5 ms·

Isn't uMatrix just as good, since it blocks non-first party cookies by default?

karaterobot 4y ago
I thought the goal of IDCAC was to get rid of those annoying cookie consent popups. It tries to block or hide the popup, but when cookies are required to use the site it automatically accepts them, assuming you will handle erasing unwanted cookies in some other way.
- happymellon 4y ago
  > when cookies are required to use the site it automatically accepts them This makes no sense. Cookies required for operation of a site are not covered by GDPR, so shouldn't be in a cookie consent form. If you use cookies for your shopping cart, then you do not need to ask permission to create a shopping cart cookie.
  - mmmmmbop 4y ago
    There are quite a few news websites that deny access to the site unless you agree to being tracked (e.g. [1]). Authorities in EU countries are split on the legality of that -- the Dutch data protection authority explicitly disallows such behavior [2], while German authorities are silently tolerating it [3]. In my opinion, this goes against the spirit and the letter of GDPR, but it seems that they are getting away with it for now. The matter hasn't been discussed by the European Court of Justice yet. In those cases, as a non-paying user, you essentially have the choice between accepting being tracked, or not viewing the site. IDCAC errs on the side of being able to view the site. [1] https://www.zeit.de/ https://www.zeit.de/ [2] https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten-toegankelijk-blijven-bij-weigeren-tracking-cookies https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe... [3] In the case of online raffles, a German court even explicitly allowed forcing users to agree to their data being used for advertising purposes if they want to participate in the raffle. https://openjur.de/u/2185336.html https://openjur.de/u/2185336.html
    - happymellon 4y ago
      Okay, that makes sense. Thank you for the information!
wartijn_ 4y ago
You don't need uMatrix to block all third party cookies, in both Firefox and Chromium that is a build in option. And I don't think that option is as good as IDCAC (or Consent-O-Matic [0]) + CookieAutoDelete. With those two add-ons even first party cookies are deleted, while you don't need to close banners all the time. [0] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
pavon 4y ago
uMatrix has been unmaintained for 2 years and has known vulnerabilities[1]. Time to move to another extension. [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...
- ThunderSizzle 4y ago
  I wish it would be fixed or forked if gorhill won't fix it. uMatrix's UI is easily the best I've used due to showing the white/black list as a matrix.
  - pavon 4y ago
    I know, I love uMatrix, and was sad to leave it. I've migrated to uBlock Origin, but it isn't the same even with dynamic filtering window opened. With uMatrix I had been taking the approach of denying all third-party resources by default and selectively allowing just the ones I need, and after the move largely ended up abandoning this approach. The different UI of uBO was part of this decision, but not the biggest factor. Over time it had gotten less and less workable even with uMatrix's great UI. I could no longer configure a site once and then expect it to work for any amount of time, as the rate at which new mandatory third-party dependencies were added to sites kept increasing. And I was visiting more websites as part of avoiding big sites like Amazon. In addition, uBO's CNAME unmasking meant that many resources that were considered first party by uMatrix, are treated as third party by uBO. This added to the burden of whitelisting, but also got me thinking about how fuzzy the first party / third party distinction was and that it was increasingly a poor proxy variable for what I was really trying to block (trackers mostly, and also some annoyances). I also use the Temporary Container extension in Firefox. In the end I decided that the default block lists of uBO combined with the isolation and discarding of persistent data provided by Temporary Containers was good enough for most browsing. I still use a whitelisting approach for my handful of permanent containers, and uBO's dynamic mode UI is good enough for that.
- fn-mote 4y ago
  Easy to say "move to another", but what offers comparable functionality? The vulnerability does not seem that serious to me... isn't it going to be pretty obvious if it gets exploited with this description? > An attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. When the extension crashes, users are left without protection until it is reloaded. So I'm going to start seeing a bunch of ads as my clue, right? [Not a drive-by:] > It requires that users become active, e.g. by clicking on a link. The article you linked has plenty of information in the comments, it's actually a good resource.

I thought the goal of IDCAC was to get rid of those annoying cookie consent popups. It tries to block or hide the popup, but when cookies are required to use the site it automatically accepts them, assuming you will handle erasing unwanted cookies in some other way.

happymellon 4y ago
> when cookies are required to use the site it automatically accepts them This makes no sense. Cookies required for operation of a site are not covered by GDPR, so shouldn't be in a cookie consent form. If you use cookies for your shopping cart, then you do not need to ask permission to create a shopping cart cookie.
- mmmmmbop 4y ago
  There are quite a few news websites that deny access to the site unless you agree to being tracked (e.g. [1]). Authorities in EU countries are split on the legality of that -- the Dutch data protection authority explicitly disallows such behavior [2], while German authorities are silently tolerating it [3]. In my opinion, this goes against the spirit and the letter of GDPR, but it seems that they are getting away with it for now. The matter hasn't been discussed by the European Court of Justice yet. In those cases, as a non-paying user, you essentially have the choice between accepting being tracked, or not viewing the site. IDCAC errs on the side of being able to view the site. [1] https://www.zeit.de/ https://www.zeit.de/ [2] https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten-toegankelijk-blijven-bij-weigeren-tracking-cookies https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe... [3] In the case of online raffles, a German court even explicitly allowed forcing users to agree to their data being used for advertising purposes if they want to participate in the raffle. https://openjur.de/u/2185336.html https://openjur.de/u/2185336.html
  - happymellon 4y ago
    Okay, that makes sense. Thank you for the information!

wartijn_ 4y ago

You don't need uMatrix to block all third party cookies, in both Firefox and Chromium that is a build in option. And I don't think that option is as good as IDCAC (or Consent-O-Matic [0]) + CookieAutoDelete. With those two add-ons even first party cookies are deleted, while you don't need to close banners all the time. [0] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic

pavon 4y ago

uMatrix has been unmaintained for 2 years and has known vulnerabilities[1]. Time to move to another extension. [1] https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vulnerability-here-is-a-workaround/ https://www.ghacks.net/2021/07/15/umatrix-has-an-unfixed-vul...

ThunderSizzle 4y ago
I wish it would be fixed or forked if gorhill won't fix it. uMatrix's UI is easily the best I've used due to showing the white/black list as a matrix.
- pavon 4y ago
  I know, I love uMatrix, and was sad to leave it. I've migrated to uBlock Origin, but it isn't the same even with dynamic filtering window opened. With uMatrix I had been taking the approach of denying all third-party resources by default and selectively allowing just the ones I need, and after the move largely ended up abandoning this approach. The different UI of uBO was part of this decision, but not the biggest factor. Over time it had gotten less and less workable even with uMatrix's great UI. I could no longer configure a site once and then expect it to work for any amount of time, as the rate at which new mandatory third-party dependencies were added to sites kept increasing. And I was visiting more websites as part of avoiding big sites like Amazon. In addition, uBO's CNAME unmasking meant that many resources that were considered first party by uMatrix, are treated as third party by uBO. This added to the burden of whitelisting, but also got me thinking about how fuzzy the first party / third party distinction was and that it was increasingly a poor proxy variable for what I was really trying to block (trackers mostly, and also some annoyances). I also use the Temporary Container extension in Firefox. In the end I decided that the default block lists of uBO combined with the isolation and discarding of persistent data provided by Temporary Containers was good enough for most browsing. I still use a whitelisting approach for my handful of permanent containers, and uBO's dynamic mode UI is good enough for that.
fn-mote 4y ago
Easy to say "move to another", but what offers comparable functionality? The vulnerability does not seem that serious to me... isn't it going to be pretty obvious if it gets exploited with this description? > An attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. When the extension crashes, users are left without protection until it is reloaded. So I'm going to start seeing a bunch of ads as my clue, right? [Not a drive-by:] > It requires that users become active, e.g. by clicking on a link. The article you linked has plenty of information in the comments, it's actually a good resource.