Hacker News Reader

Comment by idoubtit | Hacker News Reader

If you disallow third party cookies, then there is no use for this per website cookie jar. I've browsed the web like this for decades (since Opera 9, IIRC), and I had problems with at most 5 websites. YMMV, of course.

In my opinion, the simplest way to deal with cookies is to disallow third party, and to keep a white list of authorized websites. Cookies outside this white list should be deleted manually or automatically after a few hours. Extensions for this probably exist, but I've had bad experiences with extensions breaking or becoming intrusive, so I made my own where I hard coded the domains that I want to keep.

View on HN

https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... is great

Do you have issues with online payments? Things where you are transferred to some banking page to enter some two factor authentication or something like that.

That is one of the main issues I have when I do things like that, online payments fail in subtle ways and you aren't sure if the payment goes through or not.

I'm using FF almost exactly the same way as you describe, and have found the "Forget Me Not" addon to be great. Not allowing 3rd party cookies at all via browser settings, then the addon deletes all cookies for a specific site after closing the tab. Having a whitelist with 5-6 sites where I keep cookies forever.

Not my field of expertise, but I think it's also possible to over-estimate the protection this provides.

By the time sites are incorporating Google's own JavaScript code, tracking cookies can be stored as the site itself. Only a single action (look how much data is handed to the site via the URL of a search result, for example) and this site-specific cookie is just part of wider tracking.

But the technique does not scale. I.e., if more people start using this, then at some point companies may start blocking people.

Not if this becomes the default in browsers with meaningful market share.

Also, blocking people who use privacy settings can be legally iffy. Many sites are already on thin ice, telling people to use their browser settings if they don't want tracking cookies. Forcing tracking like that sounds like a recipe to receive an expensive lesson in GDPR.

You are right, but in practice it's a catch-22 situation. If companies start blocking privacy-aware browsers, then people will not use them, and they will not get market share.

Reply on news.ycombinator.com