3 ms·

The problem with cookies (and “remember this device”) is that the same mechanism is used for remembering things that help the user (that we are logged in) and t

The problem with cookies (and “remember this device”) is that the same mechanism is used for remembering things that help the user (that we are logged in) and things that harm the user (ads, tracking). Edit: I’m talking about first-party cookies.

lolinder 3y ago
That's why we're in the process of phasing out third-party cookies but retaining first-party cookies. It's the closest dividing line we have for "good" and "bad" cookie applications: most good cookies are first-party (there are some use cases that are unfortunately caught in the crossfire) and most bad ones are third-party. Any time you give developers access to storage on the user device for any reason, you've given them a way to track users. First-party cookies are a decent compromise in my book: you can track users, but you can only track their movements on your own domain.
- two_handfuls 3y ago
  I was talking about first-party cookies. Third-party cookies don’t have this ambiguity, they’re unequivocally bad.
  - lolinder 3y ago
    Ah. Well, as I noted, it's not a problem with the design of cookies, it would be a problem with any storage mechanism that HTTP could possibly support. We want apps to be able to store session IDs so that I don't have to send my username/password with every single HTTP request. But as soon as I've given you permission to remember my session, you can use that to start tracking my movements on your site. There's no way around that. The only thing we could do is add a layer on top that prevents most sites from using cookies at all—make cookies a permission similar to camera and screen sharing. But first-party cookies aren't easy to use for abusive purposes and (as we all found out post-GDPR) popup fatigue is real, so I'm personally okay leaving them as is by default. Anyone who isn't comfortable with them can easily install extensions that implement more complex behaviors.

lolinder 3y ago

That's why we're in the process of phasing out third-party cookies but retaining first-party cookies. It's the closest dividing line we have for "good" and "bad" cookie applications: most good cookies are first-party (there are some use cases that are unfortunately caught in the crossfire) and most bad ones are third-party. Any time you give developers access to storage on the user device for any reason, you've given them a way to track users. First-party cookies are a decent compromise in my book: you can track users, but you can only track their movements on your own domain.

two_handfuls 3y ago
I was talking about first-party cookies. Third-party cookies don’t have this ambiguity, they’re unequivocally bad.
- lolinder 3y ago
  Ah. Well, as I noted, it's not a problem with the design of cookies, it would be a problem with any storage mechanism that HTTP could possibly support. We want apps to be able to store session IDs so that I don't have to send my username/password with every single HTTP request. But as soon as I've given you permission to remember my session, you can use that to start tracking my movements on your site. There's no way around that. The only thing we could do is add a layer on top that prevents most sites from using cookies at all—make cookies a permission similar to camera and screen sharing. But first-party cookies aren't easy to use for abusive purposes and (as we all found out post-GDPR) popup fatigue is real, so I'm personally okay leaving them as is by default. Anyone who isn't comfortable with them can easily install extensions that implement more complex behaviors.