Comment by anon4 | Hacker News Reader

Comment by anon4 | Hacker News Reader

An easy (though sort of annoying) fix would be for the browser to only store cookies per-tab - so if I log in to site A in tab A, then open site B in tab B, the cookies set in tab A don't apply to tab B, which also means that if I open site A in tab B, I'll be asked to log in again; and also to delete any stored cookies when navigating away from the domain for which they were set, or when closing a tab, etc. This of course also applies to all other forms of local storage. A sort of a stronger version of the "delete all history when I close the browser" setting.

Now, I realise these will get very annoying very fast, so I suggest you could whitelist which domains can store things permanently and then only send them if the url in the location bar is from the domain which set them (because fuck iframes)... Of course iframes will need to work, so you'll also want to have whitelisting of cookies which can be used in an iframe from this or that domain.

All of which in the end has a pretty harsh setup for average users, but I'd like it.

That doesn't actually fix the problem. If you visit Facebook in your first tab, then navigate to another page from within the same tab, the new page can still use this exploit.

So you've just broken the internet in a pretty major way, but not actually fixed the problem (esp. considering a lot of people don't use tabs or use them very minimally)

If you navigate away from facebook, it will delete all facebook cookies in the tab. That's the idea.

Also, it doesn't break the internet - it doesn't tinker with IP or TCP or HTTP or anything. I'm also not suggesting that all browsers do this, it's obviously way too annoying for an ordinary user to put up with. I just want my browser to do it. I want to fix the internet for myself.

Well if it's a cookie problem, then what should be done is that third-party cookie policies should be rigorously enforced, then it doesn't even matter what tabs are open, your browser would never present a cookie when the site you're on is anything other than the site that gave you the cookie.

Typically browsers haven't been great with this sort of thing, and usually end up being tricked into accepting "first party cookies" from a site through which you are redirected (e.g. Google's login process, where when you click "login", you are redirected from accounts.google.com to youtube.com and eventually to your final destination, so that you have "first party cookies" with Youtube, despite never voluntarily going to the site. Paypal did a similar thing with Doubleclick some years ago, where you clicked a link, it took you to a page where you're redirected to Doubleclick, they give you a tracking cookie, then redirected to the page you wanted to go to).

I have an easier solution for you: Just log out of services after you used them.

So then you're a single-tasker?

Login to gmail, check messages, reply to messages, logout. Go see what's happening on twitter... login, scroll through timeline, send some tweets, logout. Go over to salesforce, update some customer records, look at chatter, logout. Jump over to kill some time on HN... login, look at replies to comments/discussions...

You get the picture. Nice idea in theory but immensely impractical for almost any standard user.

Nice idea in theory but immensely impractical for almost any standard user.

Yes, but less impractical than the solution that my parent poster suggested, which was my entire point.

I wonder how much that would affect advertising tracking?

Reply on news.ycombinator.com