Self-Destructing Cookies | Hacker News Reader

Self-Destructing Cookies

addons.mozilla.org

133 pointsdsr_47 comments

While this is an awesome extension, it is annoying living in the EU to continually see "This site uses cookies, click 'accept' to acknowledge and continue to the site" every time I visit a site that has had its cookies cleared, since the acknowledgement is stored in a cookie that is subsequently cleared when the tab is closed.

The irony is fantastic.

How came that crap to pass and become some EU thing anyway?

Whats the big deal about EU and cookies?

People complained that cookies were being used by advertisers to track them.

The EU decided to take action by mandating that companies make it visible when this was happening, in the Directive on Privacy and Electronic Communications[1].

Since it's technically impossible to allow the benefits of cookies without opening privacy holes, I don't really know what else privacy campaigners were hoping to achieve.

[1]: http://en.wikipedia.org/wiki/Directive_on_Privacy_and_Electr...

People used to care about privacy. The EU wants to protect people's privacy. Passing EU law takes a considerable length of time. By the ti e the law passed it had been made weird by bureaucrats and obsolete by time. Now there are many worse privacy invasions and most people don't care so much about privacy.

It's an example of why we are doomed.

The law was caused by a combination of dumb/naive politicians thinking they were preventing tracking/spying and self righteous political opportunists pretending they were in the first group. They had a vague understanding of what cookies are and how they work and made a law that is the equivalent of painting a second lock on a door for extra security.

The net result is that they have effectively mandated nag screens and done nothing to protect anyone's privacy.

Having politicians with a "high level understanding just doesn't work here. Cookies are controlled by the browser and the browser is controlled by the udder so the sensible solution is for the browser, not the law to make rules about who should be able to set them when.

I listened to some parliamentary comitee hearing once about parental controls online. It was being chaired by some arrogant and clueless parliamentarian playing the concerned mother. It was horrifying. Like listening to Pointy Haired Boss reprimanding Charles Darwin.

We're doomed!

You can block EU cookie notices with Adblock Plus if you add Prebake filter or you can manually add them to ABP (for that I use Element Hiding Helper) on pages you visit regularly.

Prebake filter: http://liamja.co.uk/Prebake/

Element Hiding Helper: https://addons.mozilla.org/en-US/firefox/addon/elemhidehelpe...

This'll probably be an unpopular comment but I feel the need to point out that this is good (in the ways that made this post popular) and bad.

Bad because for the dot com company I work for, we use cookies to make sure we don't show users 'helper' tooltips more than once per 30 days and cookies is one of the better ways of doing this. It also helps us anonymously track a user location to show better search results, user currency etc.

There are many bad ways a website can use cookies, but by using a plugin like this, it'll ultimately just ruin your own user experience.

These users can hide 'helper' tooltips by their own.

For years ive been browsing with clear cookies after each session. What you describe with first visit notification is not common at all. And when sites actually do it, its usually very subtle and can be ignored like the notification bar on the top of stackoverflow. I can only name one website where I am annoyed by the lack of cookies and that is when youtube doesn't remember my preferred video resolution. Otherwise browsing with fresh ones has no degraded user experience for me.

Actually this is starting to become worse though after EU introduced the must notify about cookies law last year. The ones who do clear their cookies once in a while are punished by being notified about them time after time while the others will blindly click OK and never see the message again.

> when youtube doesn't remember my preferred video resolution

https://addons.mozilla.org/en-US/firefox/addon/youtube-cente...

This is (IMHO) a bad UI approach on your side anyway.

If these tooltips are valuable, why are they visible (prominently displayed) only on the first visit? And if they are not valuable (most of the sites overvalue their content - visitors stats should help you assess that) you should just get rid of them anyway.

I am not saying cookies don't have their place, but being misused as they are I like keeping my cookie jar clean too.

Well it's up to the user whether they prefer privacy or better user experience.

You can easily whitelist sites you visit often/where you don't mind about them tracking you & prefer the better user experience..

Another example: even with standard browser settings and without that kind of plugin, I often get the annoying "we use cookies" warning mandated by European regulations, on the same website.

As someone who has Firefox configured to never store history, cookies, session, whatever, basicly constant Private Browsing Mode, I blame your website for bad user experience.

In the mind of the your users it is never going to be their own fault that tooltips keep showing up on your website, they'll blame you.

One way of fixing it: Only show a tooltip if the user have a cookie older than a day. No one will get a tooltip on their first visit, but that seems acceptable.

Wait.. How is that acceptable? The first visit seems the time that you would need the tooltips the most!

Cool! I wrote a similar extension for Chrome that simply enforces a user-adjustable maximum cookie lifetime (e.g. 21 days instead of 10+ years...). This seems to provide a good balance for login cookies that you don't necessarily want removed every session.

https://github.com/semenko/chrome-limit-cookie-lifetime

https://chrome.google.com/webstore/detail/limit-cookie-lifet...

(And the same for Chrome's ever-present history:

https://github.com/semenko/chrome-limit-history-lifetime

https://chrome.google.com/webstore/detail/limit-history-life... )

Note the "clear browser cache when idle" option aggravates a referrer logging side channel for sites embedding Google Ajax libs or Analytics.

That aside, I'm in love!

Can you explain why?

Nuking those scripts from the cache means that they get re-requested more often, and the request has its referrer sent to the server hosting the tracking script which means the referrer+ip pair can be logged.

And that's where RequestPolicy comes in: https://addons.mozilla.org/en-US/firefox/addon/requestpolicy...

I already use No-Script. I tried addeding RequestPolicy but the combination is just too much work for normal browsing.

You can use something like https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ to control who gets your referer. I default to no one and make exceptions for poorly coded websites.

I've been wondering for many years why this isn't the standard behaviour of web browsers.

Just like "click to flash" and other plugins that should only run when I authorise them once, or always if I whitelist them.

This is a very good extension, I have been using it for a while. It is very much the best of both worlds, using cookies to login, then deleting them when you leave the site. You don't have to worry about whitelists, etc.

But without whitelisting, I wouldn't know how much of the web is completely broken without cookies, where by "broken" I mean a blank page, or just a little strip of the template. This includes blogs, one-off demos, and other sites that don't require (or even offer) log in or settings of any kind.

I can only conclude that some common frameworks depend on cookies for their own operation, and that in many cases the developers aren't even aware of the "problem".

I switch browsers more than I switch underwear, mostly between Safari, uzbl, Firefox, Chrome and TOR Browser (FF fork). When I write extensions I do it for the browser I currently fancy, so I've got a few ones for Safari, Firefox and Chrome. But when I switch I lose the old ones, until I switch back.

Right now I'm in Safari (silky smooth rendering), and can't use this. That sucks. But FF, Chrome and Safari extensions are just JS anyways. Why can't they be automatically ported, or something? What's stopping Mozilla from enabling Firefox to run Chrome and Safari extensions, and vice versa?

Because they interact with different APIs.

Different browsers provide similar APIs in different ways sometimes, and usually web standards support differs between browsers.

Any idea if someone has written an abstraction layer for this yet?

Aside from the obvious (API's), the use case you describe see,s incredibly small - likely too small to justifiably target.

I love this extension and have been using it for a long time! It makes it convenient to use a single browser to access multiple Gmail (or other mail or any other service provider) accounts without having to clear cookies manually and without having to associate or link accounts together (the latter is something Gmail allows, but I prefer not to use it). Just close the tab and the cookies are gone, allowing a new session to begin.

The same holds good even for web searches, though I rarely use Google/Bing and instead use start page or DuckDuckGo.

Nice! I wonder if it clears cache too?

EDIT: apparently it does.

BTW, you can check if you can still be cookie / storage / cache-tracked here: http://www.canyoutrackme.com/

For me it didn't work. I was still tracked by - Cache, - ETag.

ditto.

Also, I had to close my browser for the test to be allowed to work (session expiry). I tried closing the tab, but that's not enough.

For me that is an unfair test as I hardly ever close my browser down completely.

IIRC, SDC does not immediately clear cookies/cache on tab closing. It purges them on a scheduled interval. If you close the tab and wait a while (you should eventually see a toast message, if you have them enabled, saying something like "deleted x cookies from blah.com"), then your session should be removed. Closing the browser runs the purge immediately which is why that was working for you already.

So, what other extensions can we ditch now?

I really like the UX of SDC; are Disconnect or DoNotTrackMe just clutter, or adding value still?

Can't you already set Firefox (and Chrome?) to only keep cookies around for the session?

This deletes cookies /during/ the session. After you close a tab, any cookies unique to that tab's history are cleared

And not just when you close a tab... also a short time (configurable, default 10s) after you navigate away from a site in an "old" tab.

Persona is not working when I enable this addon.

Persona uses third-party cookies, so this is expected with this add-on. If you whitelist persona.org (e.g., just visit persona.org and set self-destruct to "never"), then Persona works fine.

Is there something similar for Chrome?

There's a setting for both 'Keep local data only until you quit your browser' and 'Block sites from setting any data' under Cookies in stock Chrome.

I don't use it though, so not sure of the effectiveness.

Not exactly. You have to quit the browser. Using this FF extension, you just have to close a tab. So there's no such option available in Chrome.

If you care about privacy don't use a closed source browser especially not from Google...

I use Chromium. As it happens, Chromium and Chrome have the same extension system. Thanks for your half-arsed "concerns", though.

Reply on news.ycombinator.com