What will replace cookies?
Chrome agrees with you on that: https://github.com/michaelkleber/privacy-model
The replacements they are talking about attempt to maintain the economic benefits without cross-site tracking.
Disclosure: I work at Google but not on ads or Chrome.
To me, this is an example of where a browser trying to be a good agent for users overall separates from a browser trying to be a good agent for any particular user. Yes, selfishly, I would rather skip paywalls and not see ads, but an internet where the browsers did that by default for everyone would be a much worse internet.
("paywall circumvention" is a broad topic. I wouldn't want a browser, for instance, integrating "go get the mirrored content from another site" or "mirror paywalled content to other users", but things like "suppress specific popovers that also block scrolling", sure. If you don't want a user to have the content, don't serve it to them and then hide it.)
Why not? It sounds like if you accept the role of the browser as "do what is best for this specific user despite the broader consequences" they're worth doing?
What the user wants is content.
So there are two scenarios:
a) content is worth it so the user would pay to access it (for example $0.01 aka micropayments which browsers refuse to natively implement and automate; we can argue why in the light that all three mainstream browsers are directly or indirectly ad-supported and micropayments are an anti-thesis to ads)
b) content is worth it and it is not behind a paywall (this is what most high quality content on the web is actually nowadays - wikipedia, hacker news or your own blog and blogs of many other people are examples)
In the event that content is not worth it (which is sadly true for most ad/affiliate/tracking monetized content on the web today) the user should have these two options:
a) not read it (probably best for them)
b) have their browser block ads/tracking, to at least make it consumable and privacy respecting
In other words the websites wanting to monetize their content should totally be in the position where they need to make that content good enough to be worth something to someone, otherwise why would humanity care about their existence?
Users have very widely varying amounts of money. Universal paywalls would hit poorer readers far harder than richer ones. They would also push towards centralization via bundling.
> micropayments which browsers refuse to natively implement and automate
I have yet to see a good micropayments proposal, despite 25+y (https://www.w3.org/Conferences/WWW4/Papers/246/) of work on the project. Among other things, they tend to have similar privacy properties to third-party cookies ("third parties can learn every site you visit").
> content is worth it and it is not behind a paywall (this is what most high quality content on the web is actually nowadays - wikipedia, hacker news or your own blog and blogs of many other people are examples)
Hacker News has ads (paid links on the front page for job openings), and Wikipedia has fundraising banners (which many adblockers block). My blog is funded just by me as a hobby project, yes, but most of what I (and I suspect you) read on the web isn't.
I really do not understand this argument. This is a fact of life.
Isn't the price of gas affecting poorer citizens? Should we subsidize the gas with ads in you car? Isn't the price of housing affecting poorer citizens? Should we subsidize houses with ads on your walls? How abot having ads via an electrode in your brain 24/7 to get food for free? Where would this lead humanity?
Having a price point is how 99% of world's economy works and it is completely normal that everyone can not buy everything, and that people have to budget and prioritise their expenses based on the perceived value they are getting. I am pretty sure that people would give up on 99% ad-supported content on the web quite easilly if it had even a $0.01 price point, because it is simply not worth it for most people (and not consuming it would arguably improve their lives too).
> I have yet to see a good micropayments proposal,
Or the simple answer is just unwillingness to implement because of conflict of interest. We went to the Moon in 8 years and micropayments are objectively a simpler problem.
> Hacker News has ads (paid links on the front page for job openings), and Wikipedia has fundraising banners (which many adblockers block).
I was not aware you can buy an ad on Hacker News. Source?
Wikipedia example is different from what we are discussing, because for Wikipedia user=customer so they are selling their service to their users, for Google Search, Chrome Browser and most ad-supported websites user!=customer (customer there being an advertiser, introducing conflict of interest).
> My blog is funded just by me as a hobby project, yes, but most of what I (and I suspect you) read on the web isn't.
Most of the content I choose to read does not have ads. I do this consciously as I know that the content with ads will be lower quaility and probably not worth my time. This includes almost all news. "We are what we read" [1] and I am very careful about what content I put in my brain, like I am careful what food I put in my body.
Housing is so expensive that advertising couldn't put an appreciable dent in it. But I don't have any sort of moral objection to some company renting out apartments that are a bit cheaper but have advertisements. (And I would be opposed to outlawing them if they existed)
> I am pretty sure that people would give up on 99% ad-supported content on the web quite easilly if it had even a $0.01 price point, because it is simply not worth it for most people
I think you would see that as well, but mostly because of friction, not because of willingness how much value people get out of things.
> We went to the Moon in 8 years
This cost the US a quarter of a trillion dollars, adjusted for inflation. This was a massive investment. Almost everything has received far less investment than that; no need to posit a conspiracy!
If you think it is just a matter of implementation, I would love to see a link to a proposal you would endorse?
> I was not aware you can buy an ad on Hacker News
There's one in the front page right now: "UPchieve (EdTech Nonprofit, YC W21) is hiring senior engineers"
> Most of the content I choose to read...
I can believe this for you, though that you did not notice the ads here makes me wonder whether you might be missing tasteful ads elsewhere? But it's definitely not true for most people: a web without advertising funding is a web that the vast majority of people who currently use the web would enjoy much less.
"Most people" argument is generally a bad one as it takes a point in time statistic vs a first principles merit-based observation.
For example "most people" enjoyed smoking in 1960s, which can at best be a point in time statistic and in no way a good argument for smoking (actually it is a terrible argument).
Whether you can make a moral based argument for ads requires at least moral consistency. If you can truly say "I strongly believe ads are a driving force for the good in the society, and therefore I also choose to expose my kids to ads from a young age and would not mind them one day living in an apartment that is running ads on their walls 24/7" then you can at least hold a morally consistent position and I would applaud you for that.
I of course completely disagree with this position, and am doing whatever I can to protect my kids from exposure to ads from young age by limiting TV, paying for YouTube Premium, having them use an ad-free search engine, use a browser that has built in ad blocker and so forth. I teach them that companies never give away things for free unless it benefits them in some other way, and that in life you always get what you pay for.
c) do not consume the content
It is actually the best option for the user in most cases when ad-supported content is in question. The way it evolved over the years, the purpose of the content became not to inform the user, but to monetize their visit. As such it transformed from being intelligence amplifying to intelligence insulting (in general).
Why? Because ad supported content tends to be of lower quality, produced en-masse, with inherent conflict of interest, clickbaity and poorly written (ads significantly contributed to detoriation of journalism globally), littered with ads to the point of being impossible to read and finally infested with tracking in the worst privacy-invasive ways.
In the event you still want to access it, the best your browser can do is indeed to try to block all ads/tracking on the page. What this converges to is either the sites producing low quality content disappearing or them actually making it worthwhile for people to pay for. Both outcomes are good for humanity, where preserving the current state is bad.
The same thing happens with content supported through direct payments. Think video game streamers producing mindless content all day long, and asking for donations that allow viewers to get a flair next to their name or an in-stream callout of some chosen sentence.
>ads significantly contributed to detoriation of journalism globally
Ads have been in journalism for a long time. When would you say the deterioration happened?
You get what you pay for. If the product is mindless to begin with, I do not think this proves any point. It would be different if stream was paid to begin with.
> Ads have been in journalism for a long time.
You still paid for the newspaper, meaning an economic transactio happend where you valued the content at some price point and were ready to pay. That meant content had to pass at least some quality threshold.
Replacing this with fully free, ad-supported content totally changed incentives.
Now the content can be of zero value (which it in most cases is) and will still be consumed because it is free.
(I used to work on this at Google)
(I used to work in this area)
[1] https://blog.google/products/chrome/update-testing-privacy-s...
[2] https://privacysandbox.com/open-web/#proposals-for-the-web
Event-level reports are generated as follows:
The browser matches clicks or views with conversion data defined by an adtech. Later, the browser sends the resulting reports to a predefined endpoint, with some delay and noise.
--
OK is it just me or is this super hand wavy ? Where's the beef ?
and if you insist on that your users must use javascript to view your web site, then cookie is not even needed, one can do some finger printing and there is your permanent cookie!
This development of web has many tech savvy people stop using internet on their phone and switched back to old dump phones (and this comes from someone who has being promoting JS since before nodejs came along). Please bring back web pages that does not require cookie or javascript to function, a web page that can work in the terminal browser like lynx or links2 is the base standard for web page. JS and cookies are just icing on the cake not needed.
I feel that we got to a point where the community put out a couple recipes for deploying websites and everyone just jumped on it irrespective of the problem, mimicked the same patterns (email newsletter popups, ads, google analytics, 30 million external assets, etc) and called it a day.
While I think your opinion is a bit extreme, I agree that there are so many things that we don’t need, but companies are hiring and new devs are copying the recipes.
It's funny that you include popups in that, because actual popups are almost nonexistent today, whereas they were ubiquitous in the early 2000s web.
For example, browsers used to actually allow pop-up windows (as in it would open a new desktop window (not a tab), sometimes off-screen). And then when you closed it the browser would let it spawn more pages.
There was a common pattern of spamming popup windows with a "close" button the same place a "run" button was when you downloaded an executable in Windows 95.
And then after closing 10 windows with the button in the same place they'd hit you with an executable download.
This was common.
I’m moreso talking about _how_ people design sites for the web and how poor design choices lead to poor usability. I think the proliferation of tools that require not too much in-depth knowledge (react), heavy CSS frameworks and large client side JS libs have ruined a lot of the web surfing I used to enjoy
The vast majority of the web really honestly doesn't need it though, like this website.
If you do this through hidden forms then page navigation can no longer be done through hyperlinks and must now all be form submissions, which means a malfunctioning back button and logout when refreshing or opening a link in a new tab.
Please do not do this.
First party cookies are very useful and it's bad enough that people keep trying to replace them with javascript+localstorage despite the decades of security best practices that have been built into them.
I do agree that we can do away with third party cookies however.
The issue with this was that it broke direct linking to pages, or created such ugly and long URLs that they were weren't "sharing" friendly.
It was horrible, and cookies were (and remain) a much better solution.
There are also other auth mechanisms natively supported by browsers, like HTTP Basic Auth that can be used.
No matter what happens, if I store my JWT in a no JavaScript cookie, it's safe. Nowhere else on the web is safe in that way.
I also feel like it's a mistake too Tell people to use fingerprinting instead of cookies, when users actually have control of cookies, it's almost always better for them If we use them instead of fingerprinting.
I very much do want the bank to fingerprint the hell out of my devices, front page of my local newspaper? Nope.
Client certs would really be ideal if browsers handled them better and sync'd the certs between devices (like bookmarks), but I guess that still wouldn't solve the signing in from a new/different (non-synced) device.
I've used basic auth in production. It has terrible user experience, and unfixable issues and limitations.
I wish browser-integrated logins had taken off, with Persona, but that was unfortunately abandoned.
That said, 3rd-party cookies should be blocked by default. IDPs and other exceptional cases can request permission or use one-time query param hashes to exist without them.