3 ms·

Cookies are not really about security, but privacy. Their tracking of your online habits are bad; how would that change with WebSessions?

denton-scratch 3y ago
From my reading of the article, WebSessions specifically doesn't do tracking. It's a replacement only for session cookies, not for tracking cookies. So with WebSessions for session maintenance, you can turn of cookies completely, if you want to avoid tracking. It looks pretty reasonable to me (except possibly the nonce-management bit). I can't be bothered to try and pick it apart, and anyway I'm no expert.
psd1 3y ago
I don't clear cookies because session cookies are useful. If cookies are never session cookies, then I can treat all cookies as useless.
- contravariant 3y ago
  Just clear all cookies after the session. That's what I do, I just need to make a couple of exceptions for the few webpages I want to remember me across multiple sessions.
  - psd1 3y ago
    Yeah, turning that on and setting the exceptions is on my to-do list...
    - contravariant 3y ago
      The extension CookieAutodelete makes it fairly painless, though you do need to remember configuring it for the webpages you actually want to stay logged in to (which may be fewer than you'd expect).
- chrismorgan 3y ago
  A proposal like this will never fully replace cookies: quite apart from inertia and largely-unmaintained systems, it’s much, much more complicated for servers to implement. Diffie-Hellman, CBOR, encryption, session nonces… now compare that to just generating a big random string and using that as a cookie value and as the session table primary key. The consequence is that—even if there’s a nice backwards-compatibility path and all the browsers implement the whole lot—major frameworks like Django or Ruby on Rails will implement it, but smaller things and roll-your-own things won’t, because they’ve already got something easier that works about as well.

denton-scratch 3y ago

From my reading of the article, WebSessions specifically doesn't do tracking. It's a replacement only for session cookies, not for tracking cookies. So with WebSessions for session maintenance, you can turn of cookies completely, if you want to avoid tracking. It looks pretty reasonable to me (except possibly the nonce-management bit). I can't be bothered to try and pick it apart, and anyway I'm no expert.

psd1 3y ago

I don't clear cookies because session cookies are useful. If cookies are never session cookies, then I can treat all cookies as useless.

contravariant 3y ago
Just clear all cookies after the session. That's what I do, I just need to make a couple of exceptions for the few webpages I want to remember me across multiple sessions.
- psd1 3y ago
  Yeah, turning that on and setting the exceptions is on my to-do list...
  - contravariant 3y ago
    The extension CookieAutodelete makes it fairly painless, though you do need to remember configuring it for the webpages you actually want to stay logged in to (which may be fewer than you'd expect).
chrismorgan 3y ago
A proposal like this will never fully replace cookies: quite apart from inertia and largely-unmaintained systems, it’s much, much more complicated for servers to implement. Diffie-Hellman, CBOR, encryption, session nonces… now compare that to just generating a big random string and using that as a cookie value and as the session table primary key. The consequence is that—even if there’s a nice backwards-compatibility path and all the browsers implement the whole lot—major frameworks like Django or Ruby on Rails will implement it, but smaller things and roll-your-own things won’t, because they’ve already got something easier that works about as well.