Hacker News Reader

Comment by hedora | Hacker News Reader

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode.

Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to be clear)

Maintaining a whitelist of sites that can have session state would be trivial (the sites in my password manager are a great first cut). I don’t want to restart my browser periodically to clear everything else’s session state.

How hard would it be to build something like this?

View on HN

On HackerNews? You're probably not the only one.

In the world of real users? You're probably the extreme minority.

Most people want convenience, and will trade almost anything for it. Especially if they don't realize they are trading something like "privacy" or "trackability" for convenience.

Why do you try to imply that a Web browser experience not built around making the user trackable most effectively, like it is by default with the big browsers, has to be inconvenient?

The way I use Chromium [0], is very convenient to me. The downsides are almost nonexistent, and the upsides are not just in privacy: it is convenient (albeit perhaps of questionable morality?) to not have to worry about newspaper article quotas; likewise with having more control over cookies and other browser data in the "simultaneous multiple sessions" model. For example having more than one user logged in to some Web site does not take any extra effort compared to just one user being logged in.

On the other hand there is a difference between "real users" and those willing to exploit the Unix programming environment/interface to its full potential, and that is required knowledge, or the willingness to get it. For example to use my script tb effectively one has to understand that "being logged in with a Web site" means temporarily storing appropriate data chunks gotten from the Web site (cookies) so that they are accessible to the browser and it could send them back to the server to authenticate.

[0] https://news.ycombinator.com/item?id=20484845

You answered your own question. The vast majority of users are not "willing to exploit the Unix programming environment."

For the vast majority of people who do not already have Unix skills (or whatever), it is convenient not to have to learn them.

> Most people want convenience, and will trade almost anything for it.

No, this is what indoctrinated "UX" people think.

I hear it every day from ordinary office workers how sick they are from dysfunctional, progressively dumbed down UIs.

Ask just how many people keep MS Office 2003 just because they can't use the "ribbon" UI.

You're conflating bad UI design with user-friendly, intuitive, comfortable UX.

Also, design is simplified because that strategy works. People want simple UIs, while business doesn't want to invest in design, costs of which rise exponentially unless you have talent both in development as well as management at work, or deal with too many unique support requests.

When framed correctly, a stateless browser is totally acceptable for general users. General users have no concept of cookies, so if you describe browsers as just a dumb window to let you load websites, it totally makes sense that you would have to log back in when you close the window.

For example, I set my Mom up with a Firefox configuration that doesn't remember anything when you close the window (basically incognito by default). She has used that configuration for years and never complained. In fact, she always compliments me for how safe and reliable I've made her browser. When she sees other people on other computers just load their logged-in websites without having to log in, she thinks they're totally unsafe and exposed.

She associates closing the window == back to safety, so whenever she ends up on a scary website or sees a scary popup, she just closes firefox and opens it back up again. It's wonderful. I didn't have to teach her about cookies or sessions or anything. All I had to teach her was that if she ever got into a situation where she didn't know what to do, just close the window and you're safe again.

Anyway, I feel pretty strongly that if browsers were incognito by default and you had to opt-in to persist sessions (e.g. whitelist cookies), general users would get used to it pretty quickly and end up thinking the time back before was a very unsafe place (like the free love era before the AIDS epidemic).

Doesn't using Chromium in the first place kinda defeat the purpose? I mean, you'll thwart others' tracking with your methods (though you made no mention of blocking tracking scripts/images which is a huge piece) but you're still handing data directly to Google.

You can turn that off in the settings.

There's a setting, but it doesn't really prevent anything. You're still tracked.

This reminds me of firefox's telemetry for people who turn off telemetry [1]. None of the big three browsers respect your privacy enough to not track you in any way. Not a single one.

Here's to hoping that a browser that truly respects its users appears soon.

[1] https://www.ghacks.net/2018/09/21/mozilla-wants-to-estimate-...

Better to use brave maybe? Or Firefox?

You could use ungoogled-chromium to circumvent the Google-parts.

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode.

Take a look at my comment here: https://news.ycombinator.com/item?id=20484845

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is probably bound by regulation or law not to force multi-factor-authentication on me. So, just say no when asked about confirming your phone number.)

Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.

Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be).

Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof.

Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.

I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in.

Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human.

Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting

That's what I do.

For most services I cancel the account and explain why.

> it can not be detected, unlike Incognito mode

This may be true today, but that's because Chrome has a bug. (At least, I can't see why we wouldn't view it as a bug.)

Incognito Mode shouldn't be detectable. Hopefully they'll fix that.

It is true that Google will supposedly start making an effort to make Incognito mode non-detectable [0], but Incognito mode is still crippled compared to the way I use Chromium (through a simple shell script), mostly because of the option to use multiple "sessions" simultaneously and whitelisting of browser data that gets copied/used.

[0] https://www.blog.google/outreach-initiatives/google-news-ini...

Do you use Firefox multi-account containers?

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

It's the biggest reason I use Firefox. Intuitive, straightforward session partitioning. Every browser should have it.

I'd like every single tab to be stateless which I believe Firefox has an end goal of with containers

If you assume (big ask) that your browser is trustworthy and your computer won’t be compromised, it’s nice to have bookmarks, history, and a password manager built in.

That definitely exists on mobile. I use FF Focus, which just clears the entire session as soon as you close the window.

Also, on iOS Safari and Firefox can be defaulted to private browsing.

On desktop, Firefox can be configured to clear all cookies and site data whenever it is closed.

If lots of people did this, websites would start saying "sorry, you can only enter this website if you have cookies that are at least a month old"

What’s your motivation for doing this?

Btw, I store my passwords in Firefox Sync. What would the benefit be of storing them in a third-party password manager, from a security and privacy perspective?

To make the browser stateless and, thus, harder to track.

Do you use any form of tracking protection (either as a built-in browser feature or via browser extensions)?

> What’s your motivation for doing this?

Maybe he, like me, just thinks there is no reason for history, form data, cookies and all that stuff to be saved after starting a new browser instance, except in rare circumstances.

> What would the benefit be of storing them in a third-party password manager

Decoupling, less dependance on a specific browser. "Unix philosphy".

A concrete example of why a 3rd party pw manager is useful- git(hub/lab) credentials. On both sites, I can easily want to enter account credentials in a terminal as well as the browser. Not every password will exclusively be used in the browser, and 3rd party managers are handier outside the browser.

>Am I the only one that wants their browser to be 100% stateless?

I achieved it by using Disposable Virtual Machines in Qubes OS. Works flawlessly.

Do you use two-factor authentication? Staying logged in with the same trusted browser/device is a big benefit for security. It makes it a lot easier for companies to spot suspicious login attempts.

Not the only one - there are probably dozens of us :)

I use Firefox for this purpose, not in private mode - I just let FF delete everything whenever I close it. It's not "100% stateless", as I still allow cookies and such while my browser is open (I use uBlock and Privacy-Badger to block out the worst), but whenever I close the browser I still have a "clean slate" whenever I reopen it.

There are definitely a few downsides (as much as I love the GDPR, the compliance banners are annoying), but together with a password manager, it's definitely a setup that works for me.

I guess what benefits do you get out of that, and at what cost? I just don't see the amount of privacy I give up worth losing the convenience of the features.

Reply on news.ycombinator.com