4 ms·

What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"

by ihsw 14y ago

derefr 14y ago
Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever. Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify you've given them the persistence they want before they let you through, and so forth. And even if they didn't, the request would still become one of those things naive users think you just "have to click OK to if you want the computer to keep doing the thing"--like Windows UAC elevation. On the other hand, giving users an equivalent option to a "hellban" on a website--the ability to make the website think it's persisting, but then it turns out not to be--has far fewer incentives. It only ends up being something you click for a reason, rather than a "mother may I" you have to just click all the time, and since getting off the blacklist wouldn't be exposed directly through the browser chrome, there'd be nowhere for a malicious site to "point an arrow."
- Nursie 14y ago
  "almost all cookies are friendly" I would really dispute this. Compare the number of sites visited to the number of ad-tracking cookies stored in the average browser, I think you'll find a very different answer.
  - derefr 14y ago
    If you consider ad-tracking cookies set by sites {A,B,C} to be read by ad-provider X all "one cookie", then the numbers balance out. (Which I would--tracking cookies, semantically, should be considered to be stored in the ad-provider's "bucket", as far as allowing them/purging them goes.
    - Nursie 14y ago
      If you consider ad-tracking cookies set by sites {A,B,C} to be read by ad-provider X all "one cookie" I'm not really sure what you mean by this. You said "almost all cookies are friendly" and I'm pretty sure you're wrong. Even if the numbers 'balance out' (which I doubt very much) that's still not close to 'almost all cookies are friendly'. The pro-cookie side of the privacy debate really needs to just admit there's a problem here, then we can work together to try and ensure privacy and functionality, without making reckless assumptions that somehow tracking is sanctioned or providing value to the user without even the courtesy of asking.
      - deleted 14y ago
        [deleted]
  - lowboy 14y ago
    How about "almost all first-party cookies are friendly"?

What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"

by ihsw 14y ago

What's wrong with a whitelist? "Example.com has requested 1KB/5MB of your disk so it can remember its place. [Allow]"

Because almost every site uses cookies, and almost all cookies are friendly (not "tracking cookies.") It would be a large decrease in user convenience to make them have to accept every cookie ever. Not only that, website owners are incentivized to actively subvert whitelist-based policies: shady sites would paint arrows up to the "Allow" button saying "click this to continue!", doing iframe AJAX ping-pong to verify you've given them the persistence they want before they let you through, and so forth. And even if they didn't, the request would still become one of those things naive users think you just "have to click OK to if you want the computer to keep doing the thing"--like Windows UAC elevation. On the other hand, giving users an equivalent option to a "hellban" on a website--the ability to make the website think it's persisting, but then it turns out not to be--has far fewer incentives. It only ends up being something you click for a reason, rather than a "mother may I" you have to just click all the time, and since getting off the blacklist wouldn't be exposed directly through the browser chrome, there'd be nowhere for a malicious site to "point an arrow."

Nursie 14y ago
"almost all cookies are friendly" I would really dispute this. Compare the number of sites visited to the number of ad-tracking cookies stored in the average browser, I think you'll find a very different answer.
- derefr 14y ago
  If you consider ad-tracking cookies set by sites {A,B,C} to be read by ad-provider X all "one cookie", then the numbers balance out. (Which I would--tracking cookies, semantically, should be considered to be stored in the ad-provider's "bucket", as far as allowing them/purging them goes.
  - Nursie 14y ago
    If you consider ad-tracking cookies set by sites {A,B,C} to be read by ad-provider X all "one cookie" I'm not really sure what you mean by this. You said "almost all cookies are friendly" and I'm pretty sure you're wrong. Even if the numbers 'balance out' (which I doubt very much) that's still not close to 'almost all cookies are friendly'. The pro-cookie side of the privacy debate really needs to just admit there's a problem here, then we can work together to try and ensure privacy and functionality, without making reckless assumptions that somehow tracking is sanctioned or providing value to the user without even the courtesy of asking.
    - deleted 14y ago
      [deleted]
- lowboy 14y ago
  How about "almost all first-party cookies are friendly"?