Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things not available when someone blocks all cookies

blog.tomayac.com

Post reply on HN
Print view View original

101–110 of 231 posts

Re: Things not available when someone blocks all cookies

#101

Post by sysmuird »

user3939382 wrote: post #65

I just want to take this opportunity to thank "adtech" and everyone working in it for making local storage way more complex than it otherwise needed to be because you couldn't/can't stop yourselves from abusing users.

I’m in adtech and we manage to do ads in a completely user respecting way within the retail space. We monetize on search traffic without user data, cookies, local storage. The only browser feature we leverage are click events and img tags.

Though I appreciate your frustration, your aggression is a little off target. :)

Re: Things not available when someone blocks all cookies

#103

Post by powerhour »

salawat wrote: post #28
AlexandrB wrote: post #11

Earlier quoted context omitted.

This feature is long overdue in both Android and iOS. The amount of location data being harvested is outrageous.

This is absolutely unacceptable. No. The solution to "software authors routinely collecting more info than they should" is not "accept the behavior as irredeemable, and just normalize it". The answer is "make ot way more visible to users when it is done, snd make it harder for software authors to do/maintain." Anything else is just a tacit acknowledgement and grant of legitimacy to the behavior in question.

Giving app developers bogus data would make it harder to use* and maintain, so that's a clear win, IMO.

* use as in use for the intended business purposes, not harder to write the code

Re: Things not available when someone blocks all cookies

#104

Post by MereInterest »

jefftk wrote: post #17

> All I am using is some innocent localStorage and IndexedDB to persist user settings like the values of the sliders or the chosen color scheme. When you turn off cookies you're telling the browser not to let sites persist information. Otherwise, whatever goals you had in disabling cookies would just be worked around through these other technologies.

Especially with single-page applications, I would love for there to be a way for a page to have either access to persistent store or network connections, but not both. A site could load all resources, then announce to the browser that it would like to have access to whatever it stored the previous time. The browser would grant access to the local information, and simultaneously take away access from ever initiating a network connection again. A newly loaded copy of the page would start in the same state, able to pull in new resources, but unable to read or write local information until it again gives up the right to exfiltrate.

It would be a one-way street that way. The page can take any network information with it into the private cave, but nothing from the cave may ever come out, nor may it even know if the cave is empty before taking that irreversible step.

Re: Things not available when someone blocks all cookies

#105

Post by pessimizer »

MetaWhirledPeas wrote: post #46
orev wrote: post #36

Earlier quoted context omitted.

“Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist. When people, laws, banners, etc. refer to cookies, they mean “any technology that stores information on the client side systems”. Whatever mechanism is used is irrelevant to the meaning/concept.

> “Cookies” is shorthand for “persistent storage” because nobody outside of web developers knows other methods exist Most people don't know what "cookies" means either. We shouldn't make the problem worse by giving them false information.

Or we could just recognize that for the general population, "cookies" are any client storage by a website, and for technical people, cookies are a subset of options for client storage by a website.

The public never needs to know the technical distinction because it is both

1) Arbitrary: "cookie" could just as well have been a general term for client storage, and

2) Insignificant: Virtually nothing the public is concerned about hinges on specifically how client data is stored, except for lawyers trying to get around cookie laws or to deceive through the text and UI of cookie consent pop-ups.

> We shouldn't make the problem worse by giving them false information.

So what I'm saying is that it's not a problem. It's very easy and accurate enough to tell users that they have to allow cookies in order to use some webpages offline. They can make all of the informed political decisions and personal decisions they need to make. I'd be happy to even further complicate the situation by referring to localstorage as the type of cookie that you'd need to make a lot of pages work offline.

edit: I mean, you can save your cookie in localstorage. For me, that makes it a superset, and the name "local storage" makes it clear that it's storing things where you are. If the public weren't calling all client storage cookies, I'd recommend that they start calling all client storage localstorage.

Re: Things not available when someone blocks all cookies

#106

Post by jefftk »

MereInterest wrote: post #99
jefftk wrote: post #71

Earlier quoted context omitted.

> what the heck is so important that folks need to cookie that can't be just tied to the session token in the backend? Storing information on the client makes your site a lot more transparent about what it's keeping. If I have various user preferences in local storage you can tell that's what I'm doing and why, but if I just cookie you with an opaque token you have no idea what I'm tracking with that on the server.

While this can help, it needs to be done alongside network traffic analysis. If you type your name/phone number/address into (for example) a resume template, and you see that information stored in the local client, you don't know whether that information is also stored on the server.

Not disagreeing! This is primarily useful for sites that are trying to make it easy for their users to determine what's happening behind the scenes.

Re: Things not available when someone blocks all cookies

#107

Post by user3939382 »

sysmuird wrote: post #101
user3939382 wrote: post #65

I just want to take this opportunity to thank "adtech" and everyone working in it for making local storage way more complex than it otherwise needed to be because you couldn't/can't stop yourselves from abusing users.

I’m in adtech and we manage to do ads in a completely user respecting way within the retail space. We monetize on search traffic without user data, cookies, local storage. The only browser feature we leverage are click events and img tags. Though I appreciate your frustration, your aggression is a little off target. :)

> The only browser feature we leverage are click events

Do the users want their click events fed into an advertising engine? Did you ask them? If you made this opt-in, how many would say, yes, please track my clicks in order to advertise to me? Even if its anonymized/aggregated.

A huge amount of advertising is enabled by tracking users against their will, exploiting the fact that many users aren't aware of what's going on, don't know how to stop it, or aren't as invested in their preference as the adtech companies are in their revenue. "A man is always right in his own eyes". If you're smart it's easy to justify this stuff to yourself because you're getting paid, but that doesn't make it right.

Re: Things not available when someone blocks all cookies

#109

Post by LeifCarrotson »

ape4 wrote: post #52
antiframe wrote: post #39

Earlier quoted context omitted.

They could call it "disable cookies and other persistent storage (more information)" with more information providing their reasoning why they are bundled in plain English. There is no reason the setting has to have a two word name with no description.

Just like Windows Control Panel has "Printers and Devices" - because I guess people don't think of printers as devices?

I'd guess it's more likely that there used to be a "Printers" control panel, when the main thing it controlled was the DB-25 parallel printer port on an ancient IBM-compatible PC, and later they added other devices to it. People accustomed to adjusting printer settings might scroll straight to "Printers" and be confused if it got renamed to "Devices." Even more nefariously, it's reasonable that there's some software out there that does a string comparison for "Printers" that ignores extra characters like " and Devices" which would be a reason not to rename it completely.

Similarly here, cookies have been around since Netscape in 1994. IndexedDB is as new as 2015, window.LocalStorage is from ~2010 IIRC. For backwards compatibility, it's totally reasonable to use "Cookies" or "Cookies and local storage", and expect that to extend to any new developments.

Re: Things not available when someone blocks all cookies

#110

Post by johndhi »

God bless this man for making this -- but you know what's CRAZY to me? That no one has done this before.

We all visit websites constantly and governments (particularly in EU) talk endlessly and vaguely about cookies and yet almost NO ONE really gets it. I work on this specific problem and it is SUCH a mess.

Post reply on HN