Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Removes Cookie Control from Chrome

lauren.vortex.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Google Removes Cookie Control from Chrome

#51

Post by T-hawk »

Tichy wrote: post #28
thezilch wrote: post #14

Earlier quoted context omitted.

While I'm not familiar with which Firefox controls you are referencing, the following is a shot of the cookie+"X" and the impending modal for selecting 0..n cookies and site data to be allowed indefinitely or for this session alone: http://i.imgur.com/va1xW.png

Key thing is really to disallow third party cookies, as that (among other things) is what is being used to track you by all the advertisers, spammers, Facebookers and so on out there.

Problem with that is the surprisingly large number of legitimate sites that break without third-party cookies. Things like when verizon.com has an element from verizononline.com, which sets a login cookie that verizononline.com expects to read. "Shun brokenly-coded sites" is not an option for something as vital as paying my phone bill.

I'd love an option to accept third-party cookies but delete them on browser exit, while retaining legitimate first-party cookies as usual. Does any of the major browsers have that?

Re: Google Removes Cookie Control from Chrome

#52

Post by ck2 »

T-hawk wrote: post #51
Tichy wrote: post #28

Earlier quoted context omitted.

Key thing is really to disallow third party cookies, as that (among other things) is what is being used to track you by all the advertisers, spammers, Facebookers and so on out there.

Problem with that is the surprisingly large number of legitimate sites that break without third-party cookies. Things like when verizon.com has an element from verizononline.com, which sets a login cookie that verizononline.com expects to read. "Shun brokenly-coded sites" is not an option for something as vital as paying my phone bill. I'd love an option to accept third-party cookies but delete them on browser exit,…

An alternative to third party cookies for login sites is to do a fast forward redirect through the main site for the login and then back again to the destination.

If done properly the user will barely notice or care and it's certainly less invasive than forcing 3rd party cookies to be used.

Re: Google Removes Cookie Control from Chrome

#53

Post by stanleydrew »

lionhearted wrote: post #41
mtigas wrote: post #18

tldr: Author is referring to the ability to enable the "ask me every time a site wants to set a cookie" prompt ( a la Firefox). Looks like this has been disabled in the latest Chrome nightly. FUD, etc. However: In general, cookie controls are still entirely there , so I'm positive that specific feature is what they're referring to. I use an extensive cookie domain blocklist and that's all there and functional. (I've…

> I use an extensive cookie domain blocklist and that's all there and functional. Care to share a rough overview of sites you're blocking, and a little of your reasoning? I tried putting fairly restrictive settings on Firefox one time to see how browsing differed - I noted a lot of sites didn't work without explicit permissions, so that's sort of a hassle. Beyond that, is it privacy considerations? Do you work in a f…

I know you weren't asking me, but I have a similar setup. I block everything by default and only enable specific cookies when necessary for functionality. Same with javascript, which Chrome makes pretty easy. I don't have any specific reason except that it feels cleaner not to send a bunch of data over the wire that isn't really necessary.

Re: Google Removes Cookie Control from Chrome

#54

Post by stanleydrew »

ck2 wrote: post #10
thezilch wrote: post #8

Title here and there are a bit misleading. My hope is Lauren has simply missed the cookie icon, in his location bar. Running 7.0.536.2 (dev), in the cookie settings, I can set Chrome to "Block sites from setting any data." Now, upon browsing to a site attempting to set, in the URL (location) bar is a cookie with an "X" overlaid -- similar in style to the padlock with an "X" when an HTTPS URI is using an unsigned SSL…

What about third party cookie control which is important? I barely use chrome but I know firefox has a toggle for this.

There is a toggle to block all third party cookies by default in Chrome.

Re: Google Removes Cookie Control from Chrome

#55

Post by js2 »

Relatedly:

Ultimately, the problem is that blocking third-party cookies doesn't really buy you much (if any) privacy from folks who are motivated to track you. On the other hand, blocking third-party cookies does break some real use cases about federated identity and web sites that span more than one host name.

We decided to keep the option because it make some of our users happy, but we decided not to make it the default because we don't think the trade-off is advantageous for the majority of users.

If you'd like more information about this topic, you might be interested in reading this paper:

http://crypto.stanford.edu/safecache/sameorigin.pdf

From http://code.google.com/p/chromium/issues/detail?id=51031

Re: Google Removes Cookie Control from Chrome

#56

Post by stanleydrew »

dhess wrote: post #37
bradgessler wrote: post #29

Earlier quoted context omitted.

Cookie management is kind of a tin-foil hat feature that is already served by Incognito mode. For the more technically inclined that really care, there are switches to turn on cookie management (and no doubt third party extensions)

As far as I can determine, Incognito mode just creates a 2nd sandbox for cookies and history that's shared across all Incognito tabs/windows, and is only deleted once you close them all. Cookies you create in one Incognito tab or window are visible to all other Incognito tabs/windows, just as cookies created in plain tabs/windows are visible to all other plain tabs/windows. So if you go into Incognito mode and browse…

> what I'd really like is a Chrome extension like Firefox's CookieSafe, where I can block all cookies by default and then whitelist them back in on a site-by-site basis, but nothing like that exists at the moment.

Wait what? That functionality is built into Chrome, and you configure it in the same place that you toggle deletion of all cookies on exit. What you describe above is exactly how I browse in Chrome. No extension necessary.

Re: Google Removes Cookie Control from Chrome

#57

Post by uxp »

dhess wrote: post #37
bradgessler wrote: post #29

Earlier quoted context omitted.

Cookie management is kind of a tin-foil hat feature that is already served by Incognito mode. For the more technically inclined that really care, there are switches to turn on cookie management (and no doubt third party extensions)

As far as I can determine, Incognito mode just creates a 2nd sandbox for cookies and history that's shared across all Incognito tabs/windows, and is only deleted once you close them all. Cookies you create in one Incognito tab or window are visible to all other Incognito tabs/windows, just as cookies created in plain tabs/windows are visible to all other plain tabs/windows. So if you go into Incognito mode and browse…

As far as I can determine, Incognito mode just creates a 2nd sandbox for cookies and history that's shared across all Incognito tabs/windows, and is only deleted once you close them all. Cookies you create in one Incognito tab or window are visible to all other Incognito tabs/windows, just as cookies created in plain tabs/windows are visible to all other plain tabs/windows.

Not entirely. The basic test I performed involved me logging into a site with a standard window, then opening a new window and navigating to that site. In the new window, I was logged in, because my cookie was shared and the session could be re-activated. When I opened a new Incognito window and navigated to the same site and logged in, and then opened a new Incognito window to that same site, I was not logged in.

If I was to open a link in a new tab from the logged in Incognito tab, that new tab would inherit the session from the parent tab, but opening a new window or tab and manually navigating to that site forces the site to create a new session.

Similarly, if a malicious site was have some code that tried to steal my session (via iframe or similar), it could only do so in the same incognito tab I had an active session in. I'm not entirely sure if it could do so if the malicious site was opened from a parent tab that created the session, since I have not tested that, but I assume it can since the session was inherited, and thus shared between the two Incognito tabs.

tl;dr: Incognito tabs/windows just don't create a secondary shared storage cache, they'll create as many sandboxed caches as necessary, only taking existing cache's from their parents.

Re: Google Removes Cookie Control from Chrome

#58

Post by sesqu »

patio11 wrote: post #45
1337p337 wrote: post #38

Earlier quoted context omitted.

...Or a different browser. Seriously, though, Google is used to web development, where they control the software and the machines running it. A new version of GMail rolls out, and everyone gets it. Like in the case of Buzz, this isn't always good, but it makes developers' lives easier. But desktop applications are a different game. Almost any time you take control away from the user, it's bad. New version of the brow…

Users of b2c software are incapable of making decisions about their security, and should not be asked to.

An update procedures takes up noticeable amounts of CPU time and bandwidth. Automatic updates means your system slows down arbitrarily, often with no indication as to why. Users are able to make observations at the level of "since I installed software X, my computer doesn't work properly anymore" and interpret that as a virus infection.

Maybe they can't weigh the downsides of new and old versions, but they can weigh the downsides of now and later. Usually they go for later, which is a different problem.

Re: Google Removes Cookie Control from Chrome

#59

Post by mtigas »

lionhearted wrote: post #41
mtigas wrote: post #18

tldr: Author is referring to the ability to enable the "ask me every time a site wants to set a cookie" prompt ( a la Firefox). Looks like this has been disabled in the latest Chrome nightly. FUD, etc. However: In general, cookie controls are still entirely there , so I'm positive that specific feature is what they're referring to. I use an extensive cookie domain blocklist and that's all there and functional. (I've…

> I use an extensive cookie domain blocklist and that's all there and functional. Care to share a rough overview of sites you're blocking, and a little of your reasoning? I tried putting fairly restrictive settings on Firefox one time to see how browsing differed - I noted a lot of sites didn't work without explicit permissions, so that's sort of a hassle. Beyond that, is it privacy considerations? Do you work in a f…

I allow by default and simply block a (large) number of stat tracking domains and other dubious sites. (Generally I just compiled a large domain list of advertising / stat bug / malware domains, rather than actively patrol my cookies for domains I wanted to block.)

I’ve toyed with doing it the other way around (block by default, use whitelist) but generally it’s too much of a hassle.

This is all more or less a carryover from when I used to be really privacy paranoid — I don’t really have a valid reason outside of that these days. Force of habit. :)

Re: Google Removes Cookie Control from Chrome

#60

Post by joey_bananas »

stanleydrew wrote: post #53
lionhearted wrote: post #41

Earlier quoted context omitted.

> I use an extensive cookie domain blocklist and that's all there and functional. Care to share a rough overview of sites you're blocking, and a little of your reasoning? I tried putting fairly restrictive settings on Firefox one time to see how browsing differed - I noted a lot of sites didn't work without explicit permissions, so that's sort of a hassle. Beyond that, is it privacy considerations? Do you work in a f…

I know you weren't asking me, but I have a similar setup. I block everything by default and only enable specific cookies when necessary for functionality. Same with javascript, which Chrome makes pretty easy. I don't have any specific reason except that it feels cleaner not to send a bunch of data over the wire that isn't really necessary.

So, how do you do that then? Some extension I assume?
Post reply on HN