Firefox may soon reject Cookie prompts automatically

https://www.ghacks.net/2023/04/17/firefox-may-interact-with-cookie-prompts-automatically-soon/

by goplayoutside • 3 years ago

470 301 3 years ago

retrac• 3 years ago

I still smile sometimes at the pop-ups. I mean, you can try and store a cookie. I'm still gonna automatically delete it in a few minutes.

This never needed a legal solution in this form. Browsers should just not accept cookies, unless the user explicitly wants something stored on their device. That might have been better to legislate. Software on a user's device should not store or enable tracking by remote services, without disclaimer.

PeterisP• 3 years ago

Rejection is required to ensure that for functionally required cookies (e.g. session cookies when logged in) you refuse permission to use them for any other purpose, and that you refuse permission to use any of the many non-cookie tracking methods.

sonium• 3 years ago

AFAIK it’s not actually about cookies but a website tracking you by any technical means. Could be your IP or user agent as well

eternityforest3• 3 years ago

That would also be terrible to legislate. Browsers for privacy conscious people should offer it as an option, it's a non-issue for everyone else.

If the government wants to get involved they can make public service announcements and try to convince people to care.

anonymous_sorry• 3 years ago

With a purely client-side solution how do you stop a company using the same identifying token for basic session management and invasive tracking/data gathering?

ZiiS• 3 years ago

Tracking a single session doesn't really worry me and I seriously doubt any law will stop it. What we want to do is prevent them correlating two sessions. With FF in full defensive mode. No canvas, restricted JS, deleted cookies I can at least make it hard for them.

circuit10• 3 years ago

As far as I know the law only applies to tracking cookies, I’m not sure if the browser can distinguish those from normal ones so it has be done via the law. Asking for consent for any kind of cookie whatsoever would be a bit much

musicale3• 3 years ago

Tracking probably won't go away if you remove client side cookies - it will just move server side (think a new server-side google analytics) and to more aggressive client fingerprinting.

Is that the best outcome?

taftster• 3 years ago

I mean, I am pretty sure (have seen first hand) that this already happens regardless of whether client cookies are enabled. There's so many other (good?) ways to track users beyond just a cookie.

JohnFen6• 3 years ago

Browsers should just not accept cookies

Most (all?) browsers I've ever seen have a setting that makes them reject all cookies.

Symbiote3• 3 years ago

Browsers explicitly asked permission to allow a cookie back in the 1990s. I'd guess around 1996-7 that changed to automatically accepting them.

basisword• 3 years ago

The irony that I have to click through one of the ultra-shitty agree/learn more cookie popups just to read this article. Maybe if GHacks didn't comply with the legislation in such a user hostile manner, browser developers wouldn't have to waste time on such features.

marcosdumay2• 3 years ago

An outright dishonest cookie prompt, where "reject" or "manage choices" aren't even shown on the first screen.

I imagine the company behind this site is hosted at the US. There are not many places one can still do this.

sva_2• 3 years ago

Most of the big German news sites require you to either accept ads, or pay for a subscription.

It is sadly perfectly legal afaik. Nobody is entitled to your content without agreeing to some terms. Luckily, archive.is works very well. Wish there were more alternatives.

seppel• 3 years ago

Maybe if GHacks didn't comply with the legislation in such a user hostile manner, browser developers wouldn't have to waste time on such features.

You need the same feature for visiting EU government websites:

https://www.consilium.europa.eu/ (best example)

https://commission.europa.eu/

https://european-union.europa.eu/

tobr• 3 years ago

These just require a single click to reject, unlike the one on ghacks.net.

Deukhoofd3• 3 years ago

There's a major difference between a two button UI with a clear "I refuse cookies" screen, and a screen where you first need to click "Learn More", then manually toggle 5 toggles about what you don't want to allow, then click the greyed out "View our partners" button, then block all of those. The second one is definitely extremely user hostile.

skywal_l• 3 years ago

As it happens, GHacks cookie popup is defeated by NoScript. You might give it a try.

rickstanley• 3 years ago

Not OP. I've been using NoScript until today, works as expected of course, but the hassle to have to enable specific scripts to make a useful website work outweighs its usefulness for me.

There's "NoJS", a extension where you can enable all JS through a switch, but it doesn't handle iframes very well at the moment.

bombolo2• 3 years ago

It's actually illegal, reject should be as fast as accept.

swapfile2• 3 years ago

This is why I browse the internet with scripts disabled. I don't see a popup of any sort.

lbotos• 3 years ago

Aside: I can't remember what site I was on recently, but I saw the craziest cookie prompt. The options were:

Basic / Premium / Ultra

With you guessed it, Ultra being the most tracking cookies. I was flabbergasted.

solarkraft3• 3 years ago

Ultimate tracking experience

thedailymail• 3 years ago

Congratulations on being selected to enjoy the Diamond Elite Tier sponsor engagement experience!

tux3• 3 years ago

They should make Ultra have a limited time countdown, to stress people into FOMOclicking.

But of course, for maximum trap potential, we need to find a wording such that Premium is the option without, while Ultra tracking and Basic tracking should both do roughly the same amount of tracking (modulo not really relevant details). With a sufficiently discouraging wall of text, a bad UX, and a limited time option, no one would spend the time to figure out they need to click the middle option.

(This tweet brought to you by our sponsor, Moloch.)

jokethrowaway• 3 years ago

nope, any cookie banner is pure cancer

I don't even care about all the dark patterns of now allowing you to dismiss and ignore with one click.

Thank you Europe

solarkraft3• 3 years ago

nope, any cookie banner is pure cancer

I agree, sites shouldn't be doing the things that require showing one.

I don't even care about all the dark patterns of now allowing you to dismiss and ignore with one click.

How is this a dark pattern?

Thank you Europe

Indeed! If such tracking has to be allowed, I'm happy that at least I can opt out of it.

mike_hock5• 3 years ago

This is the same Europe that's trying to implement blanket surveillance of all chat communication. Just, you know, by the way. To illustrate how much they actually care about your privacy.

Any popup or obstruction is cancer, cookie consent or otherwise.

We need the same approach as for ad blocking. Just remove the crap from the DOM tree. Block the tracker cookies, based on curated blacklists or heuristics, or both.

We need to take back control of our devices, not leave it to every single website to hopefully obey some law.

JohnMakin• 3 years ago

Came here to post this. This is a pretty malicious pattern.

aziaziazi3• 3 years ago

And there is even worse : sometimes the “partner” list does not have a reject all AND each partner requires a two click steps - waiting for an animation in between.

Edit: remove double post of link

BlueTemplar• 3 years ago

These days, this just makes me immediately click Reader Mode.

subarctic• 3 years ago

Honestly for the first 10 seconds after I clicked the link, I thought the banner must be a joke because the irony is just too perfect

harel2• 3 years ago

I hate those cookie prompts so much I get Cookie Rage every time they appear. I rather be tracked from here to infinity than see another cookie prompt in a site i approved yesterday.

c7DJTLrn2• 3 years ago

I'm beyond Cookie Rage. I'm into Cookie Despair, maybe even Cookie Depression.

frereubu• 3 years ago

You're almost there. The five stages of cookie despair: Denial, Anger, Bargaining, Depression, Acceptance.

(https://en.wikipedia.org/wiki/Five_stages_of_grief in case the reference is too niche)

suralind• 3 years ago

there's a chrome extension which I think is called "I don't care about cookies" :)

Quarrel• 3 years ago

Which was bought by Avast, so lots of people switched to the forked open version [1] (thank you GPL).

[1] https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies

robswc• 3 years ago

Do they not remember your decision? Most sites I visit never have them and if they do, only need to select it once.

vitehozonage• 3 years ago

You are likely keeping all your cookies which is a huge privacy problem. If sites remember who you are between sessions then of course they can track you. With addons like Cookie AutoDelete this doesnt happen.

If security conscious it would be recommended to also use disposable VMs for browser sessions like with Qubes OS. Otherwise, with persistence like you describe, it's crazy to me that one bad click could so easily compromise you forever

hewlett• 3 years ago

If you reject cookies, the site has no way of knowing you have rejected cookies the next time you visit. You need a cookie in order to store the cookie decision

keketi• 3 years ago

I use incognito mode, which means throughout the day I have to click through cookie consent screens on every single website I visit.

harel2• 3 years ago

Not really. I would answer it, accepting all cookies, cakes and whatever just leave me alone. Then, the next day, I would open the same site, and they will ask me again. This is not just on one device - it's on all of them, and everywhere.

Some are really bad - Admiral requires me to either accept all (hundreds of cookies) or press one link, open a form, then accept a default selection. Some also present me with a confirmation popup. Some I have to stare at for a moment to see where is the puzzle to solve - where is that button.

RandallBrown• 3 years ago

StackOverflow has never once remembered my choice. It's the website that frustrates me the most because I felt like they had a lot of goodwill with me and now it's just gone.

louthy2• 3 years ago

Install the consent-o-matic extension. It fills out the forms automatically. It doesn’t catch everything, but is mostly pretty good…

Chrome: https://chrome.google.com/webstore/detail/consent-o-matic/md...

Firefox: https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat...

The thing that really grinds my gears is the phrase “We care about your privacy”. Bullshit! If you cared you wouldn’t even need to ask for consent!

bombolo2• 3 years ago

doesn't work in most cases

JohnFen6• 3 years ago

“We care about your privacy”. Bullshit!

That's not bullshit. They really do care about your privacy. They care a lot about relieving you of it.

rcMgD2BwE72F3• 3 years ago

How is it better than https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies

exrook• 3 years ago

Try adding the EasyList Cookie List[0] to your adblocker to block them all.

It's present in the uBlock Origin filter list settings under Annoyances but not enabled by default. HN readers may also find some of the other default disabled filter lists interesting such as the AdGuard URL Tracking Protection list which strips tracking parameters from URLs.

[0] https://easylist.to/#easylist-cookie-list

Sephr2• 3 years ago

Note that using this blocker list can actually increase first party tracking if it blocks a properly configured user respecting consent management platform.

eternityforest3• 3 years ago

There's no auto-accept feature? I still wouldn't use it, or Firefox, because that kind of automated interaction seems unreliable, but I really don't want auto- reject breaking stuff.

marssaxman• 3 years ago

I never accept or reject cookie banners - I just delete them, using uBlock Origin. This works out fine, basically all the time, so far as my experience goes.

pmontra• 3 years ago

I also use NoScript. The cookie banner of ghacks didn't show either because I uBlocked it time ago or because it was displayed by a script that didn't run.

stonogo2• 3 years ago

The law that triggered these banners already mandates that the website may not reduce functionality if the user rejects the cookies. Functionality-tied cookies are already exempted from the acceptance requirement.

These banners are the most-user-hostile possible response to the law, so it makes sense to automate getting rid of them.

eternityforest3• 3 years ago

Not everyone actually follows the law though, sometimes they mix in essential cookies and you have to click through a bunch of layers to turn them off without turning off essential ones.

I wouldn't be surprised if they find some way to defeat this in a not quite legal way and break stuff for people who use it.

mminer2373• 3 years ago

That's not true. Directive 2002/58/EC explicitly says that it's fine to condition use of websites upon acceptance of cookies:

Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose.

https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX....

dariosalvi78• 3 years ago

I use stardust cookie cutter: https://www.stardustnetwork.com/

ximm• 3 years ago

Certain regulations, like the GDPR, the General Data Protection Regulation, by the European Union, require that sites get consent for placing cookies and data on user devices.

Well, that is bullshit. GDPR requires that you have some form of legal basis for storing cookies. Consent is the last ditch effort if you were not able to find any other justification. So by nearly by definition, denying that consent is in the user's interest.

I think there is some other EU regulation that requires cookie banners. But don't blame it on the GDPR!

progval• 3 years ago

GDPR requires that you have some form of legal basis for storing cookies.

Not even that. It requires a legal basis for storing and processing personal data.

ragebol• 3 years ago

The cookie dialog must be there in case you want to do cracking cookies. If you don't place the tracking cookies, no need for a dialog IIRC.

But most sites didn't get the hint of "just don't track" and still want to track you.

phendrenad215• 3 years ago

No they get the hint, but the users who accept tracking are subsidizing the site for everyone else.

focusedone• 3 years ago

https://github.com/cavi-au/Consent-O-Matic - this has worked well for me. It'll be nice when similar functionality is built in.

WhereIsTheTruth2• 3 years ago

I'm pretty sure this is against GDPR, it requires explicit choice from the user

Users should decide themselves what to filter, so the bad actors with aggressive cookie policy gets automatically filtered out over time

I was looking for a recipe last time, I googled what I wanted, clicked the 1st link, bunch of popups for cookie/ad, I immediately hit "previous page" then I checked the next link, I bookmarked the one without fuss

rektide• 3 years ago

My choice as a user is that it's all bad, all of it is no good, no one gets any cookies.

Firefox as a user-agent is mirroring me-the-user's choice.

Admittedly that doesn't hold for every user. Some users might make other choices.

crote• 3 years ago

It is not. The GDPR requires websites to obtain explicit consent to misuse your data. The default state is an absence of consent, so such an addon doesn't change anything.

WhereIsTheTruth2• 3 years ago

I will have to read the whole thing again, it's been a while..

PaulHoule2• 3 years ago

Europe should have just mandated Do-not-Track, what they did was a billion dollar mistake.

musicale3• 3 years ago

Legal requirements are probably the only way to handle server side tracking, data brokers, etc..

Though they might be hard to enforce.

josefx• 3 years ago

Not honoring "do-not-track" isn't as visible. Sure a site could just do the bare minimum to look like it upholds the law while breaking it, but instead we got tons of user hostile dark pattern filed dialogs that outright screamed "look at us, we are violating the law".

Deukhoofd3• 3 years ago

The EU is planning to do just that. The new ePrivacy Regulation is currently in trilogue negotiations, and should go into force between later this year and 2025.

the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors.

https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...

scarface742• 3 years ago

Yes I’m sure the EU’s answer to an over complicated 99 section 11 chapter law - passing yet another law - will work out really well this time.

redeeman• 3 years ago

it is already not required to ask consent for cookies that for example backs login, shoppingcart etc

revelio8• 3 years ago

Super, so we can get rid of all banners then. Because ad tracking cookies absolutely improve the user experience. It's unarguably better for users to see a small number of high quality targeted ads than to see a large number of low quality animated flashy barrel-scraping casino ads, which is what you get when there's no ability to track preferences or interests. And nobody's privacy is being invaded because they aren't linkable to any individual identity anyway.

Given that the EU has now conceded that point, we can finally get rid of this noise and move on. Hurrah!

Now, some of you may disagree with the above analysis, but your analysis is no more valid than anyone else's. EU privacy law is deliberately vague and open to interpretation so you can't complain when someone interprets it the way given above.

swapfile2• 3 years ago

That seems like it would be a huge win for the public. Is there any good reason this couldn't happen besides the obvious troublesome process of passing laws?

mrkeen• 3 years ago

I like do-not-track, but it's not for everyone. Informed consent is a good start anyway.

julianlam• 3 years ago

If only there were an agreed upon best practice for communicating a sites handling of user data... a... "Privacy Policy", of sorts... Humm......

mike_hock5• 3 years ago

I do not like another bit of entropy.

cccbbbaaa• 3 years ago

DNT barely existed when ePrivacy was last amended, back in 2009.

adrianmonk• 3 years ago

Or they could have mandated cookie consent but require it to be handled by the browser, not the site (page and server). Define some standardized cookie description format, get it to the browser, and let it handle prompting the user for consent. Any cookie the user doesn't consent to is dropped instead of being stored.

Benefits:

(1) Don't have to trust the site to honor your consent.

(2) Sites won't try dark UI patterns (because they're not building the UI).

(3) More standardized UI because instead of each site inventing their own, they all use the browser's UI.

(4) Less tedium for the user. Browser can let the user choose defaults for the cookie consent dialog. Or define rules to handle certain choices automatically. And, if you can standardize categories (performance cookies, advertising cookies, etc.), then you can apply defaults and rules to those too.

(5) Web developers' jobs are easier. Just maintain and serve a cookie description data file. And of course be prepared to live without certain cookies.

Yes, this is extra work for the developers of browsers themselves. But it would be worth it. And apparently they're already spending engineering resources on cookie consent anyway.

musicale3• 3 years ago

Great, now I just want a preference for

    [X] NO, I do not want to subscribe to your newsletter

kytazo• 3 years ago

Honestly those are more like gimmicks from an advanced user standpoint as the I still don't care about cookies extension does the job just fine as far as I'm concerned, and while this may indeed make a good headline or feature I think development may lack emphasis on the core of firefox and what makes it a good browser.

There is much more fundamental and core functionality missing which has been requested for years like this for example https://bugzilla.mozilla.org/show_bug.cgi?id=1325692

In general it would be good having such functionality built-in, I guess they're gonna have to maintain it as well.

All and all, I'm glad to see any kind of progress on the browser and in any case wish them the very best.

nine_k• 3 years ago

Advanced users are already well-served; it's not for them.

Also, the mobile version may have limitations on extensions.

retrocryptid• 3 years ago

cool. stack exchange might become useful again.

kevin_thibedeau• 3 years ago

There's always tracking via the googleapis.com domain which breaks the site if you try to block it.

JohnFen6• 3 years ago

I block that domain. It does break some sites (and good riddance to them), but for the most part it poses no real problem.

aziaziazi3• 3 years ago

Things may changes “soon” in the legislation

the absence of any option for refusing/rejecting/not consenting cookies at the same level as the one provided for accepting their storage constitutes a breach of the legislation [0]

GO Europe GO !

[0] https://www.cnil.fr/en/edpb-adopts-final-report-outcome-cook...

jonplackett• 3 years ago

How did they not include this to begin with? It’s so obvious as to be poking you in the eye that this would be necessary.

How many cumulative wasted hours have been spent tapping through cookie pop ups?

I made a game about it if you feel like wasting even more of your precious life on pop ups.

http://termsandconditions.game

rlpb• 3 years ago

It was included. The rule hasn't been changed. The interpretation of the rule in one specific case has been confirmed, without having changed the rule. That means that, as written, this dark pattern was always illegal.

zeven7• 3 years ago

How many cumulative wasted hours have been spent tapping through cookie pop ups?

Maybe not quite as privacy conscious, but a quick workaround: (1) Open in incognito (2) Click big, easy to find "Accept" button

hutzlibu• 3 years ago

Thanks for that. This game should probably be mandatory, for anyone involved with the cookie legislation. If they succed, they may propose a new draft.

lucideer3• 3 years ago

On one hand, this was required from the beginning (this is just a clarification of original intent, not a change or addition)

However it's deeper since the popups we see today were never recommended nor required by the original regs. The laborious nonsense we endure was invented by websites as a workaround for the regs. So it wasn't obvious that consent parity would ever need to be clarified like this because it wasn't even obvious that the industry would come up with such an awful popup pattern to begin with (though in retrospect we should've known I guess).

The fact the popups were never even compliant anyway is just a combination of wilful ignorance, dark patterns, consulting companies wanting to sell something and - yes - an added set of people innocently misinterpreting regulation.

amelius2• 3 years ago

How did they not include this to begin with?

A bigger question is: why didn't they go with the DoNotTrack header.

bar000n• 3 years ago

i really don’t understand how it came to this anyway. the industry is so stubborn. what is not clear here? you should not spy on your site visitors for marketing purposes.

when you join a poll you do so with consent, when a market/social/political research entity invites you to a focus group (for example) you get at least a coffee and snack if not real money.

websites just get this for granted? it’s like stealing. it will never stop until the industry gets some understanding of these concepts.

shadowgovt2• 3 years ago

It became painfully obvious over time that the people who drafted the legislation did not think through either the ways malicious compliance could work against their goals or the incentives of all actors in this story.

SergeAx2• 3 years ago

This is because their goal is to get a consent, not to give the user a choice.

dmix• 3 years ago

As great as that is I still don't think it will make me hate them any less which is why I love Firefox for trying to address it at the browser level.

As a designer I despise mandatory content blocking modals and each one will still have a new design you have to decipher. Maybe if they clarified some design rules (2 or 3 big buttons with clearly defined text in legible colours/fonts etc) then it would be tolerable.

Regardless making it always have Accept/Reject/Custom is a good step forward, even though fingerprinting and browsers like Firefox blocking 3rd party cookies by default pretty much eliminates their utility.

pvorb• 3 years ago

It should just be a standard browser feature with a JavaScript API. Think of something similar to window.confirm() or a standard based on HTTP headers like Do Not Track. There could then just be a standard setting in the browser preferences and the world could be a better place again ten years from now.

mike_hock5• 3 years ago

What's the point of that legislation? Set your browser to block third-party cookies by default, problem solved.

idle_zealot• 3 years ago

That's a good nuclear option, but often we don't actually want to block all cookies. What we want is for sites to use cookies in ways that benefit us, but not use cookies to track us. Blocking them all or selectively allowing specifically chosen cookies puts to onus on the visitor to guess which cookies do what or lose functionality. Making the website owner legally responsible for declaring which cookies are for tracking and which provide functionality is a boon.

IanCal• 3 years ago

Cookies aren't the only thing involved here. The banners are asking if they can track you and that includes lots of things, your IP is the most obvious.

adrr• 3 years ago

Third party cookies are already blocked in safari and Firefox. Cookie prompt is for first party cookie like analytics, ab testing, and rum cookies.

contravariant• 3 years ago

If I'm honest I never could quite understand the whole privacy kerfuffle about cookies, they ask the user to remember some token and if they so choose send that token back when they visit again. If cookies are a breach of privacy then so are ticket numbers.

Of course the whole issue is that the most popular user agents (i.e. web browsers) did very little to empower users to act responsibly with their cookies. I mean I consider the Cookie Autodelete extension just basic hygiene at this point, just like having a good ad blocker and some kind of firewall/virus scanner.

KMnO4• 3 years ago

I hate that everyone benefits from GDPR and is rooting for Europe, yet very little is being done in North America.

jtbayly• 3 years ago

Whereas I hate GDPR, because all it has accomplished is making it harder to browse the web.

Nothing else.

shapefrog• 3 years ago

I hate that everyone benefits from GDPR and hates GDPR and Europe for daring to try.

Spivak• 3 years ago

If they require that that no response is considered a rejection of all non-essential then we're basically done.

Wow no one opted in? Shocked.

TheCoelacanth• 3 years ago

That's already what the law is.

Defletter7• 3 years ago

There really needs to be some kind of addition to the law that says "Should the user have GDPR_COOKIE_CONSENT=REJECTALL, the site should act as if the user manually rejected and objected all." The fact that third party vendors are having to produce workarounds for this reeks of the kind of American tax system that insists on taxpayers manually filling out their taxes.

PlutoIsAPlanet• 3 years ago

Unfortunately this will likely just be used as a part of a unique user fingerprint generation method, similar to Do Not Track.

revelio8• 3 years ago

"Disable cookies" was an option in the very first web browsers, so no, there doesn't need to be any addition to the law. You can disable cookies any time you want. Just don't cry when it turns out that you actually love "tracking" and need it to work for your web experience to be any good.

stickfigure2• 3 years ago

I want my browser to send a header:

    X-I-Dont-Give-A-Fuck-About-Cookies: true

...and let the world wide web stop torturing me. I have a nice button that clears cookies and websites can't do anything about it. This whole dance is stupid.

rwalle• 3 years ago

...which will make it easier to websites to identify and track you.

oehpr• 3 years ago

Exactly. Don't negotiate with people who operate in bad faith.

olalonde• 3 years ago

I honestly don't mind. The popups have a far more negative impact on my life. If I actually mind, which is very rare, I just open an Incognito window.

Tarq0n• 3 years ago

Keep in mind the cookie law doesn't just apply to browser cookies, but to other kinds of fingerprinting too. Your proposal would let you be tracked in a persistent way through canvas, localstorage and other forms of entropy easily retrieved from your browser that deleting cookies will not help against.

stickfigure2• 3 years ago

"Clear cookies" clears local storage, indexeddb, and the other obvious places. Of course that leaves evercookie-type tracking, but the folks using those techniques are not likely to care about about consent. And frankly you'd be better off just simply banning those techniques outright. Or better yet, make them impossible in the browser in the first place.

The "can I track you?" question does not add value.

mike_hock5• 3 years ago

canvas: Useless feature. Disable.

localstorage: Clear along with cookies.

entropy: Reduce observable information.

Fuck the law. Defend yourself with technical measures that actually work. You wanna make a law that helps? Give safe-haven protections to Tor exit nodes.

crazygringo• 3 years ago

A million times this.

It's easy enough to block cookies with an extension, but I'm sick of wasting time clicking the damn banners.

This should be controlled by the browser not the site. Let the site do whatever it wants to try to track, but let my browser do whatever it wants to prevent that.

NelsonMinar• 3 years ago

add it to the list with

    DNT: 1

EGreg• 3 years ago

I don't get it. So everyone will simply opt out of cookies automatically, and no more first-party cookies will be allowed?

What about localStorage?

I just don't understand how people are supposed to maintain an account with a site, without this stuff. Maybe using WebAuthn? Or what?

throwawaaarrgh• 3 years ago

why didn't the law prescribe an API for the cookie updates to begin with? it could have been a first class feature of the browser, and then maybe it would actually be used as intended.

RoyGBivCap• 3 years ago

Reading a lot of really good, insightful comments in this thread I have come to this conclusion: It's just another arms race. Like spam, CAPTCHAs, user engagement, and ads. There is no permanent solution and there cannot be because there are innovative humans (and now their ML tools) on both sides of it. All "good" solutions will be temporary, and laws are only as good as their enforcement.

snickerbockers• 3 years ago

Honest question: why is cookie management done by the sites instead of the browser? There's something wrong with the way this is all designed if we're relying on the websites, which have an obvious conflict of interest, to manage which cookies are necessary and which are frivolous.

xmodem2• 3 years ago

I mean, you can turn cookies off in your browser settings, but the browser doesn't have a good way to differentiate between a cookie that keeps you logged into something and a cookie that tracks you to show ads.

saurik• 3 years ago

Sure, but the vast majority of websites where I see these cookie prompts aren't even websites I'm logging in to in the first place... often they are websites I am not sure you can even log into at all. I get that if I want some kind of fine-grained cookie handling for websites that are legitimately using cookies for something I need to rely on them, but that initial "do I want this site to get cookies at all?" is almost always "no" and I should not have to rely on them for it.

kadoban• 3 years ago

Two reasons:

Because this is malicious compliance by websites. They are attempting to annoy people into clicking the easiest button, which is always the "store all my data, spam me at will" button.

And then the second is: browsers don't really know the purpose of any particular cookie, or how much the user actually wants it or not. Due to how cookies work, they really have no way to know. Cookies are not standardized enough.

prpl• 3 years ago

cookies could be standardized/semantic - by name or by another cookies’ name (of course, there could still be violations if any part of a cookies value is opaque)

Quarrelsome• 3 years ago

I would assume because either the appropriate solution (to have the settings in the browser) wasn't proposed due to a dearth of technological competence in politics or the ad lobby pushed for each site to present its own in some poor attempt to pretend to provide "consumer choice".

cozzyd• 3 years ago

Considering that the current dominant browser IS the ad lobby...

mananaysiempre• 3 years ago

Aside from the other things people have mentioned, GDPR prompts (unlike typical ePrivacy Directive prompts before that) don’t only apply to client-side stuff.

Without obtaining consent or having a legitimate (i.e. functional, not economic) reason, the website operator cannot collect server-side logs or fingerprints either. Or they might not need consent to collect data (e.g. remember your purchases for refunds) but do need it to disclose that data to third parties (e.g. to feed the purchases into a recommendation engine... or, let’s be real, an advertisement profile).

None of this nuance is enforceable browser-side. It could in theory be communicated in machine-readable form by the browser, such as with a DNT header, but before somebody sues over that I doubt it’s going to be honoured.

(I remember that the SameSite cookie proposal had a follow-up, even more web-breaking same-origin-policy cookie proposal. That’s probably the most meaningful thing you can do client-side. But it had seemingly died when FLoC did, and I can’t find it now.)

nmz• 3 years ago

The main reason is the web is run via ads which are fueled by cookies. browsers have no interest in limiting their functionality in any way. It's a deal with the devil kind of thing. spyware v free web.

cantaloa• 3 years ago

While browser cookie UI has been historically bad even for developers, I don't see how a browser's cookie UI could do what these menus do.

For example, load StackOverflow in Chrome incognito. It has buttons for "Accept all cookies", "Necessary cookies only" and a "Customize" menu that gives you checkboxes for "strictly necessary", "performance", "functionality", and "targeting cookies" all with a lot of links and explanations.

It isn't just a matter of turning off third party cookies.

kazinator• 3 years ago

It's all so silly. The simplest solution would be to have a standard cookie (and/or API in javascript) that everyone can access which declares your preferences. Instead we have these multiple rounds of complexity.

unconed• 3 years ago

Clicking "reject all" isn't sufficient though. In many cases you need to go into some sub-tab and click "object all" to legitimate interest, or even uncheck a bunch of individual checkboxes that default to on.

This is applied for purposes such as "build a personalized profile", "show personalized content" and "show targeted ads" so I have no idea what the cookie dialog is supposed to prevent anymore... clearly the original purpose has been rules lawyered into oblivion by amoral scumbags.

But if they don't handle this, they're just going to blindly opt people into a bunch of stuff you'd expect to be opted out of.

thwarted• 3 years ago

P3P was ahead of its time.

https://en.wikipedia.org/wiki/P3P

zadler• 3 years ago

This whole thing is so fucking stupid.

The website should ask your browser should ask for permission to store cookies beyond the length of the session as it asks for your location / camera access.

jrmg• 3 years ago

This seems similar to the ‘Hush’ extension for Safari:

https://oblador.github.io/hush/

muyuu• 3 years ago

Brave does this IIRC since October 2022

it's since recently also blocking "use our app" nagboxes in mobile

granoIacowboy2• 3 years ago

This. What is slowing Brave's adoption?

granoIacowboy2• 3 years ago

As muyuu said, Brave has been on this for quite a while. Why is it not a more popular browser with infosec-focused people? I'm certain I'm missing something.

PaulHoule2• 3 years ago

Every other browser will be forced to catch up or lose market share.

soraminazuki• 3 years ago

Cool feature, but is it necessary to interact with cookie prompts at all? I feel that simply blocking the tracking and the cookie prompts seem like the best solution here.

benced• 3 years ago

Firefox could send each site a UID, my home address, and my phone number and it would enrage me less than the prompts everywhere.

rcMgD2BwE72F3• 3 years ago

it would enrage me less than the prompts everywhere.

The advertising industry won with their prompts, then.

dcow3• 3 years ago

Okay so what if I actually want cookies? I notice Firefox’s feature will reject cookies. But I am so sick of having to log in to websites every 15 minutes because the site forgot who I am or otherwise running into silly bugs because nobody tested the site with cookies turned off. I honest to god just want to go back to the internet before GDPR and want to tell Firefox to just allow all cookies rather than reject. I care about privacy but I don't think cookie consent is the solution.

I think the solution lies in somewhere in the realm of legally limiting the ability to profit off of the sale of collected data or even collect data without my consent. I don’t care if snazzy.app wants to collect product analytics and marketing data when I’m on their site. I consent to that by navigating to snazzy.app. I do care if snazzy.app embeds cambridge-analytica.js, though. And cookie consent banners simply don't address this nuance. What we need is control over where the data goes and if it crosses property/origin boundaries.

xigoi2• 3 years ago

This is about tracking cookies, not about login cookies.

imiric2• 3 years ago

All this focus on cookies is entirely missing the point of regulating user tracking online. Adtech is ten steps ahead of this, and can track users whether they accept cookies or not. It's an illusion of choice that muddies the discussion of topics that really matter.

There should be more congressional hearings of adtech representatives, with legislators who are technically equipped to grill them on all details of their business, and how it affects the population.

Unfortunately, given how most legislators are technically illiterate at best, and financially corrupt at worst, nothing of value for the people has so far resulted from these hearings.

I'm hoping that in the coming decades, as younger generations get in government, this will improve. We really need much stronger regulation for Big Tech, just like we have for Big Tobacco, Oil, Pharma, et al. Hopefully this will come sooner than the point when the harms from its long-term effects are fully understood.

SergeAx2• 3 years ago

This whole thing is not about cookies, it is about extracting value from a website users. If a website has only necessary functional cookies - it is not obliged to get a user's consent. So if you see a cookie consent popup - it is 100% website trying to persuade you into giving away some of you rights. Recently I developed a habit to just close the tab with those annoyances (including the one this thred linked to).

Reason0772• 3 years ago

Firefox developers, you will be my heroes forever if you pull this off! Cookie pop-ups are the scourge of the internet.

OrangeMusic• 3 years ago

Honestly I've been using the "I don't care about cookies" extension for several years now, and I can't live without it (same with an ad blocker). I've even switched from Chrome to Kiwi Browser on my Android (it's a Chromium flavor that support extensions), just for that purpose.

Reason0772• 3 years ago

Thanks for the tip. Apparently, "I don't care about cookies" has been bought out by the spyware vendor Avast, so people don't trust it anymore. There's now a de-bloated open-source fork "I still don't care about cookies" instead.

jokoon• 3 years ago

Ublock can do this with an option

millerm• 3 years ago

And I get a nice big cookie prompt when I open up that site. The web is broken. And it follows the dark pattern approach. I’m not even gonna read it. Blacklisted.

butz• 3 years ago

Ironically the linked article shows content blocking modal without easily available option to reject all cookies. Go Firefox!

All this cookie banner nonsense could have been solved years ago by implementing a simple standard of setting your privacy preferences right in the browser.

Firefox may soon reject Cookie prompts automatically

Related Stories