A cookie (or any fingerprinting) shouldn't be necessary for a search query. Yes, the results might be "less relevant". That's fine, acceptable, and even _desired_.
That's irrelevant. Cookies are used for tons of things besides search personalization and "user tracking" (in the nefarious sense). Blocking all cookies is throwing the baby out with the bathwater.
Neither Firefox nor Safari have claimed we should block all cookies. They've committed to taking large steps towards blocking 3rd-party cookies.
I don't think Google is intentionally confusing that distinction, and I wouldn't accuse them of that. As much as I find their arguments on this subject disingenuous and distasteful, they haven't claimed anything on that scale.
However, whenever Google proposes a privacy/security change, HN has a habit of accidentally conflating their specific arguments with the broadest, most general terms. Debates about specific policies become debates about whether or not broad, sweeping statements are true: Statements like, "all cookies are bad", or "browser extensions should be able to do whatever they want."
Google's argument here isn't even really about cookies at all, it's about tracking and advertising in general. Google is arguing that whatever privacy improvements we add to browsers, we need to make sure that advertisers can still serve personalized ads that follow users around the web. They are proposing separate standards from Mozilla and Safari that they say would improve privacy while allowing them to continue their current business model.
The confusion between Safari's actual cookie policy and this fictional "get rid of all cookies" policy that no browser has proposed is adding a lot of noise to the discussion. I assume this confusion is accidental, but it has the potential to really derail conversations.
Why? Why can't I have the browser maintain an in-memory session that is reset if the browser instance dies? When I login, the browser creates an in-memory session that is used just as today for session identification purposes. The only issue would be that if the browser crashes, or I close that window/tab, I'll have to relogin, which I'm totally fine with.
Conceptually similar to using a private/incognito mode all the time?
Why can't I have the browser maintain an in-memory session that is reset if the browser instance dies?
But... you're describing 1st party cookies. You can already set Firefox to delete all cookies whenever the browser is closed. It's not just that this problem has a solution, the solution is already implemented and live today in every major browser.
It's also not 'conceptually' similar to private/incognito mode, it literally is private/incognito mode. Private mode is just Firefox storing all of your session/cookie data in RAM so that it will get deleted when the browser closes. The main difference is that private mode is more aggressive, because it includes downloads/history in the deleted session, and takes extra steps to make sure the data won't accidentally get cached even in temporary files.
The big reason browsers are getting more aggressive about 3rd-party cookies is that they can be used to track you across domains even during browsing sessions, so there's often a good reason to block known tracking cookies outright. Additionally, most ordinary users want cookies to persist between browser sessions, so to enable that behavior we have to be more creative about figuring out which cookies are harmful -- then we can remove them even for ordinary users. It turns out that blocking 3rd-party cookies can sometimes be a useful way to filter "good" and "bad" session data.
But if you don't fall into that category of user, and you're OK with needing to re-log into sites when you open the browser, then go wild. Switching to temporary cookies will definitely help with your privacy, and Firefox even includes ways for you to whitelist any sites where you do want cookies and localstorage to be persistent.
It greatly depends on what you do. For example, I have spent last hour reading HN, and visited dozens of different websites. None of them needed cookies at all, except HN itself (for user login).
A cookie could store the session id from a load balancer or app server, designed to beneficially route your return traffic back to the same warm appserver to reduce disk load times or whatnot. Blocking that cookie has no observable benefit/drawback to you, but possibly impacts the backend in a negative manner by triggering a fresh session on every visit/hit.
So, good for the user, who can't know what its session tracking cookie is used for, but bad for the server, who will have to come up with a better routing-and-whatnot scheme than relying on the user to willingly provide information they have a very real incentive not to provide.
What is your opinion on explicit whitelisting? I disabled all cookies by default and added sites to a white list as needed, and it turns out that most sites really don't use cookies for anything that's useful to the user.
Comments
Ah, what fantastic reporting. They don't bother to mention that cookies can be used for things other than ad-tracking....
A cookie (or any fingerprinting) shouldn't be necessary for a search query. Yes, the results might be "less relevant". That's fine, acceptable, and even _desired_.
That's irrelevant. Cookies are used for tons of things besides search personalization and "user tracking" (in the nefarious sense). Blocking all cookies is throwing the baby out with the bathwater.
Neither Firefox nor Safari have claimed we should block all cookies. They've committed to taking large steps towards blocking 3rd-party cookies.
I don't think Google is intentionally confusing that distinction, and I wouldn't accuse them of that. As much as I find their arguments on this subject disingenuous and distasteful, they haven't claimed anything on that scale.
However, whenever Google proposes a privacy/security change, HN has a habit of accidentally conflating their specific arguments with the broadest, most general terms. Debates about specific policies become debates about whether or not broad, sweeping statements are true: Statements like, "all cookies are bad", or "browser extensions should be able to do whatever they want."
Google's argument here isn't even really about cookies at all, it's about tracking and advertising in general. Google is arguing that whatever privacy improvements we add to browsers, we need to make sure that advertisers can still serve personalized ads that follow users around the web. They are proposing separate standards from Mozilla and Safari that they say would improve privacy while allowing them to continue their current business model.
The confusion between Safari's actual cookie policy and this fictional "get rid of all cookies" policy that no browser has proposed is adding a lot of noise to the discussion. I assume this confusion is accidental, but it has the potential to really derail conversations.
Blocking all third-party cookies would suit me just fine.
Well that's a very different case from blocking all cookies!
If you blocked all cookies, you can't establish a session on any sites at all. If can accept that,what's the problem with blocking them?
If you can accept that you won't be able to login, buy stuff, or save settings on websites, then I guess there is nothing wrong with blocking cookies.
Why? Why can't I have the browser maintain an in-memory session that is reset if the browser instance dies? When I login, the browser creates an in-memory session that is used just as today for session identification purposes. The only issue would be that if the browser crashes, or I close that window/tab, I'll have to relogin, which I'm totally fine with.
Conceptually similar to using a private/incognito mode all the time?
Every problem has a solution.
But... you're describing 1st party cookies. You can already set Firefox to delete all cookies whenever the browser is closed. It's not just that this problem has a solution, the solution is already implemented and live today in every major browser.
It's also not 'conceptually' similar to private/incognito mode, it literally is private/incognito mode. Private mode is just Firefox storing all of your session/cookie data in RAM so that it will get deleted when the browser closes. The main difference is that private mode is more aggressive, because it includes downloads/history in the deleted session, and takes extra steps to make sure the data won't accidentally get cached even in temporary files.
The big reason browsers are getting more aggressive about 3rd-party cookies is that they can be used to track you across domains even during browsing sessions, so there's often a good reason to block known tracking cookies outright. Additionally, most ordinary users want cookies to persist between browser sessions, so to enable that behavior we have to be more creative about figuring out which cookies are harmful -- then we can remove them even for ordinary users. It turns out that blocking 3rd-party cookies can sometimes be a useful way to filter "good" and "bad" session data.
But if you don't fall into that category of user, and you're OK with needing to re-log into sites when you open the browser, then go wild. Switching to temporary cookies will definitely help with your privacy, and Firefox even includes ways for you to whitelist any sites where you do want cookies and localstorage to be persistent.
Fair enough.
Except that some websites now refuse to let you see their content unless you explicitly let them set cookies first.
I discovered this because I use uMatrix and block first-party cookies by default.
Amen to this!
Exactly!
It greatly depends on what you do. For example, I have spent last hour reading HN, and visited dozens of different websites. None of them needed cookies at all, except HN itself (for user login).
A cookie could store the session id from a load balancer or app server, designed to beneficially route your return traffic back to the same warm appserver to reduce disk load times or whatnot. Blocking that cookie has no observable benefit/drawback to you, but possibly impacts the backend in a negative manner by triggering a fresh session on every visit/hit.
These two are not mutually exclusive. The exact same cookie used for logging can also be used to store your session id for internal routing.
So, good for the user, who can't know what its session tracking cookie is used for, but bad for the server, who will have to come up with a better routing-and-whatnot scheme than relying on the user to willingly provide information they have a very real incentive not to provide.
What is your opinion on explicit whitelisting? I disabled all cookies by default and added sites to a white list as needed, and it turns out that most sites really don't use cookies for anything that's useful to the user.