I'm mostly against top-down regulations like this. They rarely solve the problem and make other problems. But HTTP cookies are a horrible hack mostly created t

I'm mostly against top-down regulations like this. They rarely solve the problem and make other problems. But HTTP cookies are a horrible hack mostly created to by-pass the problems of stateful sessions with a stateless protocol. HTTP needs fixing or perhaps something on top of it. The current state is a disgrace. It's not OK advertising groups track people's internet use around the world with 1x1 pixels and all those tricks. And never mind the evil Adobe tracking people with Flash, those are even worse and much harder to delete from your computer. There are just too many poorly implemented web services using ridiculous amounts of large cookies. People run into problems because of the 8KB HTTP header limits in Apache and 16KB in IIS. Also I've worked for a large dotcom using multiple J2EE technologies running out of cookies in IE6/7 (20 max) and losing sales as people couldn't add a check-out/basket cookie. Programming a cookie-based website preventing session hijacking is quite hard and even major sites had issues. How can you expect people less competents like mom-and-pops shops and banks to be secure? This problem needs a proper solution from standards and browser vendors. http://en.wikipedia.org/wiki/HTTP_cookie#Drawbacks_of_cookies http://en.wikipedia.org/wiki/HTTP_cookie#Drawbacks_of_cookie...