Ask HN: Should I accept all cookies? (and clear them shortly after?) | Hacker News Reader

Ask HN: Should I accept all cookies? (and clear them shortly after?)

18 pointsogeiczvm7 comments

Hi,

My browsing setup on desktop is Firefox with temporary containers, ublock origin and a few other plugins. On iOS I'm using Firefox Focus most of the time with the occasional Safari window in Private Browsing mode (which has a similar behaviour to temporary containers plugin, all tabs are completely isolated).

On desktop ublock origin hides all cookie popups (thus not accepting anything) but on iOS I've been going through their hoops of going into advanced mode, toggling everything off and 'confirm my choices'. I've been doing this on principle only because the average lifetime of a tab (session) is only a few minutes so all cookies would be deleted anyway.

But recently I was wondering - have I been doing it wrong all along?

I'm not sure how cookie tracking works these days as last time I dealt with them server side was back in the PHP3 days but if my understanding is correct, accepting cookies means that the data brokers would have to keep a few bytes (cookie id) in their database for at least a short while hoping that I'd return.

So - would I pollute (and take a tiny bit of disk space) the data brokers by accepting their cookies and clearing the session afterwards instead of refusing the cookies?

Thanks.

The annoying modals are not so much about cookies but consent. If you agree to be tracked, you will be tracked.

A cookie is just one technical solution to identify your device and many more exist, such as your device fingerprint. You may not want to be tracked even though it’s session per session too.

Check your browser there: https://coveryourtracks.eff.org/

In my case I have a common iPhone which is good against device fingerprinting, but I’m also a French speaker first in my timezone (Europe/Oslo) and all the information my browser sends in HTTP headers makes me unique.

This. One more website showing how you can be tracked: https://www.amiunique.org/.

How common is browser fingerprinting when it actually comes to ad retargeting though? This isn't really the domain I work in so I could be off base here, but AFAIK none of the major ad networks use browser fingerprinting to deliver ads. Trying to use browser fingerprinting for ad retargeting/ad delivery would inherently be much difficult than with cookies (in most cases you won't uniquely identify users, and even if you were uniquely identifying a particular user how would you know?) and if ad networks were building profiles of users based on fingerprinting data they'd still be subject to GDPR and other related privacy laws. Obviously the technical issues and GDPR compliance are all things that can in principle be worked through, but to my knowledge no major ad network is doing this.

> they'd still be subject to GDPR and other related privacy laws

Just like they currently are breaking the law by using non-compliant data processing consent flows (90% of the "cookie consent" flows you see out there don't comply), and how they broke the law for over a decade before the GDPR (turns out GDPR had prior art in most EU countries)?

GDPR penalties are not enforced anywhere near enough for it to be a deterrent.

I maintain marketing systems for a living. Not sure what you are hoping to achieve, so it's hard to know what you are doing "wrong" but to clarify a few things:

- There's a pretty big difference between how first-party and third-party cookies behave. First party ones would live on the actual webhost of the site/service you are using. Third party cookies would be the responsibility of the advertiser/etc.

- All of these systems are designed for massive scale. Out of the thousands of random hits in a given day to a webpage, only a few dozen might return in a meaningful time period. So cookies are designed with a lot of disposability.

- If you maintain an account of any sort on the website in question, it could all be irrelevant anyway. If we have a user or customer ID, and we recognize that you are a customer, we'll merge your cookie IDs together whenever we recognize you. (Or forgo cookie data altogether).

AdGuard for iOS is compatible with uBlock-style filters and some of the EasyList ones will clear the cookie crap just as well as on desktop.

Most tracking nowadays is based on heuristics such as browser fingerprinting, IP addresses, etc in addition to cookies (as browsers started having built-in countermeasures against those) - clearing cookies is unlikely to be effective.

Don't bother interacting with the data processing consent forms - the majority of them aren't implemented properly and load malicious third-party scripts (at which point they already got your IP and browser fingerprint) and just rely on "asking nicely" the scripts not to track.

My recommendation is to always use private browsing mode - this will clear not just cookies but any form of local browser state that can be used for tracking. Coupled with an ad blocker it's about as good as you can make it.

One approach I cooked up ten years ago:

1. Accept all cookies

2. Every week, On Google Chrome, review the cookies you have collected.

3. Block cookies that you don't want. And clear on exit those cookies that you need but don't want to persistently track you.

Firefox solution is yet to come. I use uMatrix to block all third party cookies and selectively add them.

Mobile browser solutions suck! Except maybe firefox on android sucks less if you get it to work right.

Reply on news.ycombinator.com