Google Warns Against Blocking Cookies Entirely, Triggering Criticism

https://www.wsj.com/articles/google-warns-against-blocking-cookies-entirely-triggering-criticism-11566862905?mod=rsswn

by dominik • 7 years ago

43 34 7 years ago

QuercusMax3• 7 years ago

Ah, what fantastic reporting. They don't bother to mention that cookies can be used for things other than ad-tracking....

inetknght2• 7 years ago

A cookie (or any fingerprinting) shouldn't be necessary for a search query. Yes, the results might be "less relevant". That's fine, acceptable, and even _desired_.

QuercusMax3• 7 years ago

That's irrelevant. Cookies are used for tons of things besides search personalization and "user tracking" (in the nefarious sense). Blocking all cookies is throwing the baby out with the bathwater.

lidHanteyk2• 7 years ago

I recall PHK's humble proposal for replacing cookies. Instead of the server sending cookies to the browser, the browser sends an ED25519 key, a "Browser Identity", to the server. Anything that the server wishes to personalize for that identity can be encrypted with the identity's key. At the same time, the browser user is free to choose whichever identity they like, including a fresh/nonce identity.

SamReidHughes• 7 years ago

Oh, the intent is to share the key across devices, right?

lidHanteyk2• 7 years ago

Right. The server knows a user by their identity key, not necessarily by the device that the key is on. Since keys are lightweight, synchronizing them across devices is akin to managing metadata.

Further, servers are free to keep private information on identities, with the understanding that identities are so flimsy that any single identity profile is not worth data-mining. This won't prevent tracking from truly big players, like Google, AWS, or Cloudflare, but it greatly cuts down on their ability.

This reminds me of moot's concept of prismatic identity.

gtirloni• 7 years ago

https://varnish-cache.org/docs/trunk/phk/http20.html

zelon88• 7 years ago

Never trust anything from the client.

[1] https://research.kudelskisecurity.com/2017/10/04/defeating-e...

gerash3• 7 years ago

The propaganda machine that is WSJ. I'm glad that I don't pay $300 / year for that. Here is a quote from the article:

Cookies are small text files stored in internet browsers that let companies follow users around the internet, gathering information such as which sites they visit and what ads they view or click.

Compare that to the definition from Wikipedia:

An HTTP cookie (also called web cookie, Internet cookie, browser cookie, or simply cookie) is a small piece of data sent from a website and stored on the user's computer by the user's web browser while the user is browsing. Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user's browsing activity (including clicking particular buttons, logging in, or ...

dimator• 7 years ago

I don't see how the wsj quote is misleading or wrong.

It's a close enough approximation for laypersons reading a non-technical newspaper. It's also a definition that's more closely aligned with the article's subject.

gerash3• 7 years ago

I don't know about you but if I didn't know what Gluten was and an article simply defined it as "Gluten is a protein that causes diseases such as celiac disease" for its audience to further its argument I'd consider that misleading and wouldn't trust the author anymore.

kerng• 7 years ago

They both describe pretty identical things. The WSJ article describes in a more practical way what scenarios cookies (as defined on the Wikipedia's page you cited) enable.

So, in many ways WSJ did a superb job here in describing what the actual implications are.

gerash3• 7 years ago

See my comment above.

JMTQp8lwXL• 7 years ago

List of installed plugins, screen size, IP, and User-Agent are probably far more effective than cookies anyways.

kbos87• 7 years ago

Google wants to get out ahead of the shift in consumer sentiment on data privacy and ad targeting. No doubt they only have their own best interests in mind. They shouldn’t have a seat at the table when the legislation is being written.

mark_l_watson• 7 years ago

Does it really matter what Google wants?

I use laptops for coding and ML (one of my laptops has a 1070 GPU). I use Firefox with containers, one for each major site (Twitter, Google properties, HN, etc.). I only delete all cookies in Firefox about once a month - probably not nearly often enough, even using containers.

I do most of my web browsing on an iPad Pro and I delete all cookies on Safari very frequently.

I pay Google for Play Music, buy books and movies, and use GCP - that is enough revenue for them, so I feel like they still make money from me. Twitter makes money by showing me ads. Anyway, I feel just fine about frequently nuking cookies.

papaf• 7 years ago

I only delete all cookies in Firefox about once a month - probably not nearly often enough, even using containers.

I recommend Cookie auto delete if you haven't considered it before: https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

xg15• 7 years ago

Yes, because that is probably not the setup/workflow that the majority of internet users are using.

Also, I'm not sure how useful deleting cookies is today if the new cookie can immediately be re-linked with the old profile the moment you log into your Google account.

Google Warns Against Blocking Cookies Entirely, Triggering Criticism

Related Stories