Hacker News Reader

Comment by rohit89 | Hacker News Reader

Creepy. I wonder if a possible solution (for the tracking across sites part) is to make sure that each website can access only the cookies it creates. For example, chrome creates a seperate process for each tab and the process would have a lock on its cookies such that other processes can't access it. A VM for each process in a way.

View on HN

The cookie protocol already works this way, and has for as long as cookies have existed. The issue is that a website can load content from a third-party domain, and the historical cookie protocol implementation has historically treated those requests as cookie-able. (Hence "tracking pixels," third-party ad services and stats collection, etc.)

The demo mentions the privacy concerns of third-party cookies, but does not mention that there are significant positive uses for such cookies. In the demo, reference.com sets cookies for thesaurus.com and dictionary.com, which are different domains run by the same operator. Such cookies allow the operator to provide customized services across the domains. Third-party cookies allow for richer embedded-content experiences. Video is a great example of that.

The revenue sites can get from third-party cookied ad networks is significantly higher than from unpersonalized third-party ads. Large sites like HuffPo and NYT are able to sell a lot of their premium inventory directly, so a big reduction there is likely to disproportionately affect smaller sites.

I believe rohit89 means something else. Imagine you visit IMDB, which contains resources from doubleclick.net that set a doubleclick.net cookie. Next, surf to the WSJ which also has doubelclick.net content. Your browser could simply not send the doubleclick cookie because it knows that it came through IMDB and not through the WSJ.

In order to do this, a browser (or extension) would need to track through which sites a 3rd party cookie was set, and only send the 3rd party if you're on that same site again. Else it should just pretend there is no 3rd party cookie.

I'd definitely install an extension that would implement this process.

Yup, that's what I meant. Sandboxing on a per tab basis. To put it another way, each new tab you open is like a new incognito session.

I think disabling third-party cookies (via your browsers preference) would accomplish this (though it's no VM), with the added benefit of not needing to re-log in for each tab/window.

This doesn't, however, block all tracking scripts, as some may get your IP via an embedded 1x1 gif or other request. There's still the issues of super-cookies, or Flash cookies, or scripts that embed a unique image in your cache and then read it out, etc. So for this I recommend AdBlock or Ghostery.

Edit: Here's aseful link on this topic: http://samy.pl/evercookie/

Safari does this already, I believe. Certainly on iphone, not sure about on mac.

Reply on news.ycombinator.com