At some point I just stopped reading sites that make it too hard to opt out. Though I would really like to have a browser that automatically opens links to such sites in incognito mode, accepts the popup for me, and makes sure everything is thoroughly deleted afterward.
If you block the domain in umatrix it basically does that.
For instance techcrunch redirects me to some "guce.advertising.com" url and umatrix blocks it https://imgur.com/bxGAbiH
Oh, that's too much work. I've been using Cookie AutoDelete for Firefox and I've set it to clear all non-whitelisted cookies a couple of hours after last visit. This way I have to click once if I visit a couple of times a day.
I use Vanilla Cookie for Chrome (it deletes all non-whitelisted cookies after some time or after closing the browser), and have been thinking about making a browser extension that just hides all fixed elements and transparent full size elements. The reason for me thinking this, is that nowadays I just accept almost everything, and trust the Valinna cookie to clean up afterwards. What do you think about this?
The first bookmark on my bookmark bar is "Kill floater", and it removes most floating elements on the page. It even works on many sites that hide the page behind a popup. Use it on my iPad all the time.
I cleaned up and improved this a little. Now it hides the fixed elements, unless their computed top is at 0px. Also makes the body to scroll automatically, as many sites set their body to fixed before the fixed popup is gone:
```
javascript:(function () {
var i, elements = document.querySelectorAll('body *');
var style;
document.body.style.overflow-y = 'auto'
for (i = 0; i < elements.length; i++) {
style = getComputedStyle(elements[i]);
if (style.position === 'fixed' && style.top !== "0px") {
elements[i].style.display = 'none';
}
}
The chrome and firefox extension I made: https://baitblock.app has a feature called tracking resistance. It deletes cookies on websites that you are not logged into automatically
Logins are a common enough use case that browsers should simply support it directly, and drop support for cookies entirely.
There's no reason we can't have sites set an auth token, and send that in under the Authorization header. And then when you want to sign out of a website, you can have a button for that in the browser. The tooling already exists in the HTTP standard, it's just that it's only widely used for server-server communication.
Bingo. "Auth Token" simply becomes "Session ID", and the backend then tracks anything it wants as part of the session.
I don't see much of a solution other than making it a matter of policy, eg. Microsoft's "P3P" header. Otherwise authentication credentials need to be supplied with every request. Not a session id or token as a cookie, but the actual username and password being supplied with every request. Basically the old http basic auth, but with a more modern system to replace it.
I understand the core idea behind the EU's desire, but the fact is that cookies are absolutely required for login sessions, and it's impossible to allow users to opt out. The EU doesn't understand the tech behind the laws they are trying to enforce, and this is where it leads to. Absurdity.
Yes. However, there are some upsides: having an auth token which from the perspective of the browser is limited to auth, makes it more explicit when the browser is passing an auth token to the site: if the browser shows a "Log out" button, then you're providing that auth token--if you didn't log in to a website and suddenly you have the option to log out, that's very obviously weird. Of the perhaps 10 sites I visit on a regular basis, I only even have logins for 3 (email, Reddit, HN) so other sites would be slightly hampered in tracking me.
That requires separate opt-in consent according to GDPR.
GDPR is absolutely not about cookies, it's not about having private information but about uses of it. You may have a legitimate need to collect some data - that auth token for login purposes, the customer's address for delivery, etc. That's fine, it allows you to collect and use that data for that purpose. But it does not mean that you're automatically allowed to use that login token or delivery address you have on your servers for other purposes such as selling or giving it to third party advertisers.
