Hacker News Reader

Comment by mcv | Hacker News Reader

I often think that instead of completely blocking cookies, it would be better to accept them and then throw them away. Same with localStorage. Just store it temporarily.

View on HN

I’ve been using Cookie AutoDelete for that purpose for the last few years. It works flawlessly for me and brings me comfort in knowing that I am only being tracked online by my browser fingerprint and IP.

https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

I do the same! The whitelisting is the best part, since now i can stay logged in to sites that i trust not to track me.

Same, I absolutely love this extension. You can whitelist the websites you use frequently, and for everything else it's like a groundhog day every day.

The cookie banners can be super annoying sometimes, but they are easily removed with uBlock Origin. I also frequently have to solve captchas, but it's not so bad. For example, every time I visit amazon.com to order toilet paper or whatever, it thinks I'm a bot, but at least amazon's captchas are less annoying than some of the others.

A bot with a bowel apparently.

If you go to Amazon a lot why not whitelist?

I personally wouldn't whitelist any site that has my card details saved.

One of the last companies I'd whitelist.

Pair it with "I don't care about cookies". This one clicks Accept on all cookie banners, and Cookie AutoDelete deletes them when the tab is closed.

https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-a...

This is great, thanks

P. S. If I'm using a separate Firefox container just for Amazon, they would isolate my Amazon cookie right? So then I could just whitelist it and avoid capchas?

Yes. Each Firefox container has its own cookies.

Users who do not auto-delete are better served with Consent-O-Matic, this one clicks Deny on all cookie banners and forms by default, but is configurable.

• https://addons.mozilla.org/firefox/addon/consent-o-matic/

• https://github.com/cavi-au/Consent-O-Matic

Came here to mention this. This is is probably the most useful extension for preserving privacy while also not breaking things. Sites can store all the cookies they want now, but a few minutes after the tab goes away it's like we never met. Very nice.

Isn’t that literally what private mode is? It’s a built in feature I thought.

One thing worth noting: at least when I installed it, the auto clean functionality (the bit that actually removes the cookie/etc data) is disabled by default. This means it needs configuration to actually do anything aside from manual cleaning.

The alternative would be that installing the extension immediately wipes all of your cookies, local storage, and other local data. Most users probably don't want this.

How robust is that against server-side storage of user data?

Isn’t that essentially what private browsing is? I tend it just always use private mode in safari.

I do this with Firefox's Temporary Containers. Every manually opened tab is a new browsing session, with no cookies etc. Closed tabs' data get deleted after 15 mins. Fantastic addon, and the usage is as seamless as it gets.

https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

I do this too! I pair Temporary Containers with the Containerise add-on which lets me create persistent containers for a few specific sites that I want stay logged in to.

This setup works well with one glaring exception... Cloudflare and their stupid boats. Using temporary containers for everything has really shone a light on just how much of the web Cloudflare is gobbling up. Cloudflare throws a captcha at me every time I visit any website they gatekeep for. I'm talking mostly about random sites that turn up in web searches. Its annoying enough that when I encounter a Cloudflare captcha, I just close the tab and try the next site.

Now I'm wondering if there's a way to eliminate results from web searches that use Cloudflare with something like the uBlackList add-on.

I do something very similar, but with just the built-in Multi-Account Containers addon. Although its usage is not the most intuitive.

Well, I've reacted to the article with an "of course, the Google's browser breaks everything if you try to block tracking".

There is absolutely no reason for letting the javascript know that you've blocked some functionality. It just adds new tracking.

Anyway, the sensible thing to do is to store the values for the lifetime of the page. Simply throwing them away can be an option, but it's a bad default. Non ad based browsers do get it.

> absolutely no reason

An editor warning you that your work hasn’t been saved?

Or a page settings/preferences dialog reminding you that saving your settings isn't going to work. Sure maybe the user "should know that", but not everyone is totally in command of their own browser's settings.

Or a game warning you that your progress will be lost.

There must be tons of legit use cases.

This is the answer. Blocking the APIs is just asking for a broken internet, and I have very little sympathy.

Furthermore, blocking the API is a detectable characteristic and increases the surface area of your fingerprint. It has exactly the opposite of the intended effect on privacy.

That's basically incognito/private browsing mode.

Just wondering, is there a fully automatic way in e.g. FF to do this? Like right-click 'open in new private tab which automatically accepts all cookie dialogs' ?

Are there ways to do this while whitelisting sites where you want to retain and keep login tokens?

Cookie AutoDelete

Firefox has this when you say delete browsing data on close, next to it is a manage exceptions button

"Delete cookies and site data when Firefox is closed"

Yes, this is the way. Only issue is needing to login to everything again on restart/reboot, but it's a small price to pay.

There are extensions that will aggressively delete cookies while letting you maintain a whitelist.

"Manage Exceptions…"

Maybe. I run a word game (https://squareword.org) that uses localstorage to store stats. This allows me to give users statistics without requiring any sort of account or signup. Even so, I often hear from people that have their stats cleared, for example by iOS evicting localstorage after 7 days of not visiting a site.

I pick between the two. Of late that responsibility has been pretty well taken care of by the Forget Me Not extension on Firefox, although I think it's endangered (like a lot of things that have to do with Firefox and its extensions.)

You can set rules with three clicks, four clicks if you want that rule to be temporary and thrown away on browser restart. You may choose between never deleting, deleting on browser close, deleting on tab close, or just throwing them away. The initial setup for default policy has a few UI issues, but the author put a lot of work into it.

https://addons.mozilla.org/en-US/firefox/addon/forget_me_not...

Check out Forget Me Not - https://addons.mozilla.org/en-US/firefox/addon/forget_me_not...

I agree. Private browsing takes care of this for me. I close the tab, cookies are deleted, and I will randomly confirm this occurs occasionally just to be certain. There's no need to get all OCD or self-righteous about cookies when Javascript is the scourge. I can not respect any that block cookies but do not surf with Javascript disabled. Though html5 has nearly but not quite made Javascript irrelevant, the scourge seems to now be built in to html.

Agreed - Firefox have very legit, useable workflows for avoiding tracking while still having the web function for you. Chrome has IMO a purposefully unusable approach. It’s theatre, they give you the option, but that option breaks the web so badly that you’re not going to want to use it. Which makes sense, they’re an ad sales company, tracking is crucial to their business.

This is how I use Firefox, things only stored for the session, for the given container. Containers are better than first-party isolation, because many sites expect to share data with third-parties.

It is also better to fake API responses than to block access to them. In Firefox the privacy.resistFingerprinting option takes care of this. It was originally developed for the Tor Browser.

Unfortunately doesn't signal the rejection of tracking by things like fingerprinting.

Reply on news.ycombinator.com