Hacker News Reader

Comment by diegorbaquero | Hacker News Reader

In Chrome: Settings > Privacy > Content Settings > Tick 'Block third-party cookies and site data'

Also set 'Send a "Do Not Track" request with your browsing traffic'

And install uBlock Origin, ofc.

As somebody who tried to build code respecting "Do Not Track" preferences, I have to say that feature, while well-intended, is a complete farce.

Chrome, Safari, Firefox, IE9, IE10, and IE11 all use different APIs for Do Not Track [1], so a front-end developer has to do a lot of extra leg work to check if the user has the preference set.

I find it highly unlikely that most companies would go through the effort of respecting Do Not Track.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Navigator/d...

Wow. I am surprised at how many different ways Firefox, Safari, and IE9/10/11 implement an API as simple as navigator.doNotTrack.

This almost seems like a case of defective by design.

The main behaviour is to add the DNT: 1 HTTP header. The JavaScript APIs are just a bonus to perhaps avoid sending unnecessary information. (But yes, it’s still a silly feature, because having to go out of your way at all to respect DNT isn’t really worth it.)

3rd party cookies should be disabled by default in all browsers. It significantly improves your privacy with minimal impact.

After many years of blocking 3rd party cookies the only thing that's broken for me is my bank's bill pay system, which is an iframe of a 3rd party service.

heh, same here. I can't use my banks ebilling website.

Try opening the iframe directly.

Also, complain to your bank.

Or just whitelist that one.

I whitelisted bandcamp because some bands use custom domains.

At a minimum, though, please block third-party cookies and site data.

I have pretty minimal customizations and plugins on browsers—very few plugins, no ad-blocking, no security or privacy enhancements.

I've had third-party cookies blocked for a long time now and there aren't any sites or logins that break down with them disabled (that I've encountered).

On the plus side, though, you don't have to worry about this crap. I'm logged into several of these sites and none of them show as leaked.

Personally, I don't set the DNT header.

You have no way of knowing if any sites are actually going to comply, and it actually provides an extra datapoint to fingerprint you with.

But isn't it better to at least ask instead of not asking at all?

As I said, simply asking for it will actually reduce your privacy for any service that doesn't comply, by making you more fingerprintable.

But there is some pressure on companies to comply. Plus they can't use the defense that you could have enabled it and chose not to.

Its pretty obvious the default should be the opposite to avoid a race condition like that.

Are you suggesting a "please track me" header? Nobody would ever use it...

It was proposed that DNT be the default, but then ad companies said if that were the case, then they would just ignore the header. They want users to explicitly opt out of tracking otherwise they will assume they agree to being tracked.

There are 100s of ways to fingerprint the browser and more exactly. I think is better to set it for the few that comply.

That's true, but they usually require running javascript etc.

Looking at the request headers is the simplest way of fingerprinting.

Keep in mind, uBlock Origin does not block social media widgets by default, and you have to enable it in settings. Widgets like Facebook like buttons, and Tweet buttons have to be blocked manually.

Checking the box to block 3rd party cookies is great advice, but I would not tell my Mom or any other casual user to do it. Why? You wind up with a lot of very weird, hard-to-track down bugs in web pages. I've seen failures in OAUTH and SSO pages, buttons that don't click, etc. Things you might not expect to break, break. And it's hard to track it back to that checkbox.

I suppose the "block third-party cookies and site data" must be why this is mostly broken at home (doesn't show logins to 5-6 sites that I'm logged in to), but works properly at work (didn't bother to set that option there). Never toyed with exactly what the "site data" part means, though.

Very nice. Here's how to do it on Firefox [1]

[1] https://support.mozilla.org/en-US/kb/disable-third-party-coo...

How many people browsing the web would know to do this? Would even 0.5% of users know?

I didn't know about either of these things and I consider myself fairly security savvy (for a programmer).

uBlock Origin looks way better than Ghostery, which I was using until now.

Reply on news.ycombinator.com