Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things not available when someone blocks all cookies

blog.tomayac.com

Post reply on HN
Print view View original

71–80 of 231 posts

Re: Things not available when someone blocks all cookies

#71

Post by jefftk »

aliqot wrote: post #56
omgmajk wrote: post #37

Earlier quoted context omitted.

I assumed the same thing and was indeed happy when it turned out to be the better thing.

Quoted post unavailable.

> what the heck is so important that folks need to cookie that can't be just tied to the session token in the backend?

Storing information on the client makes your site a lot more transparent about what it's keeping. If I have various user preferences in local storage you can tell that's what I'm doing and why, but if I just cookie you with an opaque token you have no idea what I'm tracking with that on the server.

Re: Things not available when someone blocks all cookies

#72

Post by masukomi »

aliqot wrote: post #56
omgmajk wrote: post #37

Earlier quoted context omitted.

I assumed the same thing and was indeed happy when it turned out to be the better thing.

Quoted post unavailable.

> Aside from that, what the heck is so important that folks need to cookie that can't be just tied to the session token in the backend?

literally any functionality that needs to persist state and you want to use offline and between reloads? See also Progressive Web Apps (PWAs).

Re: Things not available when someone blocks all cookies

#73

Post by Bewelge »

user3939382 wrote: post #65

I just want to take this opportunity to thank "adtech" and everyone working in it for making local storage way more complex than it otherwise needed to be because you couldn't/can't stop yourselves from abusing users.

In what way is it more complex than it has to be?

I don't work in front-end but whenever I've used localstorage for personal projects it's as simple as getting/setting a javascript object with keys & values.

Re: Things not available when someone blocks all cookies

#74

Post by the_gipsy »

ricardobeat wrote: post #24

I always use a wrapper around local/session storage[1] to avoid this problem. Then you have your app sync settings with storage, never read from it except during startup. It becomes impossible to implement basic UI features like remembering open panes, etc when storage is disabled though. With the current policies around cookies - no cross-domain reads, Safari's ITP - there is no real need to turn them off for privac…

Basic UI features shouldn't need storage. In-memory or in the URL is enough. If you put it in storage then it is actually a (cookie) session, with some sort of configuration - that's not "basic UI".

Re: Things not available when someone blocks all cookies

#75

Post by [deleted] »

Bewelge wrote: post #73
user3939382 wrote: post #65

I just want to take this opportunity to thank "adtech" and everyone working in it for making local storage way more complex than it otherwise needed to be because you couldn't/can't stop yourselves from abusing users.

In what way is it more complex than it has to be? I don't work in front-end but whenever I've used localstorage for personal projects it's as simple as getting/setting a javascript object with keys & values.

[deleted]

Re: Things not available when someone blocks all cookies

#76

Post by the_gipsy »

sebazzz wrote: post #68

Weird to throw an exception when localStorage is not available. It is much more logical to have it undefined or null. Code working with localStorage is more likely to check whether it is available (“not falsey”) rather than trying to use it and fall back if it throws.

No, it's correct. Null checks are for checking that a browser API is supported, but they might be unavailable, like being blocked or full or whatever.

Re: Things not available when someone blocks all cookies

#77

Post by hnbad »

jefftk wrote: post #17

> All I am using is some innocent localStorage and IndexedDB to persist user settings like the values of the sliders or the chosen color scheme. When you turn off cookies you're telling the browser not to let sites persist information. Otherwise, whatever goals you had in disabling cookies would just be worked around through these other technologies.

I'd argue that being able to write to and read from storage for the lifetime of the session (i.e. until you close the tab) is not "persistence" in the sense that any privacy-conscious user cares about.

If anything, making these features break loudly enables sites to detect that they can't be used for persistence and allows them to find ways to circumvent that. Contrast this with cookies which are silently discarded if the server sends them anyway.

It's not at all surprising that Google's browser would chose a way to loudly break these features in a way that a) allows sites to detect that they're unavailable and b) discourages users from using this setting.

This reminds me of when third-party Android releases would add a way to fake sensor data (e.g. GPS) when denying permissions to apps so the apps wouldn't be able to lock out users unwilling to agree to those permissions. A feature that of course Google would never add to stock Android as it is important for their business model that apps can trust their tracking data to be genuine.

Re: Things not available when someone blocks all cookies

#78

Post by beebmam »

user3939382 wrote: post #65

I just want to take this opportunity to thank "adtech" and everyone working in it for making local storage way more complex than it otherwise needed to be because you couldn't/can't stop yourselves from abusing users.

A technology which leaves the door open for exploitation will certainly be exploited by someone. In a self-governing society, people would turn their backs on the most exploitable technology; in the actual world, I just don't see that happening.

Re: Things not available when someone blocks all cookies

#79

Post by hennell »

bmismyname wrote: post #63
cbsks wrote: post #51

Earlier quoted context omitted.

I’ve been using Cookie AutoDelete for that purpose for the last few years. It works flawlessly for me and brings me comfort in knowing that I am only being tracked online by my browser fingerprint and IP. https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Same, I absolutely love this extension. You can whitelist the websites you use frequently, and for everything else it's like a groundhog day every day. The cookie banners can be super annoying sometimes, but they are easily removed with uBlock Origin. I also frequently have to solve captchas, but it's not so bad. For example, every time I visit amazon.com to order toilet paper or whatever, it thinks I'm a bot, but at…

A bot with a bowel apparently.

Re: Things not available when someone blocks all cookies

#80

Post by Spivak »

moffkalast wrote: post #20
jefftk wrote: post #17

> All I am using is some innocent localStorage and IndexedDB to persist user settings like the values of the sliders or the chosen color scheme. When you turn off cookies you're telling the browser not to let sites persist information. Otherwise, whatever goals you had in disabling cookies would just be worked around through these other technologies.

Thing is though, it can be worked around as long as js is enabled. Client side fingerprinting plus server side data storage and you get the same functionality in a roundabout way.

I would actually love to see a demo of this used for comedic effect. "Unlogin, use your browser fingerprint as your password. We already, know who you are, why put up with the hassle of typing a password."
Post reply on HN