Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things not available when someone blocks all cookies

blog.tomayac.com

Post reply on HN
Print view View original

21–30 of 231 posts

Re: Things not available when someone blocks all cookies

#21

Post by 0x0 »

moffkalast wrote: post #20
jefftk wrote: post #17

> All I am using is some innocent localStorage and IndexedDB to persist user settings like the values of the sliders or the chosen color scheme. When you turn off cookies you're telling the browser not to let sites persist information. Otherwise, whatever goals you had in disabling cookies would just be worked around through these other technologies.

Thing is though, it can be worked around as long as js is enabled. Client side fingerprinting plus server side data storage and you get the same functionality in a roundabout way.

So you get to share preferences with everyone else that matches your fingerprint :)

Re: Things not available when someone blocks all cookies

#22

Post by moffkalast »

0x0 wrote: post #21
moffkalast wrote: post #20

Earlier quoted context omitted.

Thing is though, it can be worked around as long as js is enabled. Client side fingerprinting plus server side data storage and you get the same functionality in a roundabout way.

So you get to share preferences with everyone else that matches your fingerprint :)

That's the punishment for blocking local storage. :P

Re: Things not available when someone blocks all cookies

#23

Post by treeman79 »

0x0 wrote: post #21
moffkalast wrote: post #20

Earlier quoted context omitted.

Thing is though, it can be worked around as long as js is enabled. Client side fingerprinting plus server side data storage and you get the same functionality in a roundabout way.

So you get to share preferences with everyone else that matches your fingerprint :)

/s Even better we could store login information this way. What could go wrong?

Re: Things not available when someone blocks all cookies

#24

Post by ricardobeat »

I always use a wrapper around local/session storage[1] to avoid this problem. Then you have your app sync settings with storage, never read from it except during startup.

It becomes impossible to implement basic UI features like remembering open panes, etc when storage is disabled though. With the current policies around cookies - no cross-domain reads, Safari's ITP - there is no real need to turn them off for privacy reasons, for the average user at least.

[1] https://www.npmjs.com/package/localstory

Re: Things not available when someone blocks all cookies

#26

Post by ricardobeat »

josephcsible wrote: post #2

What if browsers made it so when you turned off cookies, instead of not allowing anything to be written, they instead gave each page you visited its own fresh cookie jar that was cleared when you navigated away?

This is the exact use case for sessionStorage or a cookie with expires=0. But correct usage depends on the knowledge & goodwill of website authors.

For privacy purposes, Incognito mode achieves the same effect without any of the hassle. Maybe turning off cookies should not even be an option anymore?

Re: Things not available when someone blocks all cookies

#27

Post by ckemere »

I naively assumed from the headline that the author would complain about users blocking cookies. I was very pleasantly surprised to see a post written by someone who appreciates that some users will want to do this and is actively working to support delivering them a useful content experience!

Re: Things not available when someone blocks all cookies

#28

Post by salawat »

AlexandrB wrote: post #11
techdmn wrote: post #5

Earlier quoted context omitted.

Similar to suggestions that Android offer the option to provide fake location data to apps that require it without good reason: It's a fantastic idea and seems easy to implement, but might make it less painful for users to opt out of all the tracking that makes the internet so friendly to advertisers and other groups who would like to surveil your activity.

This feature is long overdue in both Android and iOS. The amount of location data being harvested is outrageous.

This is absolutely unacceptable. No.

The solution to "software authors routinely collecting more info than they should" is not "accept the behavior as irredeemable, and just normalize it".

The answer is "make ot way more visible to users when it is done, snd make it harder for software authors to do/maintain." Anything else is just a tacit acknowledgement and grant of legitimacy to the behavior in question.

Re: Things not available when someone blocks all cookies

#29

Post by userbinator »

josephcsible wrote: post #2

What if browsers made it so when you turned off cookies, instead of not allowing anything to be written, they instead gave each page you visited its own fresh cookie jar that was cleared when you navigated away?

Isn't that basically what a session cookie is?

Re: Things not available when someone blocks all cookies

#30

Post by clsec »

jeroenhd wrote: post #19
g_p wrote: post #7

Earlier quoted context omitted.

This is loosely what Firefox's temporary containers [0] extension does. Each tab (with options to control whether a tab spawned from a parent tab should inherit the cookie-jar context of the parent) gets its own temporary context. I don't recall whether it clears the jar on navigating away, but you can have that jar cleared when the tab is closed, and you can configure new jars when opening a new tab to a new site or…

How well does this extension work together with the Multi-Account Containers addon ( https://addons.mozilla.org/en-US/firefox/addon/multi-account... )?

I've been using both for quite some time now. They work very well together and I don't see myself browsing much without them.

edit: remove redundant "together"

Post reply on HN