavior.