8 ms·

Excellent extension with one glaring flaw: IDCAC accepts cookies if there is no option to decline them. You don't see annoying popups anymore, but the cookies a

by Liquix 4y ago

Excellent extension with one glaring flaw: IDCAC accepts cookies if there is no option to decline them. You don't see annoying popups anymore, but the cookies are still there tracking you. This can be combated by combining it combined with Cookie AutoDelete [0]. Cookie AutoDelete solves the problem by purging all cookies automatically (except your whitelist) when the tab is closed. They work great together [0] https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete

ThunderSizzle 4y ago
Isn't uMatrix just as good, since it blocks non-first party cookies by default?
- karaterobot 4y ago
  I thought the goal of IDCAC was to get rid of those annoying cookie consent popups. It tries to block or hide the popup, but when cookies are required to use the site it automatically accepts them, assuming you will handle erasing unwanted cookies in some other way.
  - happymellon 4y ago
    > when cookies are required to use the site it automatically accepts them This makes no sense. Cookies required for operation of a site are not covered by GDPR, so shouldn't be in a cookie consent form. If you use cookies for your shopping cart, then you do not need to ask permission to create a shopping cart cookie.
    - mmmmmbop 4y ago
      There are quite a few news websites that deny access to the site unless you agree to being tracked (e.g. [1]). Authorities in EU countries are split on the legality of that -- the Dutch data protection authority explicitly disallows such behavior [2], while German authorities are silently tolerating it [3]. In my opinion, this goes against the spirit and the letter of GDPR, but it seems that they are getting away with it for now. The matter hasn't been discussed by the European Court of Justice yet. In those cases, as a non-paying user, you essentially have the choice between accepting being tracked, or not viewing the site. IDCAC errs on the side of being able to view the site. [1] https://www.zeit.de/ https://www.zeit.de/ [2] https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten-toegankelijk-blijven-bij-weigeren-tracking-cookies https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe... [3] In the case of online raffles, a German court even explicitly allowed forcing users to agree to their data being used for advertising purposes if they want to participate in the raffle. https://openjur.de/u/2185336.html https://openjur.de/u/2185336.html
      - happymellon 4y ago
        Okay, that makes sense. Thank you for the information!
- wartijn_ 4y ago
  You don't need uMatrix to block all third party cookies, in both Firefox and Chromium that is a build in option. And I don't think that option is as good as IDCAC (or Consent-O-Matic [0]) + CookieAutoDelete. With those two add-ons even first party cookies are deleted, while you don't need to close banners all the time. [0] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
- pavon 4y ago
  uMatrix has been unmaintained for 2 years and has known vulnerabilities[1]. Time to move to another extension. [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...
  - ThunderSizzle 4y ago
    I wish it would be fixed or forked if gorhill won't fix it. uMatrix's UI is easily the best I've used due to showing the white/black list as a matrix.
    - pavon 4y ago
      I know, I love uMatrix, and was sad to leave it. I've migrated to uBlock Origin, but it isn't the same even with dynamic filtering window opened. With uMatrix I had been taking the approach of denying all third-party resources by default and selectively allowing just the ones I need, and after the move largely ended up abandoning this approach. The different UI of uBO was part of this decision, but not the biggest factor. Over time it had gotten less and less workable even with uMatrix's great UI. I could no longer configure a site once and then expect it to work for any amount of time, as the rate at which new mandatory third-party dependencies were added to sites kept increasing. And I was visiting more websites as part of avoiding big sites like Amazon. In addition, uBO's CNAME unmasking meant that many resources that were considered first party by uMatrix, are treated as third party by uBO. This added to the burden of whitelisting, but also got me thinking about how fuzzy the first party / third party distinction was and that it was increasingly a poor proxy variable for what I was really trying to block (trackers mostly, and also some annoyances). I also use the Temporary Container extension in Firefox. In the end I decided that the default block lists of uBO combined with the isolation and discarding of persistent data provided by Temporary Containers was good enough for most browsing. I still use a whitelisting approach for my handful of permanent containers, and uBO's dynamic mode UI is good enough for that.
  - fn-mote 4y ago
    Easy to say "move to another", but what offers comparable functionality? The vulnerability does not seem that serious to me... isn't it going to be pretty obvious if it gets exploited with this description? > An attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. When the extension crashes, users are left without protection until it is reloaded. So I'm going to start seeing a bunch of ads as my clue, right? [Not a drive-by:] > It requires that users become active, e.g. by clicking on a link. The article you linked has plenty of information in the comments, it's actually a good resource.
dnissley 4y ago
> IDCAC accepts cookies if there is no option to decline them. You don't see annoying popups anymore, but the cookies are still there tracking you. Yes. Because I don't care about cookies. This is not an anti-tracking extension. I do not care about being tracked. I just want to stop being bombarded with cookie consent dialogs.
- PaulHoule 4y ago
  It is an unpopular opinion but I see GDPR as a watershed for user hostile design. It used to be that people involved with the web read Jacob Nielsen and Don’t Make Me Think, there was always pressure from the suits to distract users with BS but it was possible to hold the line. Once the GDPR came out, now it was required, even admirable, to distract users. Once that window was broken the car got stripped within 24 hours and now it is not unusual to have to dismiss 3 or more pop ups asking you to subscribe to an email newsletter.
  - AlexandrB 4y ago
    I think you're partly right but it happened before GDPR - when advertisers decided to ignore the DNT[1] flag. If DNT was respected, GDPR cookie pop ups would be unnecessary. Unfortunately the modern web is not about user choice but about herding users like cattle to maximize "engagement". [1] https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track
    - Analemma_ 4y ago
      DNT was an "evil bit" non-solution that was stupid all the way from initial concept to execution to predictable industry response. We are better off without it.
      - TillE 4y ago
        Millions of websites are currently showing stupid cookie popups because they're mandated by law to obtain the user's consent. Why shouldn't that consent or lack thereof be expressed once in the browser UI instead? The only issue with DNT is that it wasn't mandated.
rektide 4y ago
I'd rather use an extension that tells companies no, that exercises the legal right to say no. Dont just accept then delete (with likely other downstream consequences such as re-logging in when you dont want), just opt out. Make it clear that privacy matters. Dont just hack (with multiple extensions), vote. Use a moral & good & fit to task (not apathetic & consenting extension) like Consent-o-matic[1] or Auto Cookie Optout[2]. Some people actively dont care. Dont do that. Care. Help. Be a positive influence. (Ed: wow, unpopular opinion, over something that costs people nothing to assist in!! -2 points! [1] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic [2] https://github.com/CodyMcCodington/AutoCookieOptout https://github.com/CodyMcCodington/AutoCookieOptout
- Karunamon 4y ago
  Time and drain on my patience is a cost. And it is a particularly awful trade in this case; both of those are extremely precious resources, one of which is nonrenewable. I do not care about cookies. Not one person on the Internet can demonstrate a concrete harm caused by the existence of advertiser cookies on their machine. If you want to spend time twiddling these knobs, more power to you. I've got things to do and I will gladly take the first option that erases the annoyance with a minimum of disruption.
  - rektide 4y ago
    Sad that you have no spare effort-capacity whatsoever to make a choice for yourself like this, that you see yourself as at zero! Woe unto you. I dont get why this proclaimed unwillingness & lack of deciding leads you to pick the worse less defensive pick though. Why actively choose worse defense? I dont get your argumentation. Why is the worse dumber pick better for you, even if you dont feel convinced of the harm? Presented with a defensive & apathetic option, I don't see why you would still choose worse.
- fortran77 4y ago
  Then you care about cookies and this extension isn't for you.
deleted 4y ago
[deleted]
dizhn 4y ago
Another option is to use temporary containers for everything but the sites where you'd like to stay logged in.
perryizgr8 4y ago
> glaring flaw It's a feature not a flaw. See, I literally don't care about cookies. Deny them, allow them, whatever. Just don't bother me. That's exactly what the extension says and does.
- chihuahua 4y ago
  I agree with you on not caring at all about cookies. I've never understood the obsession with cookies and tracking. It seems that some people imagine Sundar Pichai sitting in his underground lair, following the browsing session of individual Chrome users, cackling with evil delight.
  - tpxl 4y ago
    We know that Facebook employees stalked people using the 'tracking' info. We know police stalked people with their info. We know people with access to PRISM data used it to stalk people. The CEO? No. A disgruntled ex? Yes.
fyvhbhn 4y ago
No, it doesn't solve the problem, because personal data processing doesn't only happen using cookies
_flux 4y ago
Temporary Containers also solve this problem (as long as you don't open things outside temporary containers), while also isolating tabs from other cookies.
Semaphor 4y ago
I respect your, and others’, opinion about not caring about tracking. But this extension is not named "i-dont-care-about-tracking", but instead misleading people into thinking it’s only about cookies when it’s not. It accepts all and any tracking, which can be far more advanced than just simple cookies. Again, anyone can use this, I really don’t care, but the original author is essentially doing the work of adtech companies (not really surprising that they sold out their users in that context) by lying about the extension.

by Liquix 4y ago

ThunderSizzle 4y ago

Isn't uMatrix just as good, since it blocks non-first party cookies by default?

karaterobot 4y ago
I thought the goal of IDCAC was to get rid of those annoying cookie consent popups. It tries to block or hide the popup, but when cookies are required to use the site it automatically accepts them, assuming you will handle erasing unwanted cookies in some other way.
- happymellon 4y ago
  > when cookies are required to use the site it automatically accepts them This makes no sense. Cookies required for operation of a site are not covered by GDPR, so shouldn't be in a cookie consent form. If you use cookies for your shopping cart, then you do not need to ask permission to create a shopping cart cookie.
  - mmmmmbop 4y ago
    There are quite a few news websites that deny access to the site unless you agree to being tracked (e.g. [1]). Authorities in EU countries are split on the legality of that -- the Dutch data protection authority explicitly disallows such behavior [2], while German authorities are silently tolerating it [3]. In my opinion, this goes against the spirit and the letter of GDPR, but it seems that they are getting away with it for now. The matter hasn't been discussed by the European Court of Justice yet. In those cases, as a non-paying user, you essentially have the choice between accepting being tracked, or not viewing the site. IDCAC errs on the side of being able to view the site. [1] https://www.zeit.de/ https://www.zeit.de/ [2] https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten-toegankelijk-blijven-bij-weigeren-tracking-cookies https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe... [3] In the case of online raffles, a German court even explicitly allowed forcing users to agree to their data being used for advertising purposes if they want to participate in the raffle. https://openjur.de/u/2185336.html https://openjur.de/u/2185336.html
    - happymellon 4y ago
      Okay, that makes sense. Thank you for the information!
wartijn_ 4y ago
You don't need uMatrix to block all third party cookies, in both Firefox and Chromium that is a build in option. And I don't think that option is as good as IDCAC (or Consent-O-Matic [0]) + CookieAutoDelete. With those two add-ons even first party cookies are deleted, while you don't need to close banners all the time. [0] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
pavon 4y ago
uMatrix has been unmaintained for 2 years and has known vulnerabilities[1]. Time to move to another extension. [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...
- ThunderSizzle 4y ago
  I wish it would be fixed or forked if gorhill won't fix it. uMatrix's UI is easily the best I've used due to showing the white/black list as a matrix.
  - pavon 4y ago
    I know, I love uMatrix, and was sad to leave it. I've migrated to uBlock Origin, but it isn't the same even with dynamic filtering window opened. With uMatrix I had been taking the approach of denying all third-party resources by default and selectively allowing just the ones I need, and after the move largely ended up abandoning this approach. The different UI of uBO was part of this decision, but not the biggest factor. Over time it had gotten less and less workable even with uMatrix's great UI. I could no longer configure a site once and then expect it to work for any amount of time, as the rate at which new mandatory third-party dependencies were added to sites kept increasing. And I was visiting more websites as part of avoiding big sites like Amazon. In addition, uBO's CNAME unmasking meant that many resources that were considered first party by uMatrix, are treated as third party by uBO. This added to the burden of whitelisting, but also got me thinking about how fuzzy the first party / third party distinction was and that it was increasingly a poor proxy variable for what I was really trying to block (trackers mostly, and also some annoyances). I also use the Temporary Container extension in Firefox. In the end I decided that the default block lists of uBO combined with the isolation and discarding of persistent data provided by Temporary Containers was good enough for most browsing. I still use a whitelisting approach for my handful of permanent containers, and uBO's dynamic mode UI is good enough for that.
- fn-mote 4y ago
  Easy to say "move to another", but what offers comparable functionality? The vulnerability does not seem that serious to me... isn't it going to be pretty obvious if it gets exploited with this description? > An attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. When the extension crashes, users are left without protection until it is reloaded. So I'm going to start seeing a bunch of ads as my clue, right? [Not a drive-by:] > It requires that users become active, e.g. by clicking on a link. The article you linked has plenty of information in the comments, it's actually a good resource.

dnissley 4y ago

> IDCAC accepts cookies if there is no option to decline them. You don't see annoying popups anymore, but the cookies are still there tracking you. Yes. Because I don't care about cookies. This is not an anti-tracking extension. I do not care about being tracked. I just want to stop being bombarded with cookie consent dialogs.

PaulHoule 4y ago
It is an unpopular opinion but I see GDPR as a watershed for user hostile design. It used to be that people involved with the web read Jacob Nielsen and Don’t Make Me Think, there was always pressure from the suits to distract users with BS but it was possible to hold the line. Once the GDPR came out, now it was required, even admirable, to distract users. Once that window was broken the car got stripped within 24 hours and now it is not unusual to have to dismiss 3 or more pop ups asking you to subscribe to an email newsletter.
- AlexandrB 4y ago
  I think you're partly right but it happened before GDPR - when advertisers decided to ignore the DNT[1] flag. If DNT was respected, GDPR cookie pop ups would be unnecessary. Unfortunately the modern web is not about user choice but about herding users like cattle to maximize "engagement". [1] https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track
  - Analemma_ 4y ago
    DNT was an "evil bit" non-solution that was stupid all the way from initial concept to execution to predictable industry response. We are better off without it.
    - TillE 4y ago
      Millions of websites are currently showing stupid cookie popups because they're mandated by law to obtain the user's consent. Why shouldn't that consent or lack thereof be expressed once in the browser UI instead? The only issue with DNT is that it wasn't mandated.

rektide 4y ago

I'd rather use an extension that tells companies no, that exercises the legal right to say no. Dont just accept then delete (with likely other downstream consequences such as re-logging in when you dont want), just opt out. Make it clear that privacy matters. Dont just hack (with multiple extensions), vote. Use a moral & good & fit to task (not apathetic & consenting extension) like Consent-o-matic[1] or Auto Cookie Optout[2]. Some people actively dont care. Dont do that. Care. Help. Be a positive influence. (Ed: wow, unpopular opinion, over something that costs people nothing to assist in!! -2 points! [1] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic [2] https://github.com/CodyMcCodington/AutoCookieOptout https://github.com/CodyMcCodington/AutoCookieOptout

Karunamon 4y ago
Time and drain on my patience is a cost. And it is a particularly awful trade in this case; both of those are extremely precious resources, one of which is nonrenewable. I do not care about cookies. Not one person on the Internet can demonstrate a concrete harm caused by the existence of advertiser cookies on their machine. If you want to spend time twiddling these knobs, more power to you. I've got things to do and I will gladly take the first option that erases the annoyance with a minimum of disruption.
- rektide 4y ago
  Sad that you have no spare effort-capacity whatsoever to make a choice for yourself like this, that you see yourself as at zero! Woe unto you. I dont get why this proclaimed unwillingness & lack of deciding leads you to pick the worse less defensive pick though. Why actively choose worse defense? I dont get your argumentation. Why is the worse dumber pick better for you, even if you dont feel convinced of the harm? Presented with a defensive & apathetic option, I don't see why you would still choose worse.
fortran77 4y ago
Then you care about cookies and this extension isn't for you.

deleted 4y ago

[deleted]

dizhn 4y ago

Another option is to use temporary containers for everything but the sites where you'd like to stay logged in.

perryizgr8 4y ago

> glaring flaw It's a feature not a flaw. See, I literally don't care about cookies. Deny them, allow them, whatever. Just don't bother me. That's exactly what the extension says and does.

chihuahua 4y ago
I agree with you on not caring at all about cookies. I've never understood the obsession with cookies and tracking. It seems that some people imagine Sundar Pichai sitting in his underground lair, following the browsing session of individual Chrome users, cackling with evil delight.
- tpxl 4y ago
  We know that Facebook employees stalked people using the 'tracking' info. We know police stalked people with their info. We know people with access to PRISM data used it to stalk people. The CEO? No. A disgruntled ex? Yes.

fyvhbhn 4y ago

No, it doesn't solve the problem, because personal data processing doesn't only happen using cookies

_flux 4y ago

Temporary Containers also solve this problem (as long as you don't open things outside temporary containers), while also isolating tabs from other cookies.

Semaphor 4y ago

I respect your, and others’, opinion about not caring about tracking. But this extension is not named "i-dont-care-about-tracking", but instead misleading people into thinking it’s only about cookies when it’s not. It accepts all and any tracking, which can be far more advanced than just simple cookies. Again, anyone can use this, I really don’t care, but the original author is essentially doing the work of adtech companies (not really surprising that they sold out their users in that context) by lying about the extension.