Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We removed advertising cookies, here's what happened

blog.sentry.io

Post reply on HN
Print view View original

131–140 of 191 posts

Re: We removed advertising cookies, here's what happened

#131

Post by jefftk »

shkkmo wrote: post #127
mark_story wrote: post #121

Earlier quoted context omitted.

That's fair, not having a cookie could work for session, how would you handle CSRF protection on a login form without cookies?

Why would you ever use a cookies to store a CSRF token? A CSRF token is a per request value and that's not what cookies are designed for. Generally the CSRF token is a hidden value on the login form.

If you authenticate users only via Same-Site=Strict cookies you're protected against CSRF in modern browsers: a cross-site request won't have the auth cookie.

Re: We removed advertising cookies, here's what happened

#132

Post by shkkmo »

ogotai wrote: post #84
itsoktocry wrote: post #73

Earlier quoted context omitted.

So you didn't even read an article you describe as "clickbaity"? Maybe try reading it, there's a lot of "what happened" in there.

I judge the headline as clickbait as well, and skipped reading it because of it. Sounds like I made the right decision based on other comments. It (probably) could've easily said, in say one to ten words, what actually happened, in the headline, so that I could decide whether I wanted to read into the details or whether it didn't interest me at all. With the headline being "something happened" and you'll have to read…

If you skipped reading the article then don't comment on it.

Re: We removed advertising cookies, here's what happened

#133

Post by jefftk »

kyriakos wrote: post #128
mark_story wrote: post #104

Earlier quoted context omitted.

The sentrysid, sc, and sudo cookies are all login state cookies btw.

Still cookies though even if essential.

If they're essential for doing what the user wants, though, then (a) no one cares and (b) they don't need e-Privacy consent and so don't need a cookie banner.

Re: We removed advertising cookies, here's what happened

#134

Post by tensor »

yborg wrote: post #124
troupe wrote: post #85

> 42.7% of internet users worldwide use ad blockers. Given how many people I know that still type google into the google search bar, I find this number to be extraordinarily high.

This was the money shot here. If that many people are trying to get away from what you do, maybe you shouldn't be doing it.

I'm one of those extremely against ads people who use an adblocker all the time, or pay for services that allow me to in order to remove ads. That said, I still click on accept for those cookie dialogs.

I think it's entirely fair that someone track me on their own web property, or within their own application. Cross-site tracking is not wonderful, unless it's between a collection of related products from the same product suite. But overall I think it's a huge misstatement to say that people who are against ads are also rabid anti-track-anything people.

Within product tracking is both useful and important for helping companies improve their products. And often it's crucial for security, to detect attacks and the like.

Re: We removed advertising cookies, here's what happened

#135

Post by braiamp »

MuffinFlavored wrote: post #103
ThePowerOfFuet wrote: post #102

Earlier quoted context omitted.

> If you're running a complex modern site and decide to do away with cookie banners, you generally need to pair this with browser automation that crawls your site and verifies that you (and your dependencies) are in fact not setting any cookies. Correction: any cookies which are not technically required for the basic operation of the site (such as a shopping cart ID).

I'm out of the loop on the latest and greatest web technologies: if I'm a shopping cart website, how do I keep track of you as a user/session enough to identify you and pair you to the contents of your cart on my backend without a cookie? Cramming a sessionId into localStorage/sessionStorage seems kind of like the same thing? Am I missing somehting?

> how do I keep track of you as a user/session enough to identify you and pair you to the contents of your cart on my backend without a cookie?

That would fall on necessary cookies. If my cart is empty, you don't need to know what's in my cart.

Re: We removed advertising cookies, here's what happened

#136

Post by mrweasel »

madeofpalk wrote: post #24
block_dagger wrote: post #16

This article is too long and packed with marketing crap to wade through.

You're surprised an article about marketing is full of marketing stuff?

What many, including myself, wanted to hear is: See, tracking cookies does nothing. Instead what we got is an article that explains that companies do in fact not need cookies, they are plenty capable of tracking our reactions to advertising without them.

Then there are paragraphs like this one:

> We decided to rely on ad engagement retargeting (rather than traditional retargeting) on most of our ad channels which isn’t the same, but still gives us a semblance of a funnel. We tailored our ads that are focused on middle of funnel (MOF) and bottom of funnel (BOF) to this engaged audience.

Which for people like me is a big "WAT?" What does that even mean, what are consequences, why didn't they do this earlier? I am aware of "retargeting", which is really what I want companies to stop doing, I don't care if they do it without cookies.

But yes, this isn't for the technical or privacy focused crowd. This is for marketing people, about how they can adjust their workflows when Chrome starts blocking 3rd party cookies.

Re: We removed advertising cookies, here's what happened

#137

Post by giancarlostoro »

jefftk wrote: post #117
mark_story wrote: post #115

Earlier quoted context omitted.

I believe that knowing whether or not you are logged would be part of the strictly necessary.

The way most sites do this is that absence of a cookie indicates not logged in; any reason this wouldn't work here?

It might also just be done by whatever underlying web framework they use without them realizing. Like maybe a call to a method that checks if you are authenticated creates those cookies deep in some library they have less control / ownership of. Just taking a guess.

Re: We removed advertising cookies, here's what happened

#139

Post by araes »

The most interesting part of this article personally was "Google's getting rid of cookies". Wait, what? How is this the first time I've heard of this?

Apparently the move is already delayed until Q2 2024 (lots of pushback at the office) [1] However, it's still difficult to believe. Must be an utter nightmare for people who built their entire business stack on cookies.

[1] https://techcrunch.com/2022/07/27/google-delays-move-away-fr...

Re: We removed advertising cookies, here's what happened

#140

Post by the_mitsuhiko »

jefftk wrote: post #119
the_mitsuhiko wrote: post #107

Earlier quoted context omitted.

You're right that fighting these cookies is not trivial and automation helps a lot. The remaining cookies are functional ones which are needed to use the sandbox for instance. That the changelog sets cookies is a known issue that will be resolved once the changelog is moved off launchnotes.

Poking around a bit more, visiting https://sentry.io/auth/login/ but performing no action sets first-party cookies __stripe_mid, __stripe_sid, session, and sentry-sc. If I don't log in, but then visit other pages on the site those cookies are still sent. I don't see why it's necessary that that these cookies be set before I actually log into the page? Or, if it is necessary for a non-obvious reason, I don't see why t…

A lot of these cookies are used to prevent CSRF or tracking flow state (eg: redirect target for login) through SSO. I'm not sure about the behavior of the stripe one. Generally once you go to a login page I'm pretty sure you will log in :)
Post reply on HN