3 ms·

This is such an intrusion of privacy. I wish I could just disable cookies entirely but the usability of many webpages just goes down. I should not be punished f

by 404mm 2y ago

This is such an intrusion of privacy. I wish I could just disable cookies entirely but the usability of many webpages just goes down. I should not be punished for not wanting 3rd party trackers.

jrockway 2y ago
Before I get too alarmed someone would have to tell me how an adsite.com cookie is being sent to adsite.example.com. This workaround seems to let adsite.com profile me as well as example.com already can, but it loses the ability to correlate my activity across example2.com and example.com with a single cookie. (I guess ad providers have gotten good enough to not need cookies? Like they know my browser window size, installed fonts, GPU vendor and model, IP address, geolocation, header order, etc. so they don't even need cookies anymore to track my activity across the web? I suppose it was only a matter of time.)
- bongodongobob 2y ago
  Browser profiling has been a thing for at least a decade if I'm not mistaken.
  - jrockway 2y ago
    Makes sense. "I am session abcdef12345" always seemed significantly guaranteed to me, but in a world with ad blockers and third-party cookie restrictions, using heuristics is the only way forward. It's somewhat scary how much information our browsers leak to unknown parties. (I don't really take sides on this. I use an ad blocker and am very anti-ad, but am impressed when ad companies come up with tech to thwart them. The cat-and-mouse game is entertaining to read about.)
    - pas 2y ago
      it's more than enough. especially that the competition is also only using the same tech
- pas 2y ago
  cookie is for each site, but that's enough... sure, maybe no retargeting ads, but those were creepy anyways (and likely not more effective)
- lancesells 2y ago
  The correlation is happening through an API connection between adsite.com and example.com and not through cookies. So even if you block all third party cookies and scripts your activities are being tracked through the first party.
quesera 2y ago
I run all the time with first-party cookies disabled. Most of the web works. Anything that does not, and I care about, gets blessed. The only content I allow by default, even in low-security browser profiles, and even from first-party domains, are HTML, CSS, and images. I consider the occasional broken page to be a successful test of my configuration. If I care, I adjust permissions.
- Sophira 2y ago
  What do you use to enforce this? Is it something that's going to break with Manifest V3?
  - quesera 2y ago
    I use uMatrix. On Firefox, so no current concerns about MV3.

by 404mm 2y ago

This is such an intrusion of privacy. I wish I could just disable cookies entirely but the usability of many webpages just goes down. I should not be punished for not wanting 3rd party trackers.

jrockway 2y ago

Before I get too alarmed someone would have to tell me how an adsite.com cookie is being sent to adsite.example.com. This workaround seems to let adsite.com profile me as well as example.com already can, but it loses the ability to correlate my activity across example2.com and example.com with a single cookie. (I guess ad providers have gotten good enough to not need cookies? Like they know my browser window size, installed fonts, GPU vendor and model, IP address, geolocation, header order, etc. so they don't even need cookies anymore to track my activity across the web? I suppose it was only a matter of time.)

bongodongobob 2y ago
Browser profiling has been a thing for at least a decade if I'm not mistaken.
- jrockway 2y ago
  Makes sense. "I am session abcdef12345" always seemed significantly guaranteed to me, but in a world with ad blockers and third-party cookie restrictions, using heuristics is the only way forward. It's somewhat scary how much information our browsers leak to unknown parties. (I don't really take sides on this. I use an ad blocker and am very anti-ad, but am impressed when ad companies come up with tech to thwart them. The cat-and-mouse game is entertaining to read about.)
  - pas 2y ago
    it's more than enough. especially that the competition is also only using the same tech
pas 2y ago
cookie is for each site, but that's enough... sure, maybe no retargeting ads, but those were creepy anyways (and likely not more effective)
lancesells 2y ago
The correlation is happening through an API connection between adsite.com and example.com and not through cookies. So even if you block all third party cookies and scripts your activities are being tracked through the first party.

quesera 2y ago

I run all the time with first-party cookies disabled. Most of the web works. Anything that does not, and I care about, gets blessed. The only content I allow by default, even in low-security browser profiles, and even from first-party domains, are HTML, CSS, and images. I consider the occasional broken page to be a successful test of my configuration. If I care, I adjust permissions.

Sophira 2y ago
What do you use to enforce this? Is it something that's going to break with Manifest V3?
- quesera 2y ago
  I use uMatrix. On Firefox, so no current concerns about MV3.