Hacker News Reader

Comment by paraschopra | Hacker News Reader

I just tested. Like cookies, it also obeys domain-only visibility. So, all hopes for cross-domain user tracking are still doomed. sigh

View on HN

I'm completely unconvinced that cross-domain local storage is even remotely a good idea. I can't think of any data I'd want to store in a clientside database that I would want other sites to be able to see/modify.

  So, all hopes for cross-domain user tracking are still doomed. sigh

Um, this is a good thing. I don't want the sites I visit to be communicating my use patterns to each other.

Actually, it wasn't a sarcasm. I do need cross-domain user tracking for perfectly legitmate reasons. Many of my users do A/B test where control is www.example.com and variation is www.example.org (for example) and the goal page lies on www.shoppingcart.com -- currently there is NO way I can track a user across these three domains (no, third party cookies don't work properly on Safari and Opera).

I am left to experiment with user fingerprinting md5(user-agent, http accept and screen resolution) but that is less than ideal situation.

If you don't need 100% reach, have a look at xauth source: http://github.com/xauth/xauth

They use a central domain and window.postMessage to make a secure but shared storage.

So, all hopes for cross-domain user tracking are still doomed. sigh

I would certainly hope so...

Why on earth would you imply that cross-domain user tracking is a good thing?

because it's a choice

Edit: I misread "is" as "could be". It's a good thing to have because it could be a good thing to use. It may be a bad thing to have enabled by default, but it's a bad thing to omit outright.

The potential for abuse is staggering. Yes, it would be good to have to benign purposes, but unless you trust everyone on the internet to act honorably, it's a terrible idea.

Then disable it by default, but don't leave it out altogether.

Can you give me an example of when it would ever be appropriate to turn something like that on?

whenever the user wants it

(to repliers)

</sarcasm>

This was one of the less obvious uses of sarcasm in recent memory.

It's entirely possible I'm wrong, but I'm hinging my decision largely on the location (hn, where invasive user tracking is synonymous with evil with nearly everyone) and the "sigh".

I don't think so... If it was sarcastic, it wouldn't really be worth mentioning, like saying <sarcasm>Oh great. Another car with airbags!</sarcasm>

Good point, people never post useless comments.

</sarcasm>

Reply on news.ycombinator.com