Live data from Hacker News

Self-Destructing Cookies – add-on for Firefox

addons.mozilla.org

31–40 of 59 posts

Re: Self-Destructing Cookies – add-on for Firefox

#32

What looks to me as a counter-feature is that if I'm logged in to GMail, and want to stay logged-in, I have to whitelist the "google.com" cookies. Wouldn't that allow all the Adwords tracking cookies as well, across sites?

" Google uses cookies, like the PREF cookie, to help personalize ads on Google properties, like Google Search, particularly when you aren’t signed in to a Google account. We also use cookies for advertising we serve outside of Google. Our main advertising cookie is called ‘id’ and it is stored in browsers under the domain doubleclick.net. We use others with names such as _drt_, FLC, NID and exchange_uid." [1]

Wouldn't this mean that only doubleclick.net is used for advertisement tracking?

[1] http://www.google.com/intl/en-US/policies/technologies/types...

Re: Self-Destructing Cookies – add-on for Firefox

#34
Cookie handling doesn't need to be this complicated. A huge part of the solution would be if third-party cookies simply stopped working by default. Sure, there are a lot of big corporate interests preventing this from happening, but if you think about it there is really almost no legitimate use for them that benefits the users.

On a related note, Chrome has a setting that simply kills all the cookies when the browser is shut down. The price is having to log into everything all over again, but it's not that much of a hassle in exchange for a clean plate every morning.

Re: Self-Destructing Cookies – add-on for Firefox

#35
> 3rd party cookie prevention is easily defeated. Sign in to Google, for example. You are now the proud owner of a YouTube cookie. The videos you view will now be linked to your account.

I'm signed into Google almost all the time and YouTube still shows "Sign in." Re-checked right now.

Third party cookie protection seems to be working fine. It's Firefox 22 with accept third-party cookies set to never.

Re: Self-Destructing Cookies – add-on for Firefox

#36
post #30

I'm the author of that add-on. Maybe I can add to the discussion by outlining my motivation for writing SDC. I'm currently in the process of compiling the results of an automated crawl of thousands of popular sites that I did last month. I think that every www user should be aware of this: - The privacy model of browsers relies on the same-origin policy. The same origin policy is in practice routinely circumvented by…

Tracking by abusing the cache is a serious problem. I've written about it before: https://grepular.com/Preventing_Web_Tracking_via_the_Browser...

I simply turned off disk and memory caching in Firefox (details in link above) and have been running this way for nearly two years. Browsing the web with cache is not as efficient, but with my ~8Mbit Internet connection, practically, I don't really notice any difference.

To get around the tracking issues, ideally, browsers would cache content, but it would be keyed on the domain in the address bar as well as the url of the content being cached. Also, content should be wiped from the cache when you leave the site it is linked to, ie there are no more tabs with the site open.

Re: Self-Destructing Cookies – add-on for Firefox

#37

There's another nice cookie manager for Firefox called Cookie Monster: https://addons.mozilla.org/en-US/firefox/addon/cookie-monste... It allows you to maintain a white-list of sites that are allowed to set cookies and allows you to pick whether the cookies the site sets are persistent or discarded at the end of the current browser session.

Moreover, using Cookie Monster you can allow cookies for second level domain names. Meaning that if you navigate to mozilla.org, cookies for www.mozilla.org will be accepted — but cookies for adnetwork.com will not.

This feature makes many sites work which otherwise break with third party cookies disabled, while still discarding the majority of third party cookies.

Re: Self-Destructing Cookies – add-on for Firefox

#38
post #34

Cookie handling doesn't need to be this complicated. A huge part of the solution would be if third-party cookies simply stopped working by default. Sure, there are a lot of big corporate interests preventing this from happening, but if you think about it there is really almost no legitimate use for them that benefits the users. On a related note, Chrome has a setting that simply kills all the cookies when the browser…

Firefox has the same setting, the problem is that many of us don't want to restart the browser every morning. Using suspension, my browser sessions tend to last more than a month.

Re: Self-Destructing Cookies – add-on for Firefox

#39
post #37

There's another nice cookie manager for Firefox called Cookie Monster: https://addons.mozilla.org/en-US/firefox/addon/cookie-monste... It allows you to maintain a white-list of sites that are allowed to set cookies and allows you to pick whether the cookies the site sets are persistent or discarded at the end of the current browser session.

Moreover, using Cookie Monster you can allow cookies for second level domain names. Meaning that if you navigate to mozilla.org, cookies for www.mozilla.org will be accepted — but cookies for adnetwork.com will not. This feature makes many sites work which otherwise break with third party cookies disabled, while still discarding the majority of third party cookies.

Firefox has this feature now build in. Goto privacy -> custom settings -> cookies from thierdparty and change to sites i have visited.

Re: Self-Destructing Cookies – add-on for Firefox

#40

> 3rd party cookie prevention is easily defeated. Sign in to Google, for example. You are now the proud owner of a YouTube cookie. The videos you view will now be linked to your account. I'm signed into Google almost all the time and YouTube still shows "Sign in." Re-checked right now. Third party cookie protection seems to be working fine. It's Firefox 22 with accept third-party cookies set to never.

that was my favourite test case when i developed the add on. I'm on the road now, so I can't verify if they still do it. it might depend on you having a YouTube account linked to your Google account. The technique I'm referring to involves redirecting you across other domains, allowing them to set 1st party cookies, and then back. this happens in an instant and "feels" like a 3rd party cookie to the user, because he does not even realize this happened. the browser will treat it as a 1st party cookie however.
Post reply on HN