Live data from Hacker News

Things not available when someone blocks all cookies

blog.tomayac.com

191–200 of 231 posts

Re: Things not available when someone blocks all cookies

#191
post #41

I often think that instead of completely blocking cookies, it would be better to accept them and then throw them away. Same with localStorage. Just store it temporarily.

"Delete cookies and site data when Firefox is closed"

Yes, this is the way. Only issue is needing to login to everything again on restart/reboot, but it's a small price to pay.

Re: Things not available when someone blocks all cookies

#192
post #41

I often think that instead of completely blocking cookies, it would be better to accept them and then throw them away. Same with localStorage. Just store it temporarily.

Well, I've reacted to the article with an "of course, the Google's browser breaks everything if you try to block tracking". There is absolutely no reason for letting the javascript know that you've blocked some functionality. It just adds new tracking. Anyway, the sensible thing to do is to store the values for the lifetime of the page. Simply throwing them away can be an option, but it's a bad default. Non ad based…

> absolutely no reason

An editor warning you that your work hasn’t been saved?

Re: Things not available when someone blocks all cookies

#193

I always use a wrapper around local/session storage[1] to avoid this problem. Then you have your app sync settings with storage, never read from it except during startup. It becomes impossible to implement basic UI features like remembering open panes, etc when storage is disabled though. With the current policies around cookies - no cross-domain reads, Safari's ITP - there is no real need to turn them off for privac…

Basic UI features shouldn't need storage. In-memory or in the URL is enough. If you put it in storage then it is actually a (cookie) session, with some sort of configuration - that's not "basic UI".

Sure, in-memory works until the page is refreshed. Storing data in the URL is an option, but also messy and cumbersome to manage especially with bookmarks. localStorage / sessionStorage is clean and dead simple, and it actually allows an app to be truly stateful, so it’s quite unfortunate that the trend is to avoid the “evils” of storing any kind of data on the client. What, should we go back to the days of session IDs and server-side storage for even the most trivial data?

Re: Things not available when someone blocks all cookies

#194

Earlier quoted context omitted.

> Aside from that, what the heck is so important that folks need to cookie that can't be just tied to the session token in the backend? literally any functionality that needs to persist state and you want to use offline and between reloads? See also Progressive Web Apps (PWAs).

You can store the state in the URL, can you not? That used to be done anyhow.

I think the poster is referring to things like "offline Google Docs editing that can survive a browser shutdown or crash" which would be... difficult... to cram into a URL ;)

Re: Things not available when someone blocks all cookies

#195
post #114
post #51

Earlier quoted context omitted.

I’ve been using Cookie AutoDelete for that purpose for the last few years. It works flawlessly for me and brings me comfort in knowing that I am only being tracked online by my browser fingerprint and IP. https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

One thing worth noting: at least when I installed it, the auto clean functionality (the bit that actually removes the cookie/etc data) is disabled by default. This means it needs configuration to actually do anything aside from manual cleaning.

The alternative would be that installing the extension immediately wipes all of your cookies, local storage, and other local data. Most users probably don't want this.

Re: Things not available when someone blocks all cookies

#196

Earlier quoted context omitted.

"Delete cookies and site data when Firefox is closed"

Yes, this is the way. Only issue is needing to login to everything again on restart/reboot, but it's a small price to pay.

There are extensions that will aggressively delete cookies while letting you maintain a whitelist.

Re: Things not available when someone blocks all cookies

#197
One thing that annoys me about firefox's total cookie protection is that I offer some 3rd party embeds. What I did on those is I set a cookie, and probed for its existance to check if the user has third party cookies disabled. Then if they do, it displays things for the case where it's not known whether or not the user is logged in to the service, rather than as if they're definitely not logged in.

This worked fine, but now that firefox just containerizes third party resources rather than actually blocking the cookies, so there's no longer a way to detect that the actual site cookies just aren't being delivered in a third party context, rather than not present without user agent sniffing.

Re: Things not available when someone blocks all cookies

#198

Earlier quoted context omitted.

Well, I've reacted to the article with an "of course, the Google's browser breaks everything if you try to block tracking". There is absolutely no reason for letting the javascript know that you've blocked some functionality. It just adds new tracking. Anyway, the sensible thing to do is to store the values for the lifetime of the page. Simply throwing them away can be an option, but it's a bad default. Non ad based…

> absolutely no reason An editor warning you that your work hasn’t been saved?

Or a page settings/preferences dialog reminding you that saving your settings isn't going to work. Sure maybe the user "should know that", but not everyone is totally in command of their own browser's settings.

Or a game warning you that your progress will be lost.

There must be tons of legit use cases.

Re: Things not available when someone blocks all cookies

#199
post #41

I often think that instead of completely blocking cookies, it would be better to accept them and then throw them away. Same with localStorage. Just store it temporarily.

Check out Forget Me Not - https://addons.mozilla.org/en-US/firefox/addon/forget_me_not...

Re: Things not available when someone blocks all cookies

#200

Earlier quoted context omitted.

> Aside from that, what the heck is so important that folks need to cookie that can't be just tied to the session token in the backend? literally any functionality that needs to persist state and you want to use offline and between reloads? See also Progressive Web Apps (PWAs).

You can store the state in the URL, can you not? That used to be done anyhow.

I really hope y'all are aware that URLs generally aren't treated as secret, but authenticated session state should be treated as secret.
Post reply on HN