4 ms·

Through all the discussions of privacy and online advertising, I don't think I've ever actually seen the focus put specifically on the fact that targeted advert

Through all the discussions of privacy and online advertising, I don't think I've ever actually seen the focus put specifically on the fact that targeted advertising online is really the problem. Websites could ship with advertising that mimics print ads - the same ad is shown to everyone and the ads are targeted based only on the overall content of the site and the general market that is likely to browse it. Advertising can absolutely still exist online, targeting should simply not be possible. That would mean losing a ton of functionality online as well, but it can be done. Get rid of cookies entirely and get rid of or at least minimize the number of headers that identify a browser and OS. Authentication would need to be handled differently for many sites, but that's a solvable problem.

squigz 2y ago
What's a session cookie, Alex?
- svieira 2y ago
  To put it another way for those who don't web-dev much. Getting rid of cookies completely _requires_ that any authenticated experience becomes an SPA (e. g. only works with JavaScript enabled). The sole alternative available today is to include the session identifier in the URL, which means the end user cannot share links safely and that anything that logs the URL logs the session key. Everything that browser makers are suggesting as a replacement for cookies also requires JS to function.
  - _heimdall 2y ago
    The hot take here, and one I'd be really interested to see proven wrong, is that we can't have cookies and privacy online. User authorization is a very specific use case. Cookies are a generic solution, if we only care about that one use case there is likely a solution that wouldn't open the door for the privacy-destroying tracking that we don't want. As far as SPAs go, without cookies SPAs could still have issues. User author tokens can be stored in local storage and included with all API requests, but that has its own security issues.
    - squigz 2y ago
      What is it about modern cookie implementations that make them more easily abused than whatever solution might be able to replace the current widespread usage of cookies for i.e., authorization and user settings?
      - _heimdall 2y ago
        User settings that live client-side only wouldn't be a problem. The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. Authorization is an interesting challenge without cookies, but I do expect it could be solved in a way that is specific to supporting authorization without adding back a general key/value store.
        squigz 2y ago
        > The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. That's not a challenge. That's a benefit. Anyway you didn't actually answer my question, so allow me: the answer is nothing. There is nothing about cookies that enable them to be abused more than any system that could take their place. Which is to say, the issue here isn't the technology, so a technical solution likely won't work without neutering the entire point of cookies. The idea of 'removing cookies entirely' over just making it illegal to collect and share private information is... a bit crazy.
  - deleted 2y ago
    [deleted]
  - raxxorraxor 2y ago
    We could also go back to basic auth. No idea how long browsers keep your login to be resend every time, but they do so as it seems. So you don't have to type in you login on every refresh at least. But yeah, any known convenience would die without any and all cookies.
1oooqooq 2y ago
That's called demographic targeting. you identify your advertising audience, match it with known audiences of content, and then go sponsor that content. it's already proved it is most cost effective and had higher sales conversion. but there are other factors at play. and everyone wants data. the entire system works now by denying publishers of any advertisement revenue by demographic targeting and forcing them to be the data extractors since they are the ones luring users in. Mozilla is also a victim of this. they had to implement all changes google ever asked of them, and now this is their meta allegiance pledge. expect meta to pick their tab soon.
Gud 2y ago
Even if you remove cookies, you can still be identified. Your browser is very, very leaky with the information it provides(probably by design, since all the major web browsers are in the pockets of the worlds largest ad distribution networks, one way or the other).
- _heimdall 2y ago
  That's actually why I included a note on removing or severely limiting headers sent like user-agent strings. There are occasional uses for those when there are actually client-specific differences, but those are few and far between outside the embedded space. Add it to the list of obvious examples where browser vendors are disingenuous. Saying they care about privacy while sending a long list of identifiable information is disingenuous at best.
account42 2y ago
Even without the targeting, advertising is still psychological manimpulation trying to get you to act in someone elses best interest instead of your own. Why would you allow that in your computer in any form?
- tzs 2y ago
  Your premise is wrong. Much advertising is trying to get you act in a way that is in both the advertiser's best interest and your best interest. For example the ads I receive in the mail from local grocery stores advertising items that are on sale. They often inform me that some item I was already planning to buy, but at another store, is available for cheaper at their store. I win by saving money on my groceries that week and they win be getting sales that they would have otherwise gone to a competing store. It's the competing store that loses.

squigz 2y ago

What's a session cookie, Alex?

svieira 2y ago
To put it another way for those who don't web-dev much. Getting rid of cookies completely _requires_ that any authenticated experience becomes an SPA (e. g. only works with JavaScript enabled). The sole alternative available today is to include the session identifier in the URL, which means the end user cannot share links safely and that anything that logs the URL logs the session key. Everything that browser makers are suggesting as a replacement for cookies also requires JS to function.
- _heimdall 2y ago
  The hot take here, and one I'd be really interested to see proven wrong, is that we can't have cookies and privacy online. User authorization is a very specific use case. Cookies are a generic solution, if we only care about that one use case there is likely a solution that wouldn't open the door for the privacy-destroying tracking that we don't want. As far as SPAs go, without cookies SPAs could still have issues. User author tokens can be stored in local storage and included with all API requests, but that has its own security issues.
  - squigz 2y ago
    What is it about modern cookie implementations that make them more easily abused than whatever solution might be able to replace the current widespread usage of cookies for i.e., authorization and user settings?
    - _heimdall 2y ago
      User settings that live client-side only wouldn't be a problem. The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. Authorization is an interesting challenge without cookies, but I do expect it could be solved in a way that is specific to supporting authorization without adding back a general key/value store.
      - squigz 2y ago
        > The challenge of cookies is how generic they are. Cookies can be used to store almost anything a server wants to store. That's not a challenge. That's a benefit. Anyway you didn't actually answer my question, so allow me: the answer is nothing. There is nothing about cookies that enable them to be abused more than any system that could take their place. Which is to say, the issue here isn't the technology, so a technical solution likely won't work without neutering the entire point of cookies. The idea of 'removing cookies entirely' over just making it illegal to collect and share private information is... a bit crazy.
- deleted 2y ago
  [deleted]
- raxxorraxor 2y ago
  We could also go back to basic auth. No idea how long browsers keep your login to be resend every time, but they do so as it seems. So you don't have to type in you login on every refresh at least. But yeah, any known convenience would die without any and all cookies.

1oooqooq 2y ago

That's called demographic targeting. you identify your advertising audience, match it with known audiences of content, and then go sponsor that content. it's already proved it is most cost effective and had higher sales conversion. but there are other factors at play. and everyone wants data. the entire system works now by denying publishers of any advertisement revenue by demographic targeting and forcing them to be the data extractors since they are the ones luring users in. Mozilla is also a victim of this. they had to implement all changes google ever asked of them, and now this is their meta allegiance pledge. expect meta to pick their tab soon.

Gud 2y ago

Even if you remove cookies, you can still be identified. Your browser is very, very leaky with the information it provides(probably by design, since all the major web browsers are in the pockets of the worlds largest ad distribution networks, one way or the other).

_heimdall 2y ago
That's actually why I included a note on removing or severely limiting headers sent like user-agent strings. There are occasional uses for those when there are actually client-specific differences, but those are few and far between outside the embedded space. Add it to the list of obvious examples where browser vendors are disingenuous. Saying they care about privacy while sending a long list of identifiable information is disingenuous at best.

account42 2y ago

Even without the targeting, advertising is still psychological manimpulation trying to get you to act in someone elses best interest instead of your own. Why would you allow that in your computer in any form?

tzs 2y ago
Your premise is wrong. Much advertising is trying to get you act in a way that is in both the advertiser's best interest and your best interest. For example the ads I receive in the mail from local grocery stores advertising items that are on sale. They often inform me that some item I was already planning to buy, but at another store, is available for cheaper at their store. I win by saving money on my groceries that week and they win be getting sales that they would have otherwise gone to a competing store. It's the competing store that loses.