Hacker News Reader

What's exactly the difference between cookies and session identifiers exactly? There's no law requiring you to send kilobytes of cookies (news.ycombinator.com gets by with a 22-byte cookie). Of course the way HTTP cookies handle ambient authority is rather imperfect, but that can be solved within the system.

View on HN

The difference is who makes the decisions: session id is controlled by the client. cookies by the server.

FaceBook, Twitter etc. track you all over the internet with their cookies, even if you don't have an account with them, whenever a site puts up one of their icons for you to press "like".

With client controlled session identifies, uses would get to choose if they wanted that.

The reason YC gets by with 22 bytes is probably that they're not trying to turn the details of your life into their product.

Reply on news.ycombinator.com