Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Shouldn't web browsers ask us before storing cookies?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#31

Post by userbinator »

hos234 wrote: post #3

It used to be an option in Firefox. You have to go dig around bugzilla to find the reasons they removed it - https://bugzilla.mozilla.org/show_bug.cgi?id=1249151 https://bugzilla.mozilla.org/show_bug.cgi?id=606655

...and this:

https://bugzilla.mozilla.org/show_bug.cgi?id=570366#c1

"This option isn't supported, last I checked"

What a reason. They decided to remove it because it "isn't supported"? So much for "open source" being better at "do what users want"... if you personally don't need that option, fine, don't use it. But don't go taking away things that a lot of others want.

I get extremely angry whenever I see discussions like that. You can read and even participate in them, but your opinion is ultimately useless because you're not part of some privileged group who makes all the decisions about what to do with Firefox. It's no better than proprietary software where your bug reports are similarly ignored, besides being possibly a little bit easier to patch.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#32

Post by fitzroy »

Instead of asking for each site, just allow first-party cookies and delete them by default when the last tab of that domain is closed. The user should be able to favorite cookies to keep indefinitely, with the rest being cleared on a user-defined schedule (onTabClose, 1 hour, 24 hours, 1 week, etc). There was a free Safari extension called Safari Cookies that handled the favoriting but it stopped working several years ago. https://sweetpproductions.com/safaricookies/index.htm

I'm surprised this isn't a standard feature built into browsers. Seems like it would be obvious to have a level of granularity between accept all first-party cookies and accept none.

Edit: to clarify, I don't think setting cookies is the issue (and not worth the UX hassle to ask everytime); the issue is storing the cookies for longer than the interaction persists. To me, it's analogous to someone remembering who you are during a conversation vs adding you to their rolodex and storing that info indefinitely.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#34

Post by EpicEng »

zrm wrote: post #17
tinus_hn wrote: post #10

Do you really want 120 questions for each site you open?

You don't need 120 separate questions, just a single list with all 120 cookies and their domains, with a checkbox next to each one and some "select/deselect all" buttons.

That literally almost no one knows how to use and clicks ok anyway.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#35

Post by ChrisSD »

jopsen wrote: post #20
_jomo wrote: post #12

I'd like to point out that GDPR compliant sites don't need to ask permission for strictly necessary cookies. I also recommend using Cookie AutoDelete for Chrome [0] or Firefox [1]. You can define a whitelist of websites where you actually need Cookies (because you want to stay logged in), and the rest will be forgotten when you close the tab. It even allows different rules in Firefox Containers. 0: https://chrome.goo…

> I'd like to point out that GDPR compliant sites don't need to ask permission for strictly necessary cookies. That's also my interpretation. If you use cookies for session state, authorization, then it's no problem. The problem is that every website decided that they needed to track users. Or that asking for permission would minimize liability.

Even with tracking you merely need a privacy policy in a place users can find. It's considered implied consent to continue using a site if the site makes a reasonable effort to make you aware that such a policy exists.

However, what counts as reasonable hasn't been explicitly defined. The UK government considers it fine to use a header that automatically disappears after awhile (i.e. no need to click "ok"). But other governments may view it differently so I can understand some large organisations being cautious.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#36

Post by SyneRyder »

fitzroy wrote: post #32

Instead of asking for each site, just allow first-party cookies and delete them by default when the last tab of that domain is closed. The user should be able to favorite cookies to keep indefinitely, with the rest being cleared on a user-defined schedule (onTabClose, 1 hour, 24 hours, 1 week, etc). There was a free Safari extension called Safari Cookies that handled the favoriting but it stopped working several year…

Microsoft Edge Beta has this. In Settings -> Site Permissions, you can disable "Allow sites to save cookies", but then add individual websites to the Allow list. There is also a Clear On Exit list you can add sites to.

I'm pretty sure Firefox & Chrome have similar functionality.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#37

Post by kbrosnan »

cheez wrote: post #18
proofofconcept wrote: post #15

As I remember it, this was an option you could enable in Netscape Navigator back in the dialup days. In practice it meant that every time you went to a new website you'd have to click ok on a dozen popup menus asking for permission to store each individual cookie before the page would load. I'm sure there are ways to make that process go a little more smoothly but in practice it's still probably something that most u…

Oh my god, you just triggered some horrifying memories of that popup. No, you definitely don't want the web browser to ask.

In the dial-up days I remember turning on ask to set cookies. It was fairly common to need to deny 10-20 cookie requests even back then. Now there are extensions to manage website trackers that deal with more than just cookies. Extensions are a ton better than having the user agree to each cookie that is sent.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#38

Post by jwagenet »

cheez wrote: post #18
proofofconcept wrote: post #15

As I remember it, this was an option you could enable in Netscape Navigator back in the dialup days. In practice it meant that every time you went to a new website you'd have to click ok on a dozen popup menus asking for permission to store each individual cookie before the page would load. I'm sure there are ways to make that process go a little more smoothly but in practice it's still probably something that most u…

Oh my god, you just triggered some horrifying memories of that popup. No, you definitely don't want the web browser to ask.

You don’t want the browser to ask because the large number of cookies is so normal.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#39

Post by zrm »

EpicEng wrote: post #34
zrm wrote: post #17

Earlier quoted context omitted.

You don't need 120 separate questions, just a single list with all 120 cookies and their domains, with a checkbox next to each one and some "select/deselect all" buttons.

That literally almost no one knows how to use and clicks ok anyway.

It's not possible to make an informed decision about whether to accept a particular cookie without first becoming informed. No UI can change that. But it can at least provide the option for the people who take the time.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#40

Post by snagglegaggle »

userbinator wrote: post #31
hos234 wrote: post #3

It used to be an option in Firefox. You have to go dig around bugzilla to find the reasons they removed it - https://bugzilla.mozilla.org/show_bug.cgi?id=1249151 https://bugzilla.mozilla.org/show_bug.cgi?id=606655

...and this: https://bugzilla.mozilla.org/show_bug.cgi?id=570366#c1 "This option isn't supported, last I checked" What a reason. They decided to remove it because it "isn't supported"? So much for "open source" being better at "do what users want"... if you personally don't need that option, fine, don't use it. But don't go taking away things that a lot of others want. I get extremely angry whenever I see discussions…

Look at https://bugzilla.mozilla.org/show_bug.cgi?id=1355407, where Mozilla is defending using the page visibility API to stop video playback for backgrounded tabs.

A user brings up the amusing parallel that Mozilla shouldn't block popups for the same reason they don't want to block the page visibility API.

Post reply on HN