3 ms·

I was talking about first-party cookies. Third-party cookies don’t have this ambiguity, they’re unequivocally bad.

• lolinder 3y ago
  Ah. Well, as I noted, it's not a problem with the design of cookies, it would be a problem with any storage mechanism that HTTP could possibly support. We want apps to be able to store session IDs so that I don't have to send my username/password with every single HTTP request. But as soon as I've given you permission to remember my session, you can use that to start tracking my movements on your site. There's no way around that. The only thing we could do is add a layer on top that prevents most sites from using cookies at all—make cookies a permission similar to camera and screen sharing. But first-party cookies aren't easy to use for abusive purposes and (as we all found out post-GDPR) popup fatigue is real, so I'm personally okay leaving them as is by default. Anyone who isn't comfortable with them can easily install extensions that implement more complex behaviors.