Programmer Humor

parent

[–] pr3d@eviltoast.org 5 points 5 months ago

I don't get it. Of course it doesn't help with IP tracking of fingerprinting, but it deletes all cookies when I leave a site. My browsers runs very long on desktop and mobile, so Firefox's 'Delete cookies on close' doesn't help much.

parent

[–] eager_eagle@lemmy.world 2 points 5 months ago*

"don't lock your door, it does not prevent scammers from getting your home address"

???

yeah, we know deleting cookies doesn't prevent IP tracking, that's also why I use a VPN

parent

[–] MangoPenguin@lemmy.blahaj.zone 2 points 5 months ago (3 children)

Is that needed if ublock already stops all the tracking scripts from loading?

parent

[–] dohpaz42@lemmy.world 20 points 5 months ago (2 children)

Yes. Because cookies are used for tracking and can be set without the aid of Javascript.

For anyone interested, cookies pre-date Javascript and are baked in the HTTP protocol by way of a Set-Cookie header that the browser responds to by storing whatever information accompanies the Set-Cookie header; usually a unique id that can then be used to track what pages on a domain you visit.

parent

[–] Quacksalber@sh.itjust.works 4 points 5 months ago* (1 child)

uMatrix once again to the rescue. It can block cookies. The only downside to uMatrix is that it dis-/allows based on su domain, so you can't accept a log-in cookie and reject the tracking cookie, if they are served by the same subdomain.

parent

Sources:
https://www.wilderssecurity.com/threads/umatrix-development-has-ended.432663/
https://www.ghacks.net/2020/09/20/umatrix-development-has-ended/

[–] DeltaWingDragon@sh.itjust.works 1 point 5 months ago

uMatrix is unmaintained since 2021, that's another downside

parent

[–] HyperfocusSurfer@lemmy.dbzer0.com 14 points 5 months ago (1 child)

It does, if you choose so. Settings -> filter lists -> cookie notices -> easylist/ubo cookie notices + adguard/ubo cookie notices

parent

[–] Multiplexer@discuss.tchncs.de 3 points 5 months ago

Thanks a lot!
Just activated it, and a short test on two of the news sites I visit regularly confirmed it to be working! :-)

parent

[–] joe@lemmy.today 11 points 5 months ago

By default it does nothing about the banners, but blocks most tracking cookies. With some config, it can both enforce a comprehensive cookie policy you set, and hide the banners for you.

parent

[–] MangoPenguin@lemmy.blahaj.zone 9 points 5 months ago

It does, just need to enable the filter list for it. It'll block most annoying things on top of the usual ads.

parent

[–] blackbeans@lemmy.zip 4 points 5 months ago

It helps partially. As it will block known trackers and tracking cookies.

parent

[–] MoonMelon@lemmy.ml 15 points 5 months ago (5 children)

I use Cookie Autodelete. Doesn't matter what I choose, it's getting nuked when I close the tab. Handy to clear out IndexedDB and localStorage too, for sites that only let you read one or two pages before putting up a paywall.

hideshow 5 child comments

[–] eager_eagle@lemmy.world 2 points 5 months ago (1 child)

Does it allow you to select the ones to keep? I'd like to delete everything, but signing into the services every day is annoying as hell, so I'd appreciate a solution to keep the authentication ones.

parent

[–] MoonMelon@lemmy.ml 5 points 5 months ago

Yeah, you can manually whitelist domains (including expressions). I do this for sites where I don't mind keeping cookies around (like lemmy).

parent

[–] MonkeyDumpster@lemmy.org 1 point 5 months ago

yup. this.

https://github.com/arkenfox/user.js/wiki/4.1-Extensions

parent

[–] SwooshBakery624@programming.dev 0 points 5 months ago (1 child)

I'm gonna copy-paste my comment here. Please, don't install such extensions.

Cookie extensions

❗️Sanitizing in-session is a false sense of privacy. They do nothing for IP tracking. Even Tor Browser does not sanitize in-session e.g. when you request a new circuit. A new ID requires both full sanitizing and a new IP. The same applies to Firefox

❗️Cookie extensions can lack APIs or implementation of them to properly sanitize: e.g.

⚠️ [last checked Nov 2024], Cookie Auto Delete even instructs it's users to disable Total Cookie Protection - ⚠️ DO NOT DO THIS ⚠️

As of Firefox 86, strict mode is not supported at this time due to missing APIs to handle the Total Cookie Protection [... followed by instructions]

parent

[–] Ghoelian@piefed.social 8 points 5 months ago

No one said deleting cookies prevents IP tracking. Deleting cookies prevents cookie tracking.

parent

[–] UnfairUtan@lemmy.world 9 points 5 months ago

I'd recommend the Consent-o-Matic extension which works well, even on mobile.

[–] null@lemmy.org 6 points 5 months ago (1 child)

Love it when sites flip the language or the decline buttons to try and trick you into accepting everything.

[–] Venator@lemmy.nz 3 points 5 months ago

Accept Nill Decline Nill

parent

[–] flint@lemmy.zip 53 points 5 months ago (10 children)

In my experience uBlock origin doesn't really get rid of cookie consent banners/dark patterns. Damn good at bonking ads though.

hideshow 10 child comments

[–] QuinnyCoded@sh.itjust.works 21 points 5 months ago

are you sure you didn't forget to install the filter list? it's not on by default

parent

[–] markz@suppo.fi [S] 18 points 5 months ago* (1 child)

Did you enable everything? I think the default is just ad block

parent

[–] dawg@lm.kluge.cafe 4 points 5 months ago

having too many filters slows down pages significantly, you should keep only those you actually need

parent

[–] nutbutter@discuss.tchncs.de 15 points 5 months ago (3 children)

In the filter lists, there are three lists named annoyances. Just enable one of them, and these banners will be gone.

parent

[–] flint@lemmy.zip 3 points 5 months ago

Aah, you are right. Lazy me actually never looked at those. Now I did and it seems to work just fine enabling the Annoyances > Cookie Banners.

parent

[–] not_woody_shaw@lemmy.world -3 points 5 months ago (1 child)

See 2nd panel of comic.

parent

[–] nutbutter@discuss.tchncs.de 4 points 5 months ago

2nd panel means you have to do it again and again for every new website you visit, or if you clear cookies regularly. Using the ublock addon, you have to enable this setting once, and it is persistent across sessions.

parent

[–] zerozaku@lemmy.world 2 points 5 months ago (2 children)

Also getting rid of cookie banners doesn't mean the site won't track with third party cookies. The cookies are ON by default and until you tell them to turn it OFF, they keep the cookies on.

parent

[–] flint@lemmy.zip 5 points 5 months ago (1 child)

That's a good point. However in the EU it should be the opposite - otherwise the site is violating GDPR.

Sometimes I have a feeling sites do whatever they want anyway regardless of bow many dark patterns I click through to find the "no" and "off" buttons because there are no real repercussions. Just like the "do not track" request and "robots.txt" are essentially useless.

parent

[–] zerozaku@lemmy.world 2 points 5 months ago

However in the EU it should be the opposite - otherwise the site is violating GDPR.

Damn then that's great for EU users. You can really see how scummy these companies are on how they treat GDPR and non-GDPR countries.

parent

[–] dual_sport_dork@lemmy.world 75 points 5 months ago (6 children)

And,

hideshow 6 child comments

[–] M1k3y@discuss.tchncs.de 10 points 5 months ago

Cookie autodelete has whitelists, optionally different per container.

parent

[–] Kangae_Hishiryo@scribe.disroot.org 0 points 5 months ago (4 children)

Thanks, but not thanks, I don't want to be logging in every site every single time I restart my browser; I just simply use AdNauseam with DandelionSprout lists (not all tho), NoCoin lists, the integrated lists, then I use Decentraleyes for not having to depend on external CDNs for almost anything, HaGeZi as my DNS provider, and OpenSnitch for system-wide interactive blocking of any suspicious domains or IPs...

Oh, and hBlock, just to add a little more of paranoia, and ClamAV with Clamd and ClamOnAcc.

hideshow 4 child comments

parent

[–] Turret3857@infosec.pub 5 points 5 months ago (3 children)

If you were truly paranoid youd log into every site every time with an offline password manager protected by a yubikey.

parent

[–] DeadDigger@lemmy.zip 6 points 5 months ago (1 child)

Yubikey had a problem, yubico sold old devices with the problem and initially didn't want to patch it at all so they are pretty crispy burned if you are truly paranoid https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

parent

[–] Turret3857@infosec.pub 1 point 5 months ago

damn wtf. good thing I'm not that paranoid :P

parent

[–] Kangae_Hishiryo@scribe.disroot.org 3 points 5 months ago

I can't afford a YubiKey, and also I don't have the time to do that ad infinitum. Just not my thing.

parent

[–] 9point6@lemmy.world 37 points 5 months ago

Consent-o-matic is good too

I prefer to make things explicit if it can

[–] megopie@lemmy.blahaj.zone 31 points 5 months ago* (1 child)

“ NOOO YOU DON’T UNDERSTAND BRO! OUR BUSINESS MODEL DOESN’T WORK IF WE CAN’T DO MASS SURVELIANCE BRO!”

[–] bstix@feddit.dk 6 points 5 months ago

I DECLARE "LEGITIMATE INTEREST" !!

parent

[–] BeUnique@lemmy.zip 26 points 5 months ago (9 children)

That shit should be illegal. Accept all / reject all. That's it. If somebody is disabling cookies, literally nobody in the entire world wants any of them! "Oh yeah, please, only keep my location data but not the data about my purchase decisions"...

hideshow 9 child comments

[–] WrathEnchanter@europe.pub 6 points 5 months ago (8 children)

I have good news for you: In the EU (which forced everyone to have the cookie-accept-banners in the first place) it IS illegal.

hideshow 8 child comments

parent

[–] rmuk@feddit.uk 15 points 5 months ago (6 children)

The EU didn't force anyone to have the cookie banners. If the site only uses nessecary cookies - the kind you can't turn off in the prompt - there doesn't need to any prompts because that's perfectly fine. The intrusive, obnoxious and deliberate confusing popups are from data harvesters throwing a tantrum because they can't stalk you every waking second any more, and complying in the most malicious and disrespectful way they can.

Cookie banners are nothing to do with the EU and everything to do with tech-bros.

hideshow 6 child comments

parent

[–] dreadbeef@lemmy.dbzer0.com 5 points 5 months ago* (last edited 5 months ago)

The EU knew about DNT signals before GDPR was finalized and decided to ignore them. I know, I was a web dev at that time (and still am, yes I'm ancient in internet years). This is on the EU and techbros, but having internet explorer and other browsers like firefox (not sure if chrome did it?) enabling DNT by default would make tech bros upset, and the EU couldn't have that, so they made the tech bros a little happier by allowing the consent banners instead.

From the working party back then, which was promptly rejected in the final GDPR we have today:

2016

The Working Party recommends rephrasing the requirements in the current Recital 66 of Directive 2009/136/EC. Instead of relying on website operators to obtain consent on behalf of third parties (such as advertising and social networks), manufacturers of browsers and other software or operating systems should be encouraged to develop, implement and ensure effective user empowerment, by offering control tools within the browser (or other software or operating system) such as Do Not Track (DNT), or other technical means that allow users to easily express and withdraw their specific consent, in accordance with Article 7 of the GDPR. Such tools can be offered to the user at the initial set-up with privacy-friendly default settings. Adherence to accepted technical and policy compliance standards must become a common practice. In addition, website operators should respect and adhere to browser control tools or other user preference settings.

2017

The Working Party recommends that terminal equipment and software must by default offer privacy protective settings, and offer clear options to users to confirm or change these default settings during installation. The settings must be easily accessible during use. Users must be enabled to signal specific consent through their browser settings. Privacy preferences should not be limited to interference by third parties or be limited to cookies. The Working Party strongly recommends to make adherence to the Do Not Track standard mandatory.

Heck, the W3C was even talking about working to make it happen.

Point is, the EU sucked up to corporations, surprise surprise.

Receipts:

https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/index_en.htm

https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2016/wp240_en.pdf

https://ec.europa.eu/newsroom/article29/redirection/document/44103

parent

[–] WrathEnchanter@europe.pub 1 point 5 months ago (1 child)

I mean.. The EU could've also said 'no privacy invasive cookies' instead of 'cookie Banner if privacy invasive cookies'. I don't think being able to disable is bad, I think they didn't go far enough (and also of course datapeople only comply in the most malicious way possible. It's literally their job, a job that shouldn't exist.)

parent

[–] bless@lemmy.ml 2 points 5 months ago

Even the idea of tightening regulations for igaming has many EU countries frothing at the mouth, what makes you think that this didn't start as "no privacy-invasive cookies?"

parent

[–] Magnum@infosec.pub 0 points 5 months ago (2 children)

It is not fine, you still need to be informed and accept

parent

[–] rmuk@feddit.uk 4 points 5 months ago (1 child)

If the cookies are nessecary for the site to technically function, you don't need to be promoted to accept. The law - which doesn't even mention cookies - allows the absolute minimum amount of data required to provide a service to be gathered. For a website, that included cookies for storing preferences, shopping baskets, login tokens, etc.

parent

[–] Magnum@infosec.pub 0 points 5 months ago*

But it must still inform you and give you the right to not use the service if you don't want this form of collection happening, its just that you can't use the service and refuse the bare minimum they need to operate.

parent

[–] BeUnique@lemmy.zip 2 points 5 months ago

It was pretty crazy taking my phone from the United States to the EU and seeing all of the notifications of how my data is being shared by "free" apps! It just goes to show that the saying "if the product is free, you're the product" is 100% true!

parent

[–] communist@lemmy.frozeninferno.xyz 21 points 5 months ago (2 children)

Consent-o-matic is a better system, it actually inputs what you want it to answer for cookie banners

[–] markz@suppo.fi [S] 15 points 5 months ago (1 child)

I don't really care if the box gets an answer or not

parent

[–] ieGod@lemmy.zip 3 points 5 months ago

Amen. If the endpoint serves up the content I'm looking for our interaction is over. The site doesn't need a response.

parent

[–] Wispy2891@lemmy.world 21 points 5 months ago (1 child)

I wonder how they can even find those 1142 partners to share my browsing data with

[–] rob_t_firefly@lemmy.world 13 points 5 months ago

Poly culture is freaking wild.

parent

[–] kalpol@lemmy.ca 13 points 5 months ago

I still run umatrix in Firefox snd the level of calling out that even simple pages do is shocking. And likely all those called sites even for fonts are collecting something about you.

[–] VinegarChunks@lemmus.org 12 points 5 months ago

I want websites to all have a button that says “yeah you can sell my personal data but the website contractually agrees to give me half”

[–] Zink@programming.dev 11 points 5 months ago (1 child)

Yeah sure, give me whatever cookies aren't already blocked. I love cookies. Is that all of them?

(closes LibreWolf, which nukes everything except whitelisted sites)

...pathetic.

[–] MissyBee@lemmy.blahaj.zone 3 points 5 months ago

That plus containerised tabs for "dirty" websites

parent

[–] hansolo@lemmy.today 9 points 5 months ago

99.5% browsing in private mode

folds up the mat and goes home

[–] kingblaaak@lemmy.world 8 points 5 months ago

Is this page worth my time....nope

*closes tab

Onto the next tab

[–] buddascrayon@lemmy.world 5 points 5 months ago (3 children)

Not if you're using a Chromium based browser. Ublock Origin no longer supported in Chromium v3.

[–] lyralycan@sh.itjust.works 1 point 5 months ago (1 child)

You can't get it from the store, but it still works as long as you already had it, install using a browser running Chromium V2 before updating, or install it from file, right? Better yet, switch to Firefox (but the most de-Mozilla'd one)

parent

[–] buddascrayon@lemmy.world 2 points 5 months ago*

No it won't work. Chromium V3 disables or removes features that it relied upon to work. That's not to say they might not have found a workaround. But I'm sure it's harder and doesn't work as effectively.

Edit: also Firefox does not use Chromium. So yes switching to Firefox is a viable option. But in no way part of my point.

parent

[–] Truscape@lemmy.blahaj.zone 1 point 5 months ago

There's your problem, pally.

parent

[–] NotASharkInAManSuit@lemmy.world 4 points 5 months ago

LibreWolf, is my response.

[–] zeroConnection@programming.dev 4 points 5 months ago (2 children)

Use adblocking DNS on your router, so you don't need to mess with every device separately

[–] dafta@lemmy.blahaj.zone 8 points 5 months ago (1 child)

DNS blocking doesn't work with cookie prompts since they're from the same domain as the website. You need something like ublock origin which has the feature to block specific DOM components on the website.

parent

[–] zeroConnection@programming.dev 2 points 5 months ago

But they will block those tracking cookies even if you "accept" to being tracked. But yeah, good point, best to combine both