Show HN: WebSession, a Secure Replacement for Cookies • Hacker News Board

Re: Show HN: WebSession, a Secure Replacement for Cookies

#111

Post by mpeg » Tue, Oct 24, 2023, 11:08 PM UTC

spiderfarmer wrote: post #47

janosdebugs wrote: post #41

> Because WebSession is dedicated to session maintenance and nothing else, a client could theoretically reject all cookies on any supporting site, ideally skipping the jarring cookie banner experience. This has nothing to do with cookies, the banner is required if the site is processing data that is not just technically necessary. In this case the site needs to ask the user for consent or at least inform them of proc…

Still lots of sites have cookie banners because the legal department demands them, even though they are not needed for the cookies they use.

I think it’s often the opposite, sites have cookie banners that are actually useless because they’re still not compliant.

Often if it’s a custom cookie banner it will only have an “accept” button (no way to reject!) and usually with vague language like “ok”

Even where they do have the right language and a way to reject cookies, sometimes the site sets cookies ahead of the user actually accepting them.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#112

Post by maxloh » Wed, Oct 25, 2023, 10:39 AM UTC

paulgb wrote: post #101

maxloh wrote: post #96

Earlier quoted context omitted.

It is possible currently. Just attach an `beforeunload` listener which asks the server to invalidate the current session.

I just tried it (Chrome on Mac), and beforeunload is not called when I lock the machine. The MDN docs also don't suggest that it should be.

For the "invalidate session on screen lock" feature, it is possible to create close enough workarounds in today's JavaScript.

https://stackoverflow.com/questions/15959244/

Bottom line, you can simply listen to mouse move events and invalidate the current session on user inactivity.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#113

Post by janosdebugs » Thu, Oct 26, 2023, 6:17 AM UTC

mpeg wrote: post #111

spiderfarmer wrote: post #47

Earlier quoted context omitted.

Still lots of sites have cookie banners because the legal department demands them, even though they are not needed for the cookies they use.

I think it’s often the opposite, sites have cookie banners that are actually useless because they’re still not compliant. Often if it’s a custom cookie banner it will only have an “accept” button (no way to reject!) and usually with vague language like “ok” Even where they do have the right language and a way to reject cookies, sometimes the site sets cookies ahead of the user actually accepting them.

IANAl, but this would still be compliant if they use legitimate interest as a justification. In that case the user just needs to be informed and have the opinion to object via separate means.