5 ms·

Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it. Block third party cookies by default,

Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it. Block third party cookies by default, delete other cookies on the last tab or window closed and prompt user to save cookies on a form submit ("do not delete cookies for this domain when leaving" type of prompt, for pages with logins, settings, etc). Also remove features that make easy fingerprinting possible, the site doesn't need to know every font I have installed, just have a "standard set" included with the browser, and use web fonts or whatever for other fonts.

quickthrower2 3y ago
The last thing a browser wants to do is break experience for older sites. If a site relies on 3rd party cookies for log in, it will no longer work on your browser. It makes your browser look shit. Same reason we allow unclosed tags, crossed tags, etc.
- pavlov 3y ago
  Browsers already detect login forms to offer autocompletion and password storage. Surely it wouldn’t be insurmountable to detect cookies being set after a login flow, and let users confirm that they want this login to persist.
- ajsnigrutin 3y ago
  We also had shockwave flash, blink tags, keygen tags for cert generation, etc., so yeah, we can change stuff if we need it. But since the biggest browser is owned by an ad company that earns money by tracking us, this will probably never happen. An alternative would be to have a cookie jar per domain.
- ssdspoimdsjvv 3y ago
  Is this really different from disabling JavaScript, which will also break the majority of sites?
- lloeki 3y ago
  Safari and Firefox block 3rd party cookies by default.
sauercrowd 3y ago
I've been thinking about the same thing - this feels like it deserves a native API, so we can get rid of all these dark patterns currently being employed.
- sergiomattei 3y ago
  It’s there. It’s “Do-Not-Track” and it sadly was never respected by the big platforms (and any developers, really). I’ve never seen a single case where setting the DNT header made a difference — which is dumb considering how infested the web is with privacy prompts… Server owners can track you with the data they collect, client side can have little control of that. I wonder if there’s a better way possible in the current iteration of the web platform, or if a substantial overhaul is necessary for privacy respecting services. Perhaps DNT would’ve been more effective if it was written in law? To gather user information for marketing purposes, you must respect this header. But then, how’d you enforce that… other problems: if browsers always set DNT to true by default, then the whole effort is pointless, because nobody will opt-in. This is ideal, but marketers will definitely not like that idea. Thinking out loud here. EDIT: found an interesting HN thread from 2017 https://news.ycombinator.com/item?id=14377877 https://news.ycombinator.com/item?id=14377877
  - tourmalinetaco 3y ago
    > I wonder if there’s a better way possible in the current iteration of the web platform, or if a substantial overhaul is necessary for privacy respecting services Web browsers taking the reigns is the best option we have. Adblock + anti-fingerprinting + cookie jars/cookies being deleted by default are all necessities in the modern day. Ideally, moving people to more privacy conscious choices (i.e. not Google/Microsoft) are great steps to reducing the power of the Internet surveillance capitalism machine.
davedx 3y ago
Because the most popular browser is made by an AdTech company
- arendtio 3y ago
  To be fair, I think it was Microsoft who killed the DNT header by enabling it by default.
  - Yizahi 3y ago
    [flagged]
    - arendtio 3y ago
      The 'general victim blaming' feels weird in contexts when there are at least three parties involved (MS, Google, End-Users + X)(NATO, Ukraine, Russia). And how would you call it, when you compare a technological detail like the default setting of a HTTP header with a war where thousands of humans die? Hyperbole? Metaphorical exaggeration? I think that is not a good base for a constructive discussion.
      - Yizahi 3y ago
        A literal cartel or corporations expected to prey on the individual humans betting on the gaps in our psychology. A different corporation has bridged these gaps simply by saying out loud what individual humans actually want, working as a simple re-transmitter of human thoughts. And cartel said that "oh, since we can't win easily now, then you are at fault now" (and not the cartel who blackmailed the world in the first place). Same happened with Ruzzia. They wanted an easy win (to re-capture everything up to west Berlin again), and because of their blaickmail were quickly denied most of those easy wins, when their prey has hidden under NATO protection. They finally tried to capture whatever remained and when encountering resistance they blamed NATO. Basically every powerful sociopath, be is Ruzzia or ad-tech corpo, want to have absolute freedom of taking what they want. And any attempt to deny them something is considered a fault of the defending party.
WesolyKubeczek 3y ago
> Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it. We had Do-Not-Track header once. Id did not play out very well.
- angio 3y ago
  Sometimes I wish GDPR included a clause stating that presence of the Do-Not-Track header equals to the user not giving consent.
  - vjk800 3y ago
    Has this been tried in any courts? It could be argued that this is the case.
  - denton-scratch 3y ago
    Cookie-consent != tracking consent.
    - WesolyKubeczek 3y ago
      Cookie consent also predates GDPR.
  - atvcatole 3y ago
    How would that change anything? DNT = no consent, no DNT = no consent
yason 3y ago
I might be wrong but I think the EU regulation that forced these cookie acceptance forms―I can't remember if it was GDPR or some earlier directive―specifically required that the consent submission may not be automated so that the browser can be configured to accept everything. It may have had good intentions as entities such as Microsoft would just set their browsers to default to accept all cookies anyway and a marginal group of people would know how to turn it off and even they couldn't still be sure if a proprietary browser still accepts and sends cookies without just telling the user. So as usual the good intentions have turned into a cat-and-mouse game in the technical, grassroot realm. There are browser extensions that will just kill these consent dialogs automatically and websites try (luckily, not very hard so far), to work around the kill scripts. Everybody suffers.
- ajsnigrutin 3y ago
  > I think the EU regulation that forced these cookie acceptance forms Yep, i'm just not sure if it was general incompetence or just plain lobbying by third parties to do so.
  - operator-name 3y ago
    The EU regulation enforced _asking users for permission before being tracked_ for non legitimate interests. There is new regulation in progress that mandates opting out to be as easy as opting in ("the Good"). None of this would be a problem if companies only used cookies for legitimate purposes.
- denton-scratch 3y ago
  > the EU regulation that forced these cookie acceptance forms No such regulation has ever existed in the EU.
  - Rygian 3y ago
    That's correct. The regulation is about providing consent to process personal data. Many people fail to see the difference.
charcircuit 3y ago
>why is this not handled through the browser instead of relying on individual web apps to do it. Websites want you to explicitly reject consent for using your data. There are many untrustworthy places on the internet, so trustworthy places want to explicitly ask because they don't want the user to reject consent to them just because they are being lumped with the other sites. Now if you had a browser setting that gave consent by default and allowed users to deny consent that is something that would reduce the need of sites constantly asking you for consent. But any attempt to automatically reject consent is just going to result in sites asking for consent via another channel. See what happened to the do not track header when you try and lump all sites together.
pantulis 3y ago
I think it makes sense to roll your own analytics stack using first party cookies, but OP went a little bit overboard by removing all tracking cookies altogether.
- JohnFen 3y ago
  The problem is that pool is getting increasingly poisoned. Websites are increasingly hosting third-party analytics and advertising tracker scripts on their own sites in order to evade people who are trying to avoid them. This is making it much less acceptable to allow first-party cookies and scripts.
  - xp84 3y ago
    Yeah, it seems like sites that offer content without a subscription keep trying to show ads (which nobody buys untargeted because they’d be a massive waste of money). It implies that the content needs to be paid for - and that’s why they’re not all just taking a polite “no” and giving up on it. And if you believe that Internet ads could be just as scattershot as the Bud Light, Coke, and Toyota spots on TV, consider how much of the Internet ad market is niche stuff you’d never see on TV ads because they couldn’t afford it. Consider every SaaS product: they don’t advertise on TV because their target customer is too niche. Probably 75% of ad dollars would simply not be there without targeting. People choose over and over again to get content for free, and then complain about it because everyone loves to complain. No one loves opening their wallet.
    - ajsnigrutin 3y ago
      So what? Literally billions of people get tracked and profiled so that some video creator can earn a bit more money... who cares. They can do it for less, or charge money directly if they think they've got what it takes. A few individuals lose a bit, while billions gain some privacy.
skylurk 3y ago
On mobile safari, private tabs isolate cookies from each other. Also, once you are in private mode, all links open in new private tabs. Close the tab, and the cookies are gone. I never turn private mode off. I wish firefox and chrome also worked this way.
- Kwpolska 3y ago
  My default browser on Android is Firefox Focus. No history, no tracking, cookies removed on close.
TheCoelacanth 3y ago
GDPR is not about cookies, it's about tracking. Browsers can (and do in the case of Firefox and other privacy respecting browsers) try to make it harder to track you, but it's not something they can just unilaterally turn on or off. Consent dialogs are about what sites do with the information they get about you, not just about what information they get.
justsomehnguy 3y ago
> why is this not handled through the browser Did you forgot what happened the last time 'the browser was handling it'? I would remind you: Internet Explorer, Do Not Track.
- eimrine 3y ago
  If the law has some stack overflows, can we really blame M$ for exploiting them? Dogs are never being controlled by their tales.
pornel 3y ago
We had P3P spec for it 20 years ago, even implemented in IE! And Google has been sending intentionally malformed P3P header to bypass it. Their trillion dollar business relies on users having difficulty stopping tracking.
- eternalban 3y ago
  TIL. Here is the relevant summary from the spec: https://www.w3.org/TR/P3P/#goals_and_capabs https://www.w3.org/TR/P3P/#goals_and_capabs (for amusement, google P3P and see what comes up first.)
jefftk 3y ago
1. Your proposal is not enough for EU privacy law, so you'd still see banners. First-party tracking is still tracking and you still need a banner if you're going to store any data on the client that is not "strictly necessary" for the user's request. 2. Your proposal gives a pretty crummy experience in cases where users do expect the site to store data on the client longer. For logins you're popping up a confusing banner, and for client-side only storage (shopping carts, preferences, work in progress) you're silently discarding people's work.
- jeremyjh 3y ago
  No consent is required to store cookies required for the site to function. Login cookies, shopping carts etc are fine. The only reason websites display these banners is because they want to track you, and they rely upon misunderstandings like you are propagating to whitewash the request.
  - warkdarrior 3y ago
    Sites can function just fine without storing my shopping carts locally.
    - jefftk 3y ago
      They don't have to store the whole contents of your cart locally, but they need to store at least a token on your machine so they can remember that this cart is yours.
  - jefftk 3y ago
    Login cookies, yes: by entering the username and password the user is requesting that you log them in. Shopping carts, sort of: if they don't check out immediately and you keep the item in their cart (which they may want but didn't explicitly request) you're in violation: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... Other things: it has to be "strictly necessary" which is a high bar and many things don't meet it. For example, implicitly learning your preferences from your behavior doesn't.
mazlix 3y ago
Lynx browser does this, for every website I choose which Set-Cookie headers I want to respect and which to ignore.
godelski 3y ago
> Also remove features that make easy fingerprinting possible Is this (reasonably) possible? If you ever do a graphics project you'll find that it is pretty difficult to get a pixel perfect render. Hence canvas fingerprinting[0]. (same happens for text rendering) The problem can come down to the silicon lottery as well as the browser[1]. If you render the same code on two different machines, with the same compiler and libraries, you won't get pixel perfect difference. And GPUs don't match CPUs, though can if you edit the FMA instructions. Usually the best way to ensure images are exactly the same is to compare between Macs because the hardware is very similar and similarly binned. So Macs tend to have lower fingerprints in general (to the best of my knowledge) Current canvas blockers tend to just return a value, but that can obviously be a fingerprint itself. So my question is if this is reasonably solved? I don't see it by being just the browser unless they can specifically just block a lot of that tracking. Which may require a big actor like Google or Apple to make a stand. (Note: not an expert, but have done a decent amount of visualization work) [0] https://privacycheck.sec.lrz.de/active/fp_c/fp_canvas.html https://privacycheck.sec.lrz.de/active/fp_c/fp_canvas.html [1] https://stackoverflow.com/questions/47696956/display-pixel-perfect-canvas-on-all-devices https://stackoverflow.com/questions/47696956/display-pixel-p...
Animats 3y ago
Firefox lets you set "strict tracking protection". The settings page warns you that "some sites may break". Some sites whine about this, usually using "Admiral" to check for cookie blocking. Most of those aren't worth visiting anyway. There's also Privacy Badger, from the EFF. This turned up that the "Who wants to be tracked" site is using "plausible.io" to track visitors.

quickthrower2 3y ago

The last thing a browser wants to do is break experience for older sites. If a site relies on 3rd party cookies for log in, it will no longer work on your browser. It makes your browser look shit. Same reason we allow unclosed tags, crossed tags, etc.

pavlov 3y ago
Browsers already detect login forms to offer autocompletion and password storage. Surely it wouldn’t be insurmountable to detect cookies being set after a login flow, and let users confirm that they want this login to persist.
ajsnigrutin 3y ago
We also had shockwave flash, blink tags, keygen tags for cert generation, etc., so yeah, we can change stuff if we need it. But since the biggest browser is owned by an ad company that earns money by tracking us, this will probably never happen. An alternative would be to have a cookie jar per domain.
ssdspoimdsjvv 3y ago
Is this really different from disabling JavaScript, which will also break the majority of sites?
lloeki 3y ago
Safari and Firefox block 3rd party cookies by default.

sauercrowd 3y ago

I've been thinking about the same thing - this feels like it deserves a native API, so we can get rid of all these dark patterns currently being employed.

sergiomattei 3y ago
It’s there. It’s “Do-Not-Track” and it sadly was never respected by the big platforms (and any developers, really). I’ve never seen a single case where setting the DNT header made a difference — which is dumb considering how infested the web is with privacy prompts… Server owners can track you with the data they collect, client side can have little control of that. I wonder if there’s a better way possible in the current iteration of the web platform, or if a substantial overhaul is necessary for privacy respecting services. Perhaps DNT would’ve been more effective if it was written in law? To gather user information for marketing purposes, you must respect this header. But then, how’d you enforce that… other problems: if browsers always set DNT to true by default, then the whole effort is pointless, because nobody will opt-in. This is ideal, but marketers will definitely not like that idea. Thinking out loud here. EDIT: found an interesting HN thread from 2017 https://news.ycombinator.com/item?id=14377877 https://news.ycombinator.com/item?id=14377877
- tourmalinetaco 3y ago
  > I wonder if there’s a better way possible in the current iteration of the web platform, or if a substantial overhaul is necessary for privacy respecting services Web browsers taking the reigns is the best option we have. Adblock + anti-fingerprinting + cookie jars/cookies being deleted by default are all necessities in the modern day. Ideally, moving people to more privacy conscious choices (i.e. not Google/Microsoft) are great steps to reducing the power of the Internet surveillance capitalism machine.

davedx 3y ago

Because the most popular browser is made by an AdTech company

arendtio 3y ago
To be fair, I think it was Microsoft who killed the DNT header by enabling it by default.
- Yizahi 3y ago
  [flagged]
  - arendtio 3y ago
    The 'general victim blaming' feels weird in contexts when there are at least three parties involved (MS, Google, End-Users + X)(NATO, Ukraine, Russia). And how would you call it, when you compare a technological detail like the default setting of a HTTP header with a war where thousands of humans die? Hyperbole? Metaphorical exaggeration? I think that is not a good base for a constructive discussion.
    - Yizahi 3y ago
      A literal cartel or corporations expected to prey on the individual humans betting on the gaps in our psychology. A different corporation has bridged these gaps simply by saying out loud what individual humans actually want, working as a simple re-transmitter of human thoughts. And cartel said that "oh, since we can't win easily now, then you are at fault now" (and not the cartel who blackmailed the world in the first place). Same happened with Ruzzia. They wanted an easy win (to re-capture everything up to west Berlin again), and because of their blaickmail were quickly denied most of those easy wins, when their prey has hidden under NATO protection. They finally tried to capture whatever remained and when encountering resistance they blamed NATO. Basically every powerful sociopath, be is Ruzzia or ad-tech corpo, want to have absolute freedom of taking what they want. And any attempt to deny them something is considered a fault of the defending party.

WesolyKubeczek 3y ago

> Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it. We had Do-Not-Track header once. Id did not play out very well.

angio 3y ago
Sometimes I wish GDPR included a clause stating that presence of the Do-Not-Track header equals to the user not giving consent.
- vjk800 3y ago
  Has this been tried in any courts? It could be argued that this is the case.
- denton-scratch 3y ago
  Cookie-consent != tracking consent.
  - WesolyKubeczek 3y ago
    Cookie consent also predates GDPR.
- atvcatole 3y ago
  How would that change anything? DNT = no consent, no DNT = no consent

yason 3y ago

I might be wrong but I think the EU regulation that forced these cookie acceptance forms―I can't remember if it was GDPR or some earlier directive―specifically required that the consent submission may not be automated so that the browser can be configured to accept everything. It may have had good intentions as entities such as Microsoft would just set their browsers to default to accept all cookies anyway and a marginal group of people would know how to turn it off and even they couldn't still be sure if a proprietary browser still accepts and sends cookies without just telling the user. So as usual the good intentions have turned into a cat-and-mouse game in the technical, grassroot realm. There are browser extensions that will just kill these consent dialogs automatically and websites try (luckily, not very hard so far), to work around the kill scripts. Everybody suffers.

ajsnigrutin 3y ago
> I think the EU regulation that forced these cookie acceptance forms Yep, i'm just not sure if it was general incompetence or just plain lobbying by third parties to do so.
- operator-name 3y ago
  The EU regulation enforced _asking users for permission before being tracked_ for non legitimate interests. There is new regulation in progress that mandates opting out to be as easy as opting in ("the Good"). None of this would be a problem if companies only used cookies for legitimate purposes.
denton-scratch 3y ago
> the EU regulation that forced these cookie acceptance forms No such regulation has ever existed in the EU.
- Rygian 3y ago
  That's correct. The regulation is about providing consent to process personal data. Many people fail to see the difference.

charcircuit 3y ago

>why is this not handled through the browser instead of relying on individual web apps to do it. Websites want you to explicitly reject consent for using your data. There are many untrustworthy places on the internet, so trustworthy places want to explicitly ask because they don't want the user to reject consent to them just because they are being lumped with the other sites. Now if you had a browser setting that gave consent by default and allowed users to deny consent that is something that would reduce the need of sites constantly asking you for consent. But any attempt to automatically reject consent is just going to result in sites asking for consent via another channel. See what happened to the do not track header when you try and lump all sites together.

pantulis 3y ago

I think it makes sense to roll your own analytics stack using first party cookies, but OP went a little bit overboard by removing all tracking cookies altogether.

JohnFen 3y ago
The problem is that pool is getting increasingly poisoned. Websites are increasingly hosting third-party analytics and advertising tracker scripts on their own sites in order to evade people who are trying to avoid them. This is making it much less acceptable to allow first-party cookies and scripts.
- xp84 3y ago
  Yeah, it seems like sites that offer content without a subscription keep trying to show ads (which nobody buys untargeted because they’d be a massive waste of money). It implies that the content needs to be paid for - and that’s why they’re not all just taking a polite “no” and giving up on it. And if you believe that Internet ads could be just as scattershot as the Bud Light, Coke, and Toyota spots on TV, consider how much of the Internet ad market is niche stuff you’d never see on TV ads because they couldn’t afford it. Consider every SaaS product: they don’t advertise on TV because their target customer is too niche. Probably 75% of ad dollars would simply not be there without targeting. People choose over and over again to get content for free, and then complain about it because everyone loves to complain. No one loves opening their wallet.
  - ajsnigrutin 3y ago
    So what? Literally billions of people get tracked and profiled so that some video creator can earn a bit more money... who cares. They can do it for less, or charge money directly if they think they've got what it takes. A few individuals lose a bit, while billions gain some privacy.

skylurk 3y ago

On mobile safari, private tabs isolate cookies from each other. Also, once you are in private mode, all links open in new private tabs. Close the tab, and the cookies are gone. I never turn private mode off. I wish firefox and chrome also worked this way.

Kwpolska 3y ago
My default browser on Android is Firefox Focus. No history, no tracking, cookies removed on close.

TheCoelacanth 3y ago

GDPR is not about cookies, it's about tracking. Browsers can (and do in the case of Firefox and other privacy respecting browsers) try to make it harder to track you, but it's not something they can just unilaterally turn on or off. Consent dialogs are about what sites do with the information they get about you, not just about what information they get.

justsomehnguy 3y ago

> why is this not handled through the browser Did you forgot what happened the last time 'the browser was handling it'? I would remind you: Internet Explorer, Do Not Track.

eimrine 3y ago
If the law has some stack overflows, can we really blame M$ for exploiting them? Dogs are never being controlled by their tales.

pornel 3y ago

We had P3P spec for it 20 years ago, even implemented in IE! And Google has been sending intentionally malformed P3P header to bypass it. Their trillion dollar business relies on users having difficulty stopping tracking.

eternalban 3y ago
TIL. Here is the relevant summary from the spec: https://www.w3.org/TR/P3P/#goals_and_capabs https://www.w3.org/TR/P3P/#goals_and_capabs (for amusement, google P3P and see what comes up first.)

jefftk 3y ago

1. Your proposal is not enough for EU privacy law, so you'd still see banners. First-party tracking is still tracking and you still need a banner if you're going to store any data on the client that is not "strictly necessary" for the user's request. 2. Your proposal gives a pretty crummy experience in cases where users do expect the site to store data on the client longer. For logins you're popping up a confusing banner, and for client-side only storage (shopping carts, preferences, work in progress) you're silently discarding people's work.

jeremyjh 3y ago
No consent is required to store cookies required for the site to function. Login cookies, shopping carts etc are fine. The only reason websites display these banners is because they want to track you, and they rely upon misunderstandings like you are propagating to whitewash the request.
- warkdarrior 3y ago
  Sites can function just fine without storing my shopping carts locally.
  - jefftk 3y ago
    They don't have to store the whole contents of your cart locally, but they need to store at least a token on your machine so they can remember that this cart is yours.
- jefftk 3y ago
  Login cookies, yes: by entering the username and password the user is requesting that you log them in. Shopping carts, sort of: if they don't check out immediately and you keep the item in their cart (which they may want but didn't explicitly request) you're in violation: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... Other things: it has to be "strictly necessary" which is a high bar and many things don't meet it. For example, implicitly learning your preferences from your behavior doesn't.

mazlix 3y ago

Lynx browser does this, for every website I choose which Set-Cookie headers I want to respect and which to ignore.

godelski 3y ago

> Also remove features that make easy fingerprinting possible Is this (reasonably) possible? If you ever do a graphics project you'll find that it is pretty difficult to get a pixel perfect render. Hence canvas fingerprinting[0]. (same happens for text rendering) The problem can come down to the silicon lottery as well as the browser[1]. If you render the same code on two different machines, with the same compiler and libraries, you won't get pixel perfect difference. And GPUs don't match CPUs, though can if you edit the FMA instructions. Usually the best way to ensure images are exactly the same is to compare between Macs because the hardware is very similar and similarly binned. So Macs tend to have lower fingerprints in general (to the best of my knowledge) Current canvas blockers tend to just return a value, but that can obviously be a fingerprint itself. So my question is if this is reasonably solved? I don't see it by being just the browser unless they can specifically just block a lot of that tracking. Which may require a big actor like Google or Apple to make a stand. (Note: not an expert, but have done a decent amount of visualization work) [0] https://privacycheck.sec.lrz.de/active/fp_c/fp_canvas.html https://privacycheck.sec.lrz.de/active/fp_c/fp_canvas.html [1] https://stackoverflow.com/questions/47696956/display-pixel-perfect-canvas-on-all-devices https://stackoverflow.com/questions/47696956/display-pixel-p...

Animats 3y ago

Firefox lets you set "strict tracking protection". The settings page warns you that "some sites may break". Some sites whine about this, usually using "Admiral" to check for cookie blocking. Most of those aren't worth visiting anyway. There's also Privacy Badger, from the EFF. This turned up that the "Who wants to be tracked" site is using "plausible.io" to track visitors.