Hacker News Reader

Comment by jr299 | Hacker News Reader

I believe this isn't always the case. If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store.

Firefox and multiple firefox profiles isolate cookie storage and I also use Fluid on OS X to build site-specific browsers. The paid version offers a feature to isolate cookie storage within each app.

View on HN

"I believe this isn't always the case. If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store."

If that's true then it's utterly insane. This StackOverflow question from 2008 seems to confirm what you're saying, though:

http://stackoverflow.com/questions/364219/how-can-i-have-mul...

I really hope it isn't still the case...

> If you're using multiple browsers in OS X all built on Webkit for instance, they share the same cookie store.

Where are you getting this? Safari and Chrome (both built on webkit) definitely do not share cookie stores on OS X.

In my limited understanding it's the difference between the webkit engine that OS X provides to developers to use, as opposed to Chrome which probably does something different in that regard. Besides site-specific browsers, there are plenty of makeshift OS X tools that implement their own built in browser, and these applications do indeed share cookies with Safari.

The easiest way to test this is with Safari and any of the OS X site-specific browser or http debugging tools.

Ah yes, you're right. I remember old versions of Spotify doing this, and it always confused me.

The Flash Player's "Shared Objects" (aka Flash cookies) are stored in a common directory, so the same Flash data is accessible from any browser (running as the same user). I do not believe Facebook's tracking is this nefarious, but the method would be quite easy to implement.

Chrome, Chromium and Safari absolutely don't share the same cookies on Mac OSX. This is easily verifiable. Not sure about other browsers... (what other browsers?).

I think you're referring to other applications which embed Safari's rendering engine. I wouldn't really call those browsers.

Webkits share cookies = ouch.. so you really need a VM.

New browser feature - open this site in a temp VM.

These days, most browsers come with a private browsing feature, which will dump your cookies, caches (for etag tracking), etc. when you're done.

If users must visit social websites like Facebook in privacy mode in separate browsers, perhaps they should rethink whether they should be using Facebook at all.

The convenience/security trade-off varies user to user, but for something as simple as FB, it might be considered overkill by most.

I would encourage browsers that support isolated profiles, multiple browsers that don't share cookie storage, or using a jailed site-specific browser approach.

Reply on news.ycombinator.com