Death of Cookies, Spyware Greatly Exaggerated?

securitas writes "The New York Times' Bob Tedeschi interviews several Internet marketing leaders who debate recent reports that Internet users are deleting cookies en masse and causing serious problems for advertisers. Among the interviewed is Eric Peterson, co-author of the Jupiter Research report that claims 39 percent of Internet users delete cookies. Slashdot has recently had stories about this supposed trend in June and July. A shorter version of the article at IHT. Who is telling the truth and who is deleting cookies? Are you?"

Comments

Yes

[It doesn't come easy]

[...]who is deleting cookies? Are you?

Routinely and automatically. I don't need any help in remembering my ID, password, or credit card number, thank you. And I don't want any company tracking my every move on the net just so they can turn around and sell information about my personal habits, whatever those habits may be.

Here's a challenge for all the companies (and individuals) out there who think it's perfectly acceptable to track and profit from every personal detail you can get your hands on of the people who interact with you. I'll let you track and profit from everything I do if you let me track and profit from everything you do. Complete discloser in both direction. Anything less is unacceptable.

Re:Yes

[Anonymous Coward]

I don't bother to delete cookies ever. I really just don't give a shit whether I'm "tracked" or not. I block most advertising anyway, it really doesn't matter.

Re:Yes

[thc69]

Complete discloser

Wouldn't that be more easily expressed as "Complete opener"?

Re:Yes

[soma_0806]

Here's a challenge for all the companies (and individuals) out there who think it's perfectly acceptable to track and profit from every personal detail you can get your hands on of the people who interact with you. I'll let you track and profit from everything I do if you let me track and profit from everything you do. Complete discloser in both direction. Anything less is unacceptable.

I think there is an even better solution. The only reason I have a problem with the whole cookies thing is that what is being taken from me has a commercial value. If the people collecting my preferences can sell them to larger companies or profit by them by tailoring product lines and advertising, then money is being exchanged for my opinion.

If money is being exchanged or made from my opinion then the one individual that most deverves some or all of that financial gain is the original owner of the opinion/preference (me). However, through the cookies scheme, I'm the only one not getting paid.

If I own something that has value and someone else takes it and prevents me from profitting myself from it, that is theft, plain and simple. I don't want someone else's prefences in exchange for mine. I want the monetary value of my opinion.

Re:Yes

[It doesn't come easy]

Cute. To "disclose" literally means to take something that is closed and to reverse the closedness of it. Instead of saying the obvious "open" as you suggest. Don't you just love the English language?

Re:Yes

[thc69]

Look up "discloser". Then, look up "disclosure".

(I thought it would be obvious in my last post.)

Re:Yes

[SB5]

"I want the monetary value of my opinion."

Here's your two friggin' cents... Some people, I tell you!

Re:Yes

[It doesn't come easy]

Oh, sorry, misspelling. Thanks for letting me know.

Re:Yes

[BlogPope]

If I own something that has value and someone else takes it and prevents me from profitting myself from it, that is theft, plain and simple.

And how do you figure you "own" the information? You visit site X, doesn't the list of people who visit site X belong to site X? Do you "own" the fact that you drive to work every morning at 8am? Do you "own" the fact that I saw you walking your dog in front of my house this morning? Did the traffic reporter steal from you when he reported the congestion you were stuck in? Did the newscaster steal from you when he reprted the headcount of the "Million Moron March"?

You want to block cookies, fine. I'm sure you accept the consequences of your actions, no problems. The the concept that someone who is taking the effort to aggregate the behavior of millions is stealing from you personally is stupidity.

Re:Yes

[Anonymous Coward]

For once it's the companies benefiting from 'fair use' of information.

Re:Yes

[jesuscyborg]

I'll let you track and profit from everything I do if you let me track and profit from everything you do. Complete discloser in both direction. Anything less is unacceptable.

Well next time you delete that Google tracking cookie, remember that you can download all the information they publish to shareholders and press releases any time you want.

Re:Yes

[imstanny]

^LOL. 60% Funny. 40% Insightful.

Re:Yes

[Will2k_is_here]

Hey, is there any browser that denies all requests to read cookies except if you are actually visiting that domain at that particular time? Or extensions to accomplish this?

Re:Yes

[Anonymous Coward]

I own my info at least as much as you think they do.

Re:Yes

[thc69]

Sorry, my "" tags failed to show up in the post. Maybe I should have used the Preview button...

Re:Yes

[saur2004]

[aol]Me Too[/aol]

Ive even been known, not to use some websites that dont work unless you allow a cookie. (i.e. OfficeMax)

Re:Yes

[Anonymous Coward]

Here's a challenge for all the companies (and individuals) out there who think it's perfectly acceptable to track and profit from every personal detail you can get your hands on of the people who interact with you. I'll let you track and profit from everything I do if you let me track and profit from everything you do. Complete discloser in both direction. Anything less is unacceptable.

As a Slashdot reader who routinely removes all cookies, I don't have a problem with people that delete cookies for whatever reason it is. I do, however, find it a tad bit troubling that you feel that people are tracking your every, personal move. With some spyware and other slightly less benevolent sites, this may be the case, but in most of the cases there are no direct links to you as an individual.

I should probably disclose the fact that I work in the marketing department of a very large ad agency, so in that sense I may be a bit biased. That said, habbit watching really is harmless to say the least, and usually useful, even when it has absolutely no ties to the name or identity of an individual.

You see, advertisers are NOT interested in pissing off the customer. Believe it or not, most advertisers would very much want to see happy customers, not pissed off ones. That's part of the entire reason why user habbits are recorded. Simply to gather trends, likes and dislikes, and hopefully provide products and services that better fit what the consumer wants, and removing what isn't wanted.

I don't pretend to believe that habbit tracking is a one-stop catch-all solution, or that there aren't annoying commercials, but the intent of such tracking and data gathering is explicitly to try and get people that are INTERESTED IN THE FIRST PLACE to get exposure to whatever they are selling, and NOT expose people that aren't. You see, one way or another, exposure to someone that isn't interested still costs the advertiser money, and may even lend to negative image reception. Not a good thing. What we would ALL like to see is ads we're interested in seeing, and none that we're not. The reason people are a bit pissed over ads is because it's something they don't want, and could care less about.

You do have the freedom to remove these cookies, mess with their content or whatever. You're not obligated to feed data. However, to say that all cookies and data collection is evil, is naive at best and most likely ignorant. Without such forms of tracking, be it on the web or in real retail outlet, you would likely end up with a bunch of stores that don't carry what you want, and have trouble finding services you're interested in.

Of course, these comments are probably not terribly appreciated on /....

Re:Yes

[Anonymous Coward]

remember that you can download all the information they publish to shareholders and press releases any time you want.

So? The SEC makes them do that. It isn't out of the goodness of their hearts that they do it.

Re:Yes

[psyon1]

The only reason I have a problem with the whole cookies thing is that what is being taken from me has a commercial value.

TAKEN from you? If the company has the information to put it in a cookie, then you had to have GIVEN it to them in the first place.

Re:Yes

[The Spoonman]

I have to ask: habbit? Isn't that what happens when Bilbo mates with Hazel-rah? :)

Re:Yes

[sporktoast]

Both accepting every cookie (as the marketers would prefer) and blindly deleting them all, (the simplest response) are just too extreme. The sweet spot for me is in the middle.

My cookie file is read-only at the file system level. It has fewer than 10 cookies in it, all of them hand filtered. This effectively makes every other cookie a session-based cookie, without having to to be nagged about it every time.

Each time I come across a site that offers me the opportunity to remember my login, I consider whether to add it to the list. I explore the site, to see whether it is actually worth it. I inspect the cookie for what else it contains, and maybe it goes in.

Outside of that, I have the usual Preferences-based options selected for security. (Allow from originating site only, etc.) I also hand-edit cookies like Google's to nullify unnecessary GUIDs. On a few of them, (Slashdot, NYT) I actually delay the expiration date so that I don't have to fiddle with them every year.

I'd say that I add maybe one new cookie a year, and update another one to accomodate some site's change in cookie format.

Re:Yes

[utopianfiat]

I don't own my sig, I voluntarily gave it to /.

Re:Yes

[Evil Grinn]

Hey, is there any browser that denies all requests to read cookies except if you are actually visiting that domain at that particular time? Or extensions to accomplish this?

You mean a browser that doesn't send your cookie from hotmail.com to the slashdot.org web server?

Any browser that supports cookies, ever since they were invented.

With the exception of browser bugs, cross-site scripting, etc., obviously, but this is a basic part of the cookie spec.

Re:Yes

[Will2k_is_here]

No, I mean if I'm visiting slashdot.org only my slashdot cookie can be read and osdn.org should not be allowed to retrieve their cookie.

Re:Yes

[Phred T. Magnificent]

The number of people who visit site $x belongs to site $x. Any identifying information about those people belongs to the individual people who visit the site.

The fact that you saw "someone" walking "a dog" in front of your house this morning is fairly innocuous. Be very careful, though, when you start identifying who, or whose dog.

A good body of privacy law will be based on the notion that any and all identifying information about me, belongs exclusively to me, and my not be used, published, stored or distributed without my express written consent. Nothing that falls short of that standard is adequate.

Re:Yes

[fbjon]

Exactly, by visiting a company's website, you have already given them the information that you have visited their website. No information is, or can be stolen. Unless they use some exploit and grab your addressbook, that's stealing.

Re:Yes

[Yahweh Doesn't Exist]

Safari has the option to only allow cookies from sites you actually go to, which is what you descibe.

Firefox has a weaker option of only allowing cookies from the originating site but you can also make it ask you.

Re:Yes

[Yahweh Doesn't Exist]

on second look, you're talking about reading not writing so...

Re:Yes

[Bad to the Ben]

However, through the cookies scheme, I'm the only one not getting paid.

Yes, you are getting paid. You get to use the website. Unless of course you'd like to pay for each time you click on a hyperlink?

Hosting a large website can be expensive, so I don't really object to SOME advertising / cookies. As long as the information is reasonably harmless to me, and the ads not too intrusive, I consider it fair.

Re:Yes

[GeekZilla]

AC: What we would ALL like to see is ads we're interested in seeing, and none that we're not.

No. Some people would prefer not to see ANY ads. Are you new here?

Re:Yes

[Progman3K]

"The the concept that someone who is taking the effort to aggregate the behavior of millions is stealing from you personally is stupidity."

The concept that people harvesting millions of other people's information won't abuse it is also stupid.

Re:Yes

[Anonymous Coward]

Do you think that's air you're breathing?

Re:Yes

[JonathanWardRogers]

Perhaps I'm missing something... What does a cookie track that you don't freely give? If you allow cookies and browse a site/fill out a form, you've given that information to the site. If you don't want them to own it, don't give it away.

Re:Yes

[ThaFooz]

I want the monetary value of my opinion

You've already got the monetary value of your opinion - free content & cheaper online prices.

Any content provider only has two realistic options for revenue - paid subscriptions and/or advertising. Online stores are able to undercut 'traditional' stores and operate on much thinner margins because of the lack of 'middlemen' and their ability to track user patterns and adjust their inventory rapidly. If you want content from somebody, is it unreasonable to ask for something of value from you? If you don't want to provide information, be preparied to provide $. Slashdotters can scream 'all information should be free' all they like, but I don't see to many giving away their work for free & paying for the hosting costs of a large distributed site.

Re:Yes

[JackCroww]

What about a security camera catching a likeness of your face?

That fits the any and all identifying information bar that you have set. Does that mean that if you knock over a liquor store, and they don't get your permission to keep the tape, the police won't be able to use it to prosecute you for your crimes?

I highly doubt it.

Re:Yes

[dajak]

If I own something that has value and someone else takes it and prevents me from profitting myself from it, that is theft, plain and simple.

: The concept that someone who is taking the effort to aggregate the behavior of millions is stealing from you personally is stupidity.

It's just as nonsensical as the concept of advertisers losing money if people delete cookies. Or the concept of losing money on non-sales because of piracy. No money is changing hands, and no goods are stolen. Just business models that reach the end of their useful life.

Re:Yes

[FudRucker]

i totally agree, fsck the advertisers, they ruin everything, driving in the country i want to see nothing but woodlands and pastures not some funky billboards advertising of products i have no need of, and television is absolutly awfull anymore, i remember a 30 minute sitcom would have 5 to 7 commercials nowdays it is 25 to 30 of them taking up 50 % of my viewing time, anymore i just turn off the TV in disgust, just catch a local news & weather and thats it... the harder the advertisers push - the harder i will push back with automatically deleting cookies and rejecting third party cookies...

Re:Yes

[shokk]

Yes. Next article.

Re:Yes

[fbjon]

Same thing. If you log in at slashdot.org, then only slashdot.org will be able to get that cookie. If ask.slashdot.org tries to access it, it won't succeed, unless you allow cookies to be read for the entire domain (usually the default).

Re:Yes

[maxwell demon]

If you have a dynamic IP, then without either cookies or you explicitly telling so there's no way for some site to determine that you are the same person who visited the page yesterday. And even with fixed IP, it's not certain (there are firewalls/proxies, computers used by multiple users, ...). A tracking cookie gives much more reliable information about identity (not completely reliable, because two people might surf with the same user account and profile, and the same person might surf from different computers, but it's much more reliable than just tracking your IP - if it wasn't, the advertisers wouldn't be so eager to use it).

Re:Yes

[Anonymous Coward]

Yes, I'm deleting cookies on a routine basis. I agree I don't want web sites to remember me. I especially don't want advertisers tracking me.

Re:Yes

[fbjon]

It's quite interesting actually. When I watch an American sitcom (here in Finland), I'm amazed at the frequency of fadeouts and breaks in the story for ads, but they're not utilized here which make them stand out quite a bit. Even worse is when the story rewinds a few seconds to make you remember what happened before those 10 ads, the pic fades out, fades back in immediately, and you have to rewatch the last 10 seconds of stuff.

Well, it's better than ads, anyway.

Re:Yes

[DeusExLibris]

So, is this the deal that you have with your credit card company, grocery store, movie rental company, etc? My guess is that you don't and yet continue to use these services. Worse yet, these companies have personally identifiable information about you (unlike the anonymous tracking cookies used by advertisers). So, why is your net activity sacrosanct?

Credit card companies have been selling the personal information of their cardholders for years and it has not raised much of a cry. In fact, we PAY THEM for the privilege of carrying a credit card.

Grocery store loyalty programs are basically required unless you want to pay higher prices at the grocery store.

I just don't get why people get so worked up about their online privacy when their real world privacy continues to be sold, "accidentally released" and otherwise trampled and has been for years.

Re:Yes

[mengel]

I don't need any help in remembering my ID, password, or credit card number, thank you.

Just wait a few years. I used to be the same way, and now I use those crutches more and more, as I become more aged & decrepid :-). On the other hand, I'd rather use Secret on my Palm Pilot to keep that stuff safe than let various companies store it in cookies that javascript bugs let other people steal...

Re:Yes

[starfishsystems]

I don't need any help in remembering my ID, password, or credit card number, thank you.

And if you did, the most secure place to set it up would under control of your browser. Firefox has a form manager which does this quite well already.

But the nature of forms, or cookies for that matter, is that similar information has to be passed again and again to many different servers. A useful browser enhancement would be to have a configuration window where such information could be recorded canonically against a set of tags. Then to fill in a new form, you'd just supply the appropriate tag. Later, if you needed, say, to change an account number or an address, you'd only do it in one place, the configuration window. Neither cookies nor server-side databases can do that for you!

But speaking of security, something potentially much more important would be enabled by this model. You could configure not only form data but also XML data in the same way. Now you have an extensible means of supplying digital certificates, crytographic tokens, or any other object that you care to define. If security is a concern, you may elect not to pass certain objects in cleartext, or to require confirmation by the browser. The point is, such behavior is entirely local and under your control.

It could even be used to generate data such as digital signatures under conditions of your choosing. Since you manage this information directly, the entire process can be much more secure than putting it under the care of some remote server.

Re:Yes

[Frank T. Lofaro Jr.]

Ironic that you'd post this anonymously.

P.S. Are you from the UK?

(I am guess that based on how your text reads)

Re:Yes

[legojenn]

I don't know what's worse. On a couple of Rogers owned stations, maybe others, here in Canada. In place of adverts on US programmes, they often run short information pieces with some ditz who talks for 30-90 seconds about some obscure news item. I don't know what is worse, excessive advverts or that.

Re:Yes

[Anonymous Coward]

Yeah, and some people would prefer the advertisers just send them big 6-figure checks to thank them for viewing their ads, but it ain't gonna happen. There will always be advertisers trying to sell you things, whether you like it or not. (Are you new here?) You think deleting cookies is going to stop it? The thing cookies might do is cause you to get ads that you're more likely to be interested in, which is better for everyone involved.

I don't see what you're disagreeing with in what you quoted from the OP. It's not a particularly insightful statement, but it's certainly true. Of course we'd all like to see ads we're interested in seeing. Isn't that the definition of being interested in seeing something? You know, that you'd like to it?

Re:Yes

[sootman]

Internet users are deleting cookies en masse and causing serious problems for advertisers.

I never touch my cookies. But I'll bet advertisers would be bothered by my use of a custom /etc/hosts file.

Re:Yes

[dzfoo]

A habbit is a female hobbit.

      -dZ.

Re:Yes

[wrp103]

Not everyone that deletes cookies do it for privacy reasons.

One of the standard answers that many help desk operations suggest if a user has problems with a web site is to delete your cache and cookies, and then restart your browser.

So, it is entirely possible that some people are deleting their cookies but not really aware of what they are and what side effects it causes.

Re:Yes

[techno-vampire]

If you're visiting Slashdot, and the page you request has an image from osdn.org, your browser sends a request to osdn.org for that image. Now, osdn.org can see any cookies it's put on your machine, but it can't see any of the slashdot cookies. There may be an extension to Firefox to block that, but if so, I don't know of it.

Re:Yes

[techno-vampire]

Any browser that supports cookies, ever since they were invented

Actually, no. When the idea of cookies was first developed, any site could simply ask for your cookies and see what was there. This, of course, led to tremendous abuse and the distrust of all cookies that some people still have. Within a year or so, it became standard for browsers to deliver only those cookies a domain had set, as they do now.

Re:Yes

[FLEB]

some funky billboards advertising of products i have no need of

On the Internet, that's what cookies are USED for... to give you relevant information as opposed to scattershot.

Re:Yes

[Infernal Device]

If the idea of owning all personally identifiable data about yourself were to pass as law, there would certainly be exceptions for law enforcement.

There always are - the FCC just passed rules stating that law enforcement has to be able to tap VOIP communications, pretty much destroying chance of having a secure connection.

It's been that way for a long time, because they are unable to compete with the pace of technology and so law-enforcement always gets exceptions.

Re:Yes

[Neo's Nemesis]

real men dont delete cookies.
they ddos those websites which do evil things with them.

Re:Yes

[hackstraw]

If money is being exchanged or made from my opinion then the one individual that most deverves some or all of that financial gain is the original owner of the opinion/preference (me).

I hate to break it to you, but your opinion is not worth much at all to marketers.

Quick thought test -- Imagine that in your opinion an iPod-like toy that had a harddrive, an LCD panel, and a builtin plunger is the next best thing that you would pay any money for. I don't think that will be on the market anytime soon, but thats my opinion.

If I own something that has value and someone else takes it and prevents me from profitting myself from it, that is theft, plain and simple.

No its not, although some of the /. crowd believe it is.

Back to the original thing about exchanging money from your opinion thing. The company that makes those animal-like turnstiles to count everybody riding a themepark ride aren't going to pay people for being counted. The theme park is not going to pay you. The census bureau isn't either.

Now the poor marketing people feel as though some of their hard researched scientific data may not be good because the users may be deleting too many cookies too quickly. WTF kind of control exists with people at home and work accessing a website?

I almost find it amusing how "scientific" these marketing people try to get. Sure, there is basic psychology, but putting too much faith in your users cookies as a real tool for measurement is a bit optimistic at best. Science it is not. Think about the subpopulations that are likely to delete cookies. Hint, they are right in the target audience for most marketed products, younger males. Think about those demographics of people that would never delete cookies. I would guess that would lie with most computer or technology illiterate people, and those that don't care. I do cookie maintenance irregularly, and I go through and delete anything that looks like its around advertising or irrelevant stuff. Basically, I delete everything except my slashdot cookies and my bank cookies, but that is not universal.

Sorry guys we are deleting our cookies. However, your only hope of them being preserved is if a user keeps them there, the browser does not automatically delete them, the cookie file never gets full (I believe its limited by the specs to be something like a total of 65k for all cookies combined), and the user always uses the same browser on the same computer. I would not base any critical data on those assumptions.

Re:Yes

[Twinbee]

• If I own something that has value and someone else takes it and prevents me from profitting myself from it, that is theft, plain and simple. I don't want someone else's prefences in exchange for mine. I want the monetary value of my opinion.

The thing you don't realise is that you're not losing anything as such. It's just that they're gaining.

Overall net result: positive.

Heck, maybe you would also gain if an advertisement came along that you were interested in.

If a site is of use to you, then isn't that a small 'price' (if you want to call it that, but it's not) to pay for free access to their content?

Re:Yes

[d.hawk]

Thats like saying that billboard owners should pay everyone that drives down the highway since you have the option to look at their advertisement.

Re:Yes

[jrumney]

I don't delete my cookies. I edit them. Far more disruptive to arsehole advertising companies that think they need to track my every movement.

Re:Yes

[fab13n]

If money is being exchanged or made from my opinion then the one individual that most deverves some or all of that financial gain is the original owner of the opinion/preference (me).

Seems to me that if you go to that cookie-stuffed website, that's because you find an interest, i.e. value, to do so. The salesman (here called a webmaster) thinks it's better to charge you with information than with bucks. If you don't feel the same, go to another salesman. If you feel that you pay too much information for too little service, choose another salesman as well. That's called free market.

Re:Yes

[dvdeug]

The fact that you saw "someone" walking "a dog" in front of your house this morning is fairly innocuous. Be very careful, though, when you start identifying who, or whose dog.

If you walk into a public space, that's public knowledge. If I want to chat to my friends about who has a nice Pekanese, or who is leaving crap on the sidewalks, or who's visiting a mistress, or who might be the Seaside Strangler, that's my right, and has been for thousands of years. You aren't going to change that, and I doubt it's good for society to legistlate enforced isolationism.

Re:Yes

[jjoyce]

If they're publicly traded companies, have at it.

Re:Yes

[Anonymous Coward]

Did the traffic reporter steal from you when he reported the congestion you were stuck in? Did the newscaster steal from you when he reprted the headcount of the "Million Moron March"?

Christ, you are a genius. Millions of lawyers will owe you a debt of gratitude. No debt of money because you were too stupid to patent your business plan, but gratitude by the bucket load. Suing for being part of the congestion reported on; it's the American dream.

Re:Yes

[The Spoonman]

One that's dedicated her life to the service of teh lord? ;-)

Re:Yes

[spectre_240sx]

I don't know why anyone would want to delete cookies. They are a delicious delicacy after all.

Re:Yes

[MagnaMark]

One thing that you are not considering is that internet users are expending resources to maintain tracking cookies. These resources include CPU cycles, bandwidth, hard drive space, and electricity.

Granted, cookies don't require too much of these resources, but still, the user is expending these resources for the benefit of some marketing company. Moreover, the user often doesn't know they are expending these resources, and they didn't agree to it. Tracking cookies generally arrive on a computer unannounced.

So users are spending resources solely for the financial benefit of some company in an unagreed and uncompensated manner.

Re:Yes

[SirPavlova]

But the nature of forms, or cookies for that matter, is that similar information has to be passed again and again to many different servers. A useful browser enhancement would be to have a configuration window where such information could be recorded canonically against a set of tags. Then to fill in a new form, you'd just supply the appropriate tag. Later, if you needed, say, to change an account number or an address, you'd only do it in one place, the configuration window. Neither cookies nor server-side databases can do that for you!

But Opera can.

Or it does something so close to what you mean that I find no effective difference. Site-specific information would still need to be edited under your system, & Opera doesn't support that beyond password management & cookie editing. But global information such as your address, your name, phone, etc. can be held by the browser (encrypted of course), & inserted with two clicks or a few keystrokes.

Re:Yes

[starfishsystems]

global information such as your address, your name, phone, etc. can be held by the browser

That's where the concept starts, but do you see where I was going with this? What about account numbers? The point I was making was that the benefit typically claimed for cookies is to preserve what is essentially form information that you have to supply anyway, and which might be subject to change that only you know about. (There are other, more defensible, uses of cookies in certain kinds of session management, but even then, they're often misused.)

So, given that it's your information, why aren't you in the position of managing it? Cookies take that away. Pursuing this idea a bit further, I mentioned treating certificates, or even digital signatures, in the same way. That is, if the site claims that it needs to store some sort of authentication data in a cookie, I have to ask what design justifies such authentication being done outside my control. If I'm the one supposedly being authenticated, surely I should be supplying the credentials!

Note that this serves a different purpose, at a different granularity, than the client-side certificates used by SSL/TLS to authenticate the connection. Even so, if the browser already lets you manage these certificates, you're more than halfway there.

Re:Yes

[SirPavlova]

I tend to agree... I don't see any valid reason for cookies bar one, & I'm not even sure if that one is valid: keeping session logins. AFAIK certificates can't do that, & I don't consider UIDs in a GET parameter good enough. There is no reason to store any information in a cookie except tracking data. Session logins need that; nothing else should even get a look in.

As an aside, what browser other than IE doesn't let you manage your certificates? I suppose it depends how in-depth you want to control them... I personally know nothing about their internals, so I can't comment further.

Re:Yes

[starfishsystems]

I don't see any valid reason for cookies bar one, & I'm not even sure if that one is valid: keeping session logins. AFAIK certificates can't do that

Actually, certificates are ideal for doing that, and hence the capability exists in SSL for validating certificates on both the server and client side. If this is done when establishing an HTTPS connection, then the connection is equivalent to a login session. It has much better security, in fact, but that's another discussion.

So, now the server has a secure connection to an authenticated client. As long as it refers to that connection, it has everything it needs to maintain arbitrary session state, including any desired tracking data. No cookies are required.

This only breaks down because of architectural decisions on the server side which force the use of cookies. The principle of an n-tier architecture is to have a clean separation between different processing layers. To some designers, clean means absolute, so the connection/authentication context ends up not being provisioned into the business logic. I don't think that's great design, but it's the prevailing fashion at the moment.

Re:Yes

[SirPavlova]

Righto then. That makes sense & squares with what I know. Give yourself a pat on the back, you've just made a convert.

First Post

[Anonymous Coward]

My browser is set to accept session cookies only!

40% of the market is a problem

[Thanatopsis]

If 40 % of the market is deleting their cookies (no doubt as part of a regular anti spyware cleaning) that's a problem no matter what spin you put on it.

Re:40% of the market is a problem

[Anonymous Coward]

That's ironic. He gets labeled informative and doesn't tell why it's a problem.

I don't see any problems, aside from advertising dollars drying up. But that's a moot point considering bandwidth is so cheap and if you want to throw up some kind of large, bandwidth consuming site you can generally run it on donation. That, and anywhere that has a decent product or service seldom needs to advertise it and when they do they don't make the big bright flashy "YOU WON A FREE PIECE-OF-SHIT" bouncing all over the screen in a flash ad game bullshit.

I hate advertising. I hate the way it advertises to women to destroy their bodies and then lie about who they are, I hate the way it advertises to men to be shovanistic dominating fucks, I hate the way it exploits need and social trust to enslave people into a process of consumption, I hate the way it educates kids about using their products for percieved, non-existant needs.
I hate the way the marketing books are written from a psychologists point of view.

Marketing works upon the communist dogma; build 1000 tracters, 1 works, rebuild the other 999 and get another working tracter, then do it again. You advertise to a kid to eat unhealthy food and watch TV, and to partake in stimulation culture. 15 years later, they're fat, unhealthy, and they're depressed becuase they can't stimulate themselves enough to get happy again (true happyness comes from controlling your wants). So you fix the situation with antidepressants, lyposuction, and a new diet and motivate them with images of supermodels and after even more money, they're to that level again. They become stupid, get pregnant, fake marrage, then what's the solution to that? Diapers, house, carpeting, divorce lawyers...and the kids get left infront of a television the whole time.

    Why? Because it destroys people. Even if I like something, I still hate advertising because once you're sold it becomes redundant.

Someone who does marketing is incapable of telling the truth. At least a lawyer can try.

Re:40% of the market is a problem

[Anonymous Coward]

How exactly is deleting cookies a problem?

Re:40% of the market is a problem

[Anne_Nonymous]

>> If 40 % of the market is deleting their cookies...

Then the marketers will end up with data on the stupidest portion of the online populace. Start expecting continued advertisements for debt consolidation loans, monkey punching services, and schlong enhancement medications.

Re:40% of the market is a problem

['nother poster]

Marketing books are written from a psychologists "point of view" because marketing is basically the psychology of getting someone to buy something.

By the way, how does true happiness come from controlling your wants? There is a LOT of things I want, but don't have. I'm pretty content. I've heard others say happiness is wanting what you have, but there are a lot of things I have that I don't want. Still, I'm not unhappy.

Re:40% of the market is a problem

['nother poster]

And if that portion of the population is also the group most likely to part with their disposable income, then the marketers are happy.

Re:40% of the market is a problem

[Anne_Nonymous]

"No one ever went broke underestimating the intelligence of the American people" - P.T. Barnum

Re:40% of the market is a problem

[vettemph]

>big bright flashy "YOU WON A FREE PIECE-OF-SHIT" bouncing all over the screen.

Is that a reference to the geotze.cx website?

Not that it would matter, but

[ZakuSage]

FireFox deletes cookies automatically for me, whenever they "expire" (whatever that means).

Re:Not that it would matter, but

[ytm]

whenever they "expire" (whatever that means)

Every cookie has its expiration time - like real cookies have Best before date. But most cookies stored in my browser will not expire until 2020 or so. Many websites use expiration time in distant future to make cookies permanent.

Re:Not that it would matter, but

[curmudgeous]

I'm not a web developer (so someone correct me if I'm wrong) but it's my understanding that the expiration date of a cookie is defined by the person creating the cookie. I prefer to have Firefox keep cookies only for the current session, then wipe them when I close the browser. I also routinely wipe the browser cache and history just out of basic tinfoil-hattedness.

Re:Not that it would matter, but

[Anonymous Coward]

You do realize that some cookies are set so that they essentially never expire on their own, right?

Re:Not that it would matter, but

[Dogers]

Some don't actually EVER expire..

Some, like Googles cookie, don't expire for ages!

(Googles cookie implodes some time around January 2039)

Re:Not that it would matter, but

[Donny Smith]

Good luck with the Google cookie.

http://www.google.com/search?q=google+cookie
(See result #1)

Re:Not that it would matter, but

[$RANDOMLUSER]

That's only because that's the limit of what they can set it to. The time is typically kept in a signed 32-bit long integer, representing the number of seconds elapsed since midnight 12/31/69-01/01/70. This counter will overflow (go negative) on January 19, 2038. By then, we will have moved that counter to a 64-bit number.

Re:Not that it would matter, but

[letxa2000]

This counter will overflow (go negative) on January 19, 2038. By then, we will have moved that counter to a 64-bit number.

Yes, we will have completed that move on approximately January 18, 2038.

Re:Not that it would matter, but

[Anonymous Coward]

Which is good for many cookies. Frankly, I don't want to have to bother logging into Slashdot again, that cookie can stick around forever, and I hope it does. (Because if someone gains physical access to my computer, having them post as me on slashdot is not one of my big concerns. I've never seen a site for anything that I'd want security that auto-logs you in) It's nice that I can go to a weather site and see the weather for the location I most often care about without logging in.

Re:Not that it would matter, but

[lgw]

But we still wont handle leap-seconds properly.

Re:Not that it would matter, but

[Anonymous Coward]

I think you might be wrong. Don't all cookies have to have an expires on date? If you set a cookie without an expires date, doesn't that cookie only live for the duration of your browser session?

Re:Not that it would matter, but

[Guppy06]

"(Googles cookie implodes some time around January 2039)"

Remind me not to have my laptop in my lap when the singularity forms.

I love cookies

[Sodki]

Cookies are delicious delicacies.

Re:I love cookies

[lucabrasi999]

C is for cookie, it's good enough for me!
C is for cookie, it's good enough for me!
C is for cookie, it's good enough for me!
Oh....Cookie, Cookie, Cookie starts with C!

----Cookie Monster

Today's song was brought to you by the number seven and the letter "C"

Re:I love cookies

[eth1]

I know, I deleat them all the time!

Re:I love cookies

[shis-ka-bob]

That's just silly, everyone knows Perl is for cookies.

Re:I love cookies

[fbjon]

monster.com has a server for cookies: cookie.monster.com

Re:I love cookies

[Analog4ever]

And here's some Cookies to Love

INGREDIENTS:

* 4 1/2 cups all-purpose flour
* 2 teaspoons baking soda
* 2 cups butter, softened
* 1 1/2 cups packed brown sugar
* 1/2 cup white sugar
* 2 (3.4 ounce) packages instant vanilla pudding mix
* 4 eggs
* 2 teaspoons vanilla extract
* 4 cups semisweet chocolate chips
* 2 cups chopped walnuts (optional)


Bake at 375F for 10-12 minutes

Re:I love cookies

[Anonymous Coward]

As a lover of cookies, it is my firm belief that we should ban the rasin cookie for tricking me into thinking it had chocolate chips in it.

Re:I love cookies

[Anonymous Coward]

Uhh, I baked all of the ingredients at 375*F for 12 minutes and my kitchen burst into flames. Not to mention a slimy pile of black goo and toxic fumes starting coming out of the oven.

Re:I love cookies

[Anonymous Coward]

Cookie Culler lets Firefox users keep the delicious cookies and toss all the delicate but icky ones.

Re:I love cookies

[Anonymous Coward]

And when we're on the topic of FF extensions, be sure to also check out this subtle one: https://addons.mozilla.org/extensions/moreinfo.php ?id=413
Sure, it's not hilarious, but it put a big smile on my (stoner) face.

Re:I love cookies

[Guppy06]

Nobody seems to be catching your reference. I feel old.

I, for one, don't bother with cookies anymore

[BlackCobra43]

I simply deleted all my cookies, visited every site I *want* a cookie from and then set my cookies to be read-only. Worry-free AND all the benefits of good cookies!

Re:I, for one, don't bother with cookies anymore

[op12]

Then what happens when one of the "sites you want" wants to update their cookie?

Re:I, for one, don't bother with cookies anymore

[BlackCobra43]

Tough luck to them, but usually when that happens I can plainly see it (the sitye doesn't work anymore)...unfreeze the cookies, visit, re-freeze. If the update is not required (i.e it doesn't break the site NOT to) then frankly I see no reason to get it at all.

Re:I, for one, don't bother with cookies anymore

[Jugalator]

Yeah... The same worry-free experience while still allowing cookies where you want them can be set up in Firefox like this:

To allow new cookies
(when visiting new forums, etc)

- Allow sites to set cookies = on
- Keep cookies = ask me every time (when asked, obviously don't accept the ad cookies, to 99% easily identifiable)

To allow modifications to cookies earlier allowed to be set, and block the rest
(the by far most common and dialog-free setting)

- Allow sites to set cookies = off

^--- This configuration works, because that setting does not disable cookie usage to 100%, but still keep cookies you've allowed before to be both read and modified. You can review which those are later via "View Cookies". I always thought Firefox documented this behavior poorly in the dialog. :-/

If something slipped in by you allowing too much, simply remove the cookies from the whitelist at "View Cookies" in Firefox. Cookies either not listed, or listed as "block" will be blocked by Firefox with "allow sites to set cookies = off", and the others listed as "allow" will always be allowed despite this setting.

Re:I, for one, don't bother with cookies anymore

[Anonymous Coward]

obviously, if it is read only, they can't.

Re:I, for one, don't bother with cookies anymore

[Anonymous Coward]

I simply have a shell script wrapper around Firefox that deletes all unknown sites from "cookies.txt" before starting firefox. Since this happens daily, this is good enough for now.

I have noticed that many "good" sites have various strange cookies set that they really shouldn't need to have.

Re:I, for one, don't bother with cookies anymore

[misleb]

Or even easier, just set firefox to keep cookies "until I close firefox." Assuming you reload firefox every now and then for whatever reason, the marketers will be foiled. There is really no practical reason to block cookies outright. It can cause problems.

-matthew

Re:I, for one, don't bother with cookies anymore

[aardwulf]

Or you can just set the Firefox option "Allow sites to set cookies" and "for the originating web site only". This will allow slashdot.org to set a cookie when you visit slashdot.org, but not the ads that are on the page from mediaplex or whatever...

Re:I, for one, don't bother with cookies anymore

[HoosierPeschke]

Cookie Culler works great for protecting cookies you want to keep without having to set files to read only and having to undo it if you find a new site you want to add.

It's also Mom and Dad friendly.

Re:I, for one, don't bother with cookies anymore

[MacDork]

I simply deleted all my cookies, visited every site I *want* a cookie from and then set my cookies to be read-only.

That might not work too well if any of those sites have an ad from doubleclick or some such. I use Omniweb. There's a little cookie icon at the bottom of the window. Not only does it tells me the site domain dropping the cookie, but it also lists the domain the cookie actually belongs to. You can selectively accept/temp/deny each cookie individually. That way, you can set the browser to deny all, then when you find you need a cookie, click the cookie icon and turn it on. If you only want it for one session, use the yellow temporary selection. Most importantly, I can accept cookies from ebay, and deny ones going back to mediaplex even though both cookies are being presented on the same page. It's perfect. Mozilla can do something similar, but the last time I used Moz, I found the interface for doing it a lot less usable.

I can believe it

[Anonymous Coward]

I have had a lot of tech support calls and when an issue came up about IE, they'd always suggest "should I delete my cookies?"

I usually don't delete cookies ...

[maxwell demon]

... because I already don't let the browser set them.

Does the advertising industry also "lose" money because it cannot track if I am watching their ads on TV?

Re:I usually don't delete cookies ...

[Dogers]

You're stealing the internet!!

Re:I usually don't delete cookies ...

[borawjm]

Does the advertising industry also "lose" money because it cannot track if I am watching their ads on TV?

With digital cable and satelite the way it is now, can't these companies track what you are watching (given that you use their provided cable/satelite boxes) and, therefore, determine if you are tuning into their ads?

Re:I usually don't delete cookies ...

[hacker]

Does the advertising industry also "lose" money because it cannot track if I am watching their ads on TV?

It must suck being only able to get 13 basic channels. What kind of antenna are you using?

Yes, this was said with tongue-in-cheek, but if you have any sort of digital cable (or cable television at all for that matter), they know exactly what you're watching, for how long, and what channels you switch to, and at what intervals.

Sure, they might not yet be able to tell when you get up and work on your motorcycle in the garage for 2 hours while the TV is on in the house, but soon enough they'll be able to do that too.

Re:I usually don't delete cookies ...

[Anonymous Coward]

How are they able to track analog cable?

Re:I usually don't delete cookies ...

[maxwell demon]

Well, I have analog cable. And which analog TV does send anything back through the cable (besides the fact that I can't imagine my old VCR would let anything through in the wrong direction anyway, even if the TV did try to send)?

Re:I usually don't delete cookies ...

[hacker]

And which analog TV does send anything back through the cable...

The TV doesn't "send anything back", the tuner knows which channel you're tuned to. That signal strength can be detected on the provider's end. Call your analog cable provider and ask them (btw: there is no such thing as "analog" cable, its digital up to the point where your analog converter takes care of it, again, call your cable provider and ask).

Re:I usually don't delete cookies ...

[misleb]

They can tell if you have something hooked up, but they can't tell what channel you are tuned to. And there is most certainly analog cable. Digital cable encodes discrete packets of numerical data into MPEG frames. Analog cable doesn't require any such digital processing to be displayed.

-matthew

Re:I usually don't delete cookies ...

[ElleyKitten]

It must suck being only able to get 13 basic channels.

My TV has three channels, PS2, Gamecube, and XBox. They have no ads, no one spying on me, and there's always something good playing.

Re:I usually don't delete cookies ...

[Urchlay]

With digital cable and satelite the way it is now, can't these companies track what you are watching (given that you use their provided cable/satelite boxes) and, therefore, determine if you are tuning into their ads?

How can they tell if I'm in the kitchen making a sandwich, or in the bathroom... or for that matter, whether I'm even home? I know a lot of people who leave the TV on 24/7 (maybe muted) whether they're even in the same room or not...

For that matter, what if I turn off the TV itself, but don't bother to turn off the cable box? Can it "tell" whether the TV is on?

I'm in the "hate all ads" camp, BTW... I use Firefox's Adblock extension aggressively. It's my screen, my bandwidth, and my eyes... and if I'm not going to buy whatever they're selling (which I'm not), what difference does it make whether I look at the ad (some sort of tree-falling-in-forest thing?)

...but cookies can be useful. They're a tool, a mechanism for imposing state on a stateless protocol. Like any tool, they can be used for good or evil... and like any client-supplied data, can be folded, spindled, and mutilated without the server's consent or knowledge.

If you really, really hate marketers tracking data, maybe you could start a "p2p cookie-sharing service". It'd create a pool of shared, effectively random cookies, and browsers could send a different one in each request... of course you'd need a way to stop it from sending garbage cookies for e.g. session cookies that you actually need...

This would be the WWW equivalent of people swapping frequent shoppers cards...

Re:I usually don't delete cookies ...

[Animats]

Me too. I run Mozilla with "Ask me before accepting a cookie", and usually click "Deny", with "Apply to all cookies from this site". Unless I'm planning to log into a site, or using its shopping cart, I don't click "Accept". All the cross-site tracking services were thus blocked long ago.

This throws some sites into annoying infinite redirect loops, but that's rare.

Re:I usually don't delete cookies ...

[Anonymous Coward]

It must suck being only able to get 13 basic channels.

Sorry to hear you're such a slave to the corporations. Try hanging out with people who don't watch TV, that'll make you watch less of it too. Do that for a month then come back and reread your above comment. You'll be surprised at your reaction.

Re:I usually don't delete cookies ...

[rc3105-Riley]

maybe the cable/sat companies can tell what YOU're watching, but not me or any of my technically inclined friends

truth be told, our settop devices generally upload bogus data that bolsters shows/channels we like - my logs indicate lots of PBS even though it's hardly ever actually on

sometimes we upload data that indicates what was actually watched. gotta wonder what the marketing dept thinks when a south texas cablebox reports accurate episode info for british Dr Who or german Stargate... ;-)

Cookies

[Exter-C]

I have been recently making it so that every site that I goto it pops up and I can accept or reject the cookie. Initially it was terrible but after some time I have found that most sites are no longer popping up the cookie information. If the site does not work I put on a allow per session within Firefox.

Re:Cookies

[lordsid]

Personally if I find a site that doesn't work without cookies I just leave. The site obviously isn't worth viewing.

Legit sites getting hit in crossfire

[Colde]

It is time to stop telling users to delete or block cookies, it causes a lot of problems for legit sites.

And really, just block 3rd party cookies, and perhaps only allow session cookies, that more or less gets rid of the evil advertiser cookies.

Re:Legit sites getting hit in crossfire

[maxwell demon]

Ok, then the site shall tell me about what cookies it sets, what it stores in them, and why it needs them. Then I can look at this policy, and if I agree with it I can enable cookies specifically for that site.

Re:Legit sites getting hit in crossfire

[C0deM0nkey]

...it causes a lot of problems for legit sites.

As a web developer, I'll call bull-puckey on this.

Every developer working in the online industry by now knows that cookies are, at best, an unreliable solution to solving the statelessness of the web. Why would you encourage anyone to keep cookies on their systems, knowing that a large segment of the online community is going to put those cookies to unethical use? Because "legit" sites will get caught in the crossfire? No. Legit sites should design a strategy for storing user state that does not involve cookies. Two well-worn ways of doing this are: storing user state in a server-side session that expires after 30 minutes or so and persisting data to a data store.

You cannot count on people having cookies enabled or on allowing cookies to be set; cookies have been usurped by advertisers and spyware writers to invade the privacy of web-surfers. I am sure that you can find either a browser feature or a browser plugin that will remember your username and password for sites you regularly visit...or fill in forms for you...or whatever. Beyond login information, everything required to enable every feature of a good site can be retrieved from a persistent data store. If a user does not want to register, they get a default presentation. Not a problem.

...allow session cookies...

If you are going to only allow session cookies why not skip the cookies altogether and store needed state information in an actual session object. No doubt this uses more resources on the server, however, it is far more reliable than using cookies and does not strongarm the user into enabling a feature that is sure to be abused by some third parties.

You and I understand what session cookies are and how they work. Most people do not; many people do not even know what cookies really are. These people have been conditioned to fear cookies and are likely to either enable or disable them altogether.

Re:Legit sites getting hit in crossfire

[mattyrobinson69]

that sounds conspicuously like a p3p policy:

http://www.google.com/search?client=opera&rls=en&q =p3p+policy&sourceid=opera&ie=utf-8&oe=utf-8

you're supposed to set a p3p policy if you set cookies, and that way the browser can block or allow cookies for you. if you have cookies such as 'remember users stylesheet' and the browser understands p3p (i believe ie does, dunno about others) then the cookie will be accepted, if its a traking cookie, then it'l prompt or block.

also, session cookies are neccessary for secure php sessions over https (alternative is GET variables, and they aren't secure).

Re:Legit sites getting hit in crossfire

[mysticgoat]

Two well-worn ways of doing this are: storing user state in a server-side session that expires after 30 minutes or so and persisting data to a data store.

Without the use of a cookie to store the session ID number, how does the server tie the visitor's next request to his state data? Aside from using a small cookie containing that session ID number, the only way I know of doing this is to be always passing the ID number back and forth in the request/response headers like a hot potato-- which I understand makes the session vulnerable to man-in-the-middle attacks.

Is there something you know that I don't know? Is there perhaps a meta-intranet that allows the browser and server to pass the session ID around by silicon-enabled telepathy??

Re:Legit sites getting hit in crossfire

[Anonymous Coward]

...As a web developer, I'll call bull-puckey on this....

welll, as a web app developer, i call bull-puckey on your statement of :

Legit sites should design a strategy for storing user state that does not involve cookies. Two well-worn ways of doing this are: storing user state in a server-side session that expires after 30 minutes or so and persisting data to a data store.

my reaction is the same as mysticgoat's: is there something you know that the rest of us dont? the only way the two methods that you mentioned can work is with SOME type of identifier being passed back and forth. the easist on the USER is the storage of a session cookie that ONLY stores the session ID. the only other way is passing the session ID back and forth via GET or POST. even server-side sessions have to set a session cookie on the user's side in order to know which server-side session goes with which user!

no, legit sites that use cookies should make sure they are using them properly and explain to their users that without being able to set the cookie, their experience with the site will be less than what it could be.

...If you are going to only allow session cookies why not skip the cookies altogether and store needed state information in an actual session object....

then please explain how your session object knows when it is being requested again? the browser has to pass SOMETHING back to the server in order for the browser and your object to match up, right? and if you arent doing that through a session cookie, then you are passing the ID by embedding it to urls (GET) or in forms (POST).

cookies are a legitimate, NEEDED item when building web apps. the problem, IMO, is the creation and use of 3rd party cookies.

personally, i only delete/block 3rd party cookies. i usually keep 1st party cookies, as long as i recognize the site that created it. 90% of them are session cookies, only storing a single piece of data : my unique session ID.

Re:Legit sites getting hit in crossfire

[C0deM0nkey]

passing the ID number back and forth in the request/response headers

Yep.

I agree with you that passing back and forth on the query string is open to man-in-the-middle attacks; however, the threat of such a thing happening can be significantly reduced by using SSL.

My less-than-eloquently-stated point is that you can design a site to not use cookies; using cookies is unreliable because you cannot guarantee that the user will have cookies enabled - and forcing them to enable cookies just to use your site is not right, in my opinion.

Ultimately, I concede the point for the following reasons:

• I did not adequately consider the man-in-the-middle attack before posting my response.
• Personal bias: I cannot stand the way cookies have been abused by 3rd Parties and do not use them in my own coding.
• In my development environment, we routinely use SSL which may not always be available to others

IN SOVIET RUSSIA

[Anonymous Coward]

People had better lives than now, with the massive crime rates, extreme poverty gaps and suffering economy under our beloved capitalism.

Just goes to show...

Re:In Soviet Russia

[Ixitar]

Love those hemlock cookies. Yummy!

Re:In Soviet Russia

[maxwell demon]

In Korea, only old Cookies are deleted.

Purge the evil

[KennyP]

My XP machines (all Pro) have a shutdown script that purges all cooties that both IE and the OS keep squirreled away for no apparant reason.

Too bad the browsers can't purge all accumulated cookies upon closing the browser window...

I don't mind logging in each time I use a machine, so why would I mind logging in to websites that I frequent?

Visualize Whirled P.'s

Re:Purge the evil

[maxwell demon]

Mozilla/Firefox can. Just tell it to set all cookies as session cookies.

Re:Purge the evil

[Exter-C]

Within firefox you can setup cookie control fairly well. There are also extensions that allow you to do even more things from what I have been told Although I have not verified the extensions.

Re:Purge the evil

[thc69]

cooties that both IE and the OS keep

This should score +5 insightful...

Re:Purge the evil

[Anonymous Coward]

My XP machines (all Pro)

All Pro? Who gives a shit? What relevance does that have to your post other than showing off? And BTW, "Windows XP Professional" is about as truthful as "Microsoft Works".

Re:Purge the evil

[ip_vjl]

I have Firefox set to treat all cookies (that aren't on my whitelist) as session cookies.

Thing is, I'll have firefox open for days at a time sometimes. They should probably add an option in addition to the existing 'Keep cookies: until I close Firefox' along the lines of 'until I close Firefox, or [XX] hours. Whichever comes first.'

That way, I could set it for 4 hours to allow hassle free session management - but not have tracking cookies hanging out if I happen to leave my browser open for a week.

Re:Purge the evil

[KennyP]

Well, being a staunch MS fan, I know what happens and how to deal with it.

Keeps me floating in beer money!

Visualize Whirled P.'s

Re:Purge the evil

[chrisvdb]

Idd, this is a very, very useful feature of Mozilla/Firefox.

In Firefox you can set this feature in Preferences - Privacy - Allow sites to set cookies & Keep cookies until I close Firefox. Also permanent cookies are accepted, but simply treated as session cookies. Sites that you do want to allow permanent cookies, you can just add to the exceptions list.

I would recommend everybody to put on this option! Almost all sites work correctly and you still have a reasonable amount of privacy.

There is btw an extension 'allow cookie' that makes it possible to add sites to the exception list (both allow and disallow) with an easy key combination. Very useful.

Cheers,
Chris.

Re:Purge the evil

[Anonymous Coward]

Actually, I think cooties would be a better term. 'Cookie' is so out of line with the rest of computer terminology. We already know that hardware/software has bugs, and a cootie is like a harmless bug.

No charge for that.

Joey

Re:Purge the evil

[maxpublic]

Opera can do this. You can delete all cookies AND all history information on exit. That's how I have it set up and it works exactly as advertised.

Max

Kewkies good

[Underholdning]

I'm not deleting cookies. They're pretty useful. They remember stuff for me. The fact that they've gotten a bad name is mainly because a lot of win32 antispywareprograms identifies them as such.

Re:Kewkies good

[Anonymous Coward]

Yeah, I tend to agree. I sincerely doubt that 40% of users even know what cookies are, anyway.

Re:Kewkies good

[RingDev]

I agree whole heartedly. Cookies got a bad name in the late nineties and have never recovered from the uninformeds' position that they must be evil.

I also agree with the AC who said that the vast majority of 'average' users don't even know what cookies are, let alone block or delete them.

-Rick

Re:Kewkies good

[TheRaven64]

I have cookies set so that they can only be accessed by the site that set them, and they can only be set from the same server as the page I am viewing. This prevents my cross-site browsing habits being tracked, but if I use someone's site then I am more than happy for them to analyse my usage pattern of their site.

Cookie Monster says...

[nearlygod]

Cookies are a sometimes food.

Re:Cookie Monster says...

[WhiZa]

I delete cookies and substitute them with vegetables instead

Re:Cookie Monster says...

[phoenix42]

Truth. In the sense that cookies are sometimes useful just as you should sometimes eat them.

Re:Cookie Monster says...

[mattyrobinson69]

cookies are vegetables, just like purple is a fruit

Re:Cookie Monster says...

[Frank T. Lofaro Jr.]

And sometimes tossing your cookies/browser bulimia is useful. :)

Re:Cookie Monster says...

[dzfoo]

Last time I heard him, he said:

'C' is for Cookie, that's good enough for me,
'C' is for Cookie, that's good enough for me,
'C' is for Cookie, that's good enough for me,
Oh, Cookie, Cookie, Cookie starts with 'C'.

http://members.tripod.com/Tiny_Dancer/cookie.html

      -dZ.

Re:Cookie Monster says...

[scruffy]

Me not delete cookies. Me eat cookies. Me not know internet full of cookies. Me browse internet all day. Me not find any cookies. Me still hungry. Someone please tell me where internet cookies are to eat.

Firefox...

[gowen]

The "Allow Cookies For Session", along with the Allow Persistent Cookie Exceptions in Firefox solve all my problems. Along with AdBlock and BugMeNot.

I guess that makes me a bad person.

Re:Firefox...

[Anonymous Coward]

You for got Objection extension for removing LSO's (Local Shared Objects)

NOW you are set! :)

Re:Firefox...

[gowen]

Well, I would ... except Flash won't actually run on my AMD_64 machine, so that's all a bit of a moot point.

Blacklisting

[RenHoek]

I'm sorry, but I've got your domains completely blacklisted. So no, not deleting your cookies, just not telling you anything. :)

me like cookie

[Anonymous Coward]

deleting cookies, no me like to eat cookies,...
- cookie monster

Adblock

[culler]

Delete? Just deny them in the first place, Firefox + Adblock extension!

Re:Adblock

[Panaphonix]

Don't forget Filterset.G and the auto-updater extension.

--
"Most, perhaps all the blame, rests with the parents." - Bender

Do what I do with everything advertisers send me

[Prospero's Grue]

Yes, I delete cookies. I also recycle flyers, fast-forward past TV commercials, and surf the radio between songs.

Shame on me for controlling the content I receive, I guess.

Adaware etc...

[Anonymous Coward]

I think it's mostly apps that tell users to delete cookies that are responsible for increased cookie deletion. People are becoming more afraid of viruses and malware, and are installing apps to help them fight the punks responsible. I'm sure users have no clue what the apps do, but that like whatever AV software does, it's gotta be good.

Deleting cookies?

[Anonymous Coward]

How about blocking unwanted ones in the first place? This is a geek site after all, right?

The truth of the matter

[loggia]

http://www.msnbc.msn.com/id/7421924/

I choose

[mporcheron]

I set my settings in my browser to ask before saving a cookie, most I deny but some, for example, logins I allow. You'd be amased how many websites set a cookie every time you visit their website and how many times. Advertisments are the worst, because they always set several cookies per advert but now I've go into the trend of just blocking whole domains, I hate the feeling that some body is sitting at a computer monitoring how many different people are seeing his adverts/

Delete your cookies regularly

[TarryTops]

I delete my cache regularly. Advertisers can take a hike.

Re:Delete your cookies regularly

[Donny Smith]

>Advertisers can take a hike.

They still can make good use of your cookies during a browsing session.
If you refused them alltogether, well then...

Re:Delete your cookies regularly

[Anonymous Coward]

Advertisers can take a hike.

....says that man that has Google ads on his blog.... :)

adblock

[Anonymous Coward]

even worse, I block ads with the adblock extension. Not they don't track me, they don't even know that I didn't see it.

Mirror

[Anonymous Coward]

Spyware Heats Up the Debate Over Cookies
By BOB TEDESCHI

INTERNET users are taking back control of their computers, and online marketers and publishers are not pleased with the results. But they don't quite know what to do about their conundrum - if it is a conundrum, since they can't even agree on that.

Until recently, Internet businesses could track their users freely, using what are known as cookies, tiny text files they embed on the user's hard drive. Now, with the proliferation of antispyware programs that can delete unwanted cookies, they often cannot tell who has been to their Web site before or what they have seen. And this erosion of control over a tool for gaining insight into consumer behavior has many of them fretting.

"Cookies are critical from a business perspective," said Lorraine Ross, vice president for sales at USAToday.com. "They help us do things like track our profitability per unique visitor, for instance. But if you don't know how many people are coming in, you don't really have a handle on whether your profitability is improving or not."

It isn't necessarily just corporate America that is threatened by the anticookie fervor, Ms. Ross said - the deleters stand to suffer, too. For example, cookies help a computer limit how many times a user sees annoying ads like a floating, animated message. Such "frequency caps," to use industry parlance, are common among publishers. "So cookies are a really good thing for managing the user's experience," she said.

Last year, though, Ms. Ross said executives at the company debated how effective their frequency limits were, since a growing number of Internet users were deleting cookies and possibly seeing lots of animated ads.

Ms. Ross said that like most established companies, USAToday.com did not use its cookies to identify its users. "But the user's paranoia is understandable, given the history," she said.

Cookies first got a bad name in 1999, when DoubleClick announced that it would use them to identify Internet users and analyze both their offline purchasing patterns and online surfing habits for the purpose of showing them more relevant online ads. That plan died a loud, painful death after privacy advocates objected strenuously, and marketers and publishers have since taken a much more cautious approach.

Even so, privacy advocates deplore cookies and, as software programs like Webroot Spy Sweeper and McAfee AntiSpyware have come on the market, surfers by the millions are apparently knocking the cookies out of service as fast as the programs can be installed. This spring, the online consulting firm Jupiter Research published a report saying that nearly 40 percent of Internet users surveyed regularly erased them.

"I don't think cookies should be out there at all," said Marc Rotenberg, executive director of the Electronic Privacy Information Center, an advocacy group based in Washington, "but the good news here is that consumers are at least becoming more sophisticated about the appropriate use of cookies."

Eric Peterson, the analyst who wrote the Jupiter report, pointed out that most of the deleted files were so-called third-party cookies placed on the computer by a company other than the one operating the site the user was visiting. Most publishers rely on outside companies like DoubleClick and Atlas to send ads to the user's computer and track the effectiveness of campaigns.

Antispyware programs often leave in place first-party cookies, which can save users the inconvenience of having to log in to a news site each time they visit, but remove third-party cookies, the main target of users' ire. Some people say they think that total anonymity is the way to go.

The threat to the bottom line is real. Mr. Peterson said cookies not only helped sites measure overall profitability, but were critical in measuring the effectiveness of individual advertising campaigns. Marketers, for instance, could conceivably pay a Web site to deliver ads to 100,000 people, but only reach about 60,0

Personally, i do.

[domipheus]

But not because of security concenns, it is mostly because I have got into a nervous habit of clearing my cache and cookies every day.

A few months ago this was a different story, seeing about 400MB of cache/cookies taking up around a gig on the hdd because the files were so small changed it; and I dont mind having to re-login to sites every time, it means I am less likely to forget my various passwords!

Delete on exit

[jla0]

I have Firefox setup to delete cookies on exit. Also, it only accepts cookies from originating site as well. Remind me why I should KEEP cookies again? Oh I know.. it's probably for Amazon to start charging me more because I'm "loyal" customer!

Anti-Spyware deletes cookies

[H0p313ss]

The article is mentions the rise of anti-spyware and how it usually cleans up suspect cookies.

From my experience with average users, clients, co-workers and family, most users have no clue what the anti-spyware is actually doing, they just follow along blindly. Personally I think this a great improvement over the truely clueless who don't practice safe browsing of any sort.

Tough luck for marketers

[SpeedyGonz]

But I could use a wee bit less of ad bombardment and a little bit more of privacy . . . utopic as it may sound nowadays

Re:Tough luck for marketers

[shadowspar]

Au contraire -- you can opt to see almost no ads at all, and keep your surfing habits private to boot. Much to the marketers' chagrin, users can control what content they see while browsing the web. And sure enough, if you annoy someone enough with your ads, they'll try and figure out a way not to be subjected to them -- whence cometh Adblock, Flashblock, and NoScript, amongst others.

The message to marketers is loud and clear. Will they listen? By and large, they haven't yet.

Mangage THIS, yuppie scum!

[Le Marteau]

"So cookies are a really good thing for managing the user's experience" says a USA Today markedroid.

Clueless. Absolutly clueless. This goes straight to the heart of the matter. They can't understand why people don't want their 'experience managed'.

I can manage my own goddamned experience, thanks anyway. Keep your filthy paws offa me.

Re:Mangage THIS, yuppie scum!

[kevin_conaway]

Clueless? I don't think so.

The majority of their users probably DO want (or don't care about) their "experience managed". They most likely think that the small majority of people who oppose it will go ahead and block the cookies anyway.

I suspect the percentages of people deleting cookies are not people that are actively deleting them because they are worried about their privacy. Its most likely that the cookies are getting caught up in a spyware removal tool.

In short, they are saying: If you don't like them, delete them.

Re:Mangage THIS, yuppie scum!

[darkmayo]

I dont know about you but many times I have been lost in a torrent of unmanageable experiences on the internet only to be saved from the vast insansity of netspace by a few hundred doubleclick cookies..

Save your mind! dont delete your cookies!

Re:Mangage THIS, yuppie scum!

[shadowspar]

Hear, hear.

For example, cookies help a computer limit how many times the user is exposed to annoying ads like a floating, animated message. Such "frequency caps," to use industry parlance, are common among publishers. "So cookies are a really good thing for managing the user's experience," she said.

Of course, you could just not show the annoying floating, animated ads to begin with -- that would improve the user's experience even more. In fact, one has to wonder why you're showing them in the first place, since your users hate them!

The stupidity! It burns!

Re:Mangage THIS, yuppie scum!

[jim_v2000]

"I can manage my own goddamned experience, thanks anyway. Keep your filthy paws offa me."

I suppose you don't like well designed and laid-out websites...perhaps you would prefer a giant text file of info?

Re:Mangage THIS, yuppie scum!

[Dr. Evil]

Oh god yes!

Re:Mangage THIS, yuppie scum!

[Anonymous Coward]

AOL! to that (no pun intended).

Re:Mangage THIS, yuppie scum!

[Le Marteau]

I suppose you don't like well designed and laid-out websites...perhaps you would prefer a giant text file of info

What does that have to do with external entities trying to 'manage my experience'?

I like a well designed and laid out book, but I don't want it dynamically changing based on how some external entity thinks I should peruse it. I prefer to use an index or table of context rather than have the book try to divine my intent.

Likewise with a web site. What on the net REQUIRES 'management of user experiences?'. Banking? I could find my account page just fine if they'd cut the cruft and make it lean and mean instead of fat and bloated. Shopping? I know what I want when I go to the site... I don't need junk flashed in my face. Reading the news? Likewise, I don't need some half-assed AI smacking me in the face with stuff I could just as easily find using a search or a table of contents or an index.

Re:Mangage THIS, yuppie scum!

[greed]

only to be saved from the vast insansity of netspace by a few hundred doubleclick cookies..

Yeah... I have no sympathy for cookies set in response to IMG requests (typically, cross-site tracking cookies). And I got fairly tired of Certain Ad Servers taking forever to cough up the ad, that my nameserver grew a few new entries like this:

zone "doubleclick.net" IN {
type master;
file "master.d/null";
allow-update { none; };
};

Any site which results in the browser "barberpole" running for ages after page load appears complete gets their whole domain taken out that way. Especially if it is a file called "blank.gif" that is reported to be "1px x 1px". That's there for nothing but cross-site tracking.

Re:Mangage THIS, yuppie scum!

[Anonymous Coward]

Keep your filthy paws offa me, you damn dirty ape!

(Sorry, I had to complete the (almost quote) -- my Asberger's at play)

Re:Mangage THIS, yuppie scum!

[Anonymous Coward]

You're a dickweed for running BIND.

No, but...

[lilmouse]

I don't allow cookies in the first place; that kind of obviates the need to delete them.

I accept cookies from about 10 sites (and yes...slashdot is one of them). And even those get deleted when I close firefox!

When I set up others' computers, I only allow cookies from the orinating website, so that cuts down on cookie retention as well.

No one needs to track me!

--LWM

Re:No, but...

[Frymaster]

I don't allow cookies in the first place;

i went through a no-cookies allowed period a couple of years ago and i quickly found something out: they're actually useful and in a lot of cases, dare i say it, desireable.

call me lazy but i actually like my login forms prefilled (name only, of course). i like my template preferences recorded. when i go to ecommerce site 'x' i honestly find it convenient to see what i bought on my last trip.

and, above all, i want to be able to maintain sessions on a lot of sites. increasintly, if you don't have cookies, holding a session is impossible (unique id's on the getline are going the way of the dodo) and, increasingly, sites want you to maintain sessions to do anything useful.

Re:No, but...

[advocate_one]

and, above all, i want to be able to maintain sessions on a lot of sites. increasintly, if you don't have cookies, holding a session is impossible (unique id's on the getline are going the way of the dodo) and, increasingly, sites want you to maintain sessions to do anything useful.

well... durr... that's what session cookies are for... doesn't ie support them then??? who really cares, Konq and Firefox do... and that means I'm happy ;)

Re:No, but...

[Jaseoldboss]

Here's what I do.

Get Firefox to turn ALL cookies into session cookies by deleting them "when I close Firefox" in options.

Then make exceptions for the sites you want to track you. I do this for /. so I don't have to log in everytime.

From the article;

This anticookie fervor also hurts the deleters, she says. For example, cookies help a computer limit how many times the user is exposed to annoying ads like a floating, animated message. Since when should you trust a site not to annoy you with ads, block popups and use Adblock and Flashblock.

"...So cookies are a really good thing for managing the user's experience," she said." If this was true, we'd all be installing adware on our computers to deliver 'interesting relevant and targetted' advertising to enrich our web experiences wouldn't we? Bah!

Re:No, but...

[Evil Grinn]

increasintly, if you don't have cookies, holding a session is impossible (unique id's on the getline are going the way of the dodo) and, increasingly, sites want you to maintain sessions to do anything useful.

For session tracking, cookies are now the standard, but there are other security precautions that can only accomplished by including a unique ID in every form.

Go read up about "session riding" or "cross-site request forgery". For example:

http://shiflett.org/articles/foiling-cross-site-at tacks

See the code sample near the end of the page, under "Force the use of your own HTML forms".

Re:No, but...

[gosand]

and, above all, i want to be able to maintain sessions on a lot of sites. increasintly, if you don't have cookies, holding a session is impossible (unique id's on the getline are going the way of the dodo) and, increasingly, sites want you to maintain sessions to do anything useful.

Another example of shopping sites: if you add things to your cart, and come back to the site later, you can keep your cart if you have cookies enabled. That is a great convenience for shoppers. We do this at the ecommerce company I work for. There is no personal information in the cookie, just product data. One of our clients even recently asked for us to increase the life of the cookie from 7 to 30 days.

We can gather data on your purchases without cookies anyway. And as much as people want to think that Big Brother is always doing malicious things with their purchase info, sometimes they don't. We used Omniture tracking too. It is really quite amazing, you can track clicks, time on the page, and paths through the site. You can't, however, track it to a person (at least in our system). We had a client that was concerned about sales, and by looking through the Omniture data we came up with a plan to redesign the site. It helped to understand how the current client base was using the site, and how it could be improved.

Re:No, but...

[LurkerXXX]

I don't accept cookies for 99% of websites. I will from a few I trust or just to make life easy on a few. Others I allow, but delete at fairly regular intervals (Google, etc).

Re:No, but...

[stranger here myself]

and, above all, i want to be able to maintain sessions on a lot of sites. increasintly, if you don't have cookies, holding a session is impossible (unique id's on the getline are going the way of the dodo) and, increasingly, sites want you to maintain sessions to do anything useful.

Only reason I allow them. But for this there is no need for the cookie to persist after the session, and hence my browsers are set to delete all cookies when I close the program.

Cookies which don't serve such purposes (e.g. most 3rd party cookies, anything at all from certain domains) are blocked anyway.

Re:No, but...

[alphaseven]

I accept cookies from about 10 sites (and yes...slashdot is one of them). And even those get deleted when I close firefox!

I allow all sites to set cookies and I delete them when I close firefox. I figure if I visit a site it can track me going around the site through my ip, tracking numbers in the url, and the referer... then dissallowing cookies won't matter much. It wasn't worth the hassle from sites that say "you must allow cookies" to visit.

I delete cookies because I don't like the idea of, say, Amazon keeping a list of every book I've ever searched for or looked at on their site for the past several years, because I can't help but think that having thousands of cookies stored would have a negative effect on my PC's performance, and most importantly, because I don't see much "advantage" in allowing sites to set persistant cookies.

Re:No, but...

[gstoddart]

i went through a no-cookies allowed period a couple of years ago and i quickly found something out: they're actually useful and in a lot of cases, dare i say it, desireable.

call me lazy but i actually like my login forms prefilled (name only, of course). i like my template preferences recorded. when i go to ecommerce site 'x' i honestly find it convenient to see what i bought on my last trip.

I'm glad it's useful for you. And, I'm glad you can configure your browser however the hell you want.

I just think that leaving passwords filled out in forms managers is like leaving your keys in the car so it's already to do.

If it's been so long since I've logged on to your site I need to track down my password, that's good.

I have my cookies set to 'originating only' and 'ask'. Sites like slashdot, I leave cookies on and I don't need to login. Damned near everyone else is excluded.

I, for instance, sure as hell would not like any banking sites or the ilk to be recorded and filled out. It's just dangerous.

Re:No, but...

[pthor1231]

I believe the PP said that he only used cookies to fill in usernames, not passwords. I should hope that if someone can go through an anti-cookie phase, they are smart enough to not save passwords in cookies.

Re:No, but...

[slavemowgli]

I rarely delete my existing cookies, but I do generally disallow sites from setting cookies unless there is a positive reason why I'd want them to have that ability.

For example, if I read a Slashdot post that links to an article on $RANDOMSITE, which tries to set a cookie when I visit it, I simply disallow that cookie and tell Mozilla to remember my choice. For Slashdot itself, on the other hand, I do allow cookies (and persistent cookies, too, not just session cookies); I like to be able to have the site customised to my preferences and to be able to post without having to log in first.

For sites that do legitimately require cookies to function (many e-commerce sites, for example) but for which I don't want the tracking etc. that comes with persistent cookies, I typically allow session cookies only, so that new cookies are thrown away when I exit Mozilla.

In general, the decision really depends on whether I think I get any value out of the cookies myself (as opposed to simply being tracked without any benefit for myself), and on how "evil" I think the site is. The "remember my decision" functionality ensures that I don't have to click away tons of cookie setting attempts each time I use the browser.

As far as ad tracking is concerned (as opposed to tracking done by the site I visit), I usually don't even see those cookies, since AdBlock already blocks the images/iframes/objects in question.

But of course, all that's just me, and I don't think I'm a typical user. The rest of my family, who doesn't obsess about computers the same way I do, probably doesn't even know what cookies are, much less that you can even choose to not accept them.

Re:No, but...

[revmoo]

More like leaving your keys in the car while it sits in a locked garage.

Block 3rd party cookies and allow the rest and you should have nothing to worry about. Unless you enjoy the paranoia.

Re:No, but...

[Frank T. Lofaro Jr.]

Perhaps allowing sessions based on URL parameters will become popular again.

There are no significant drawbacks.

Re:No, but...

[techno-vampire]

Since when should you trust a site not to annoy you with ads, block popups and use Adblock and Flashblock.

You and I have much the same way of dealing with ads. However, the idea is that if you are going to see ads, you should see a different one each time. That way, instead of having one product shoved under your nose over and over, you get one look at a large number of products. This increases the chance that you will find at least one of the ads useful and lowers the chance that you will get so fed up you block them all.

As I see it, you have two sensible choices. Either you block all ads or you allow the cookies. Blocking cookies and accepting ads just gets you bombarded with endless repititions of the same thing and that's the worst outcome.

Re:No, but...

[murukusu]

I'm only accepting cookies from few sites and blocking all but google's text ads. I must say that since I started to surf like this, my user experience has improved vastly.

Re:No, but...

[Brandybuck]

Like any tool, cookies can be used for either good or evil. I've got a cookie set at Netflix. In what possible manner could Netflix use this cookie for evil? They already have my information! If they wanted to sell my movie rental history to the highest bidder, they don't need a cookie to do it!

I've got cookies set to "ask" by default, and I routinely set sites to "no" if I'm casually browsing, or "yes" if I have a commercial relationship to them. Most other cases get a "no" as well.

Re:No, but...

[bluefoxlucid]

Read up on session hijacking. You'd be surprised at the security implications of a single poor assumption. (for example, someone typing a random number and suddenly getting your username and password and other info because they appear to be you on that session)

Re:No, but...

[Frank T. Lofaro Jr.]

Simple fix, use a 128 bit randomized/pseudo-random number.

(such as the md5 or sha1 of a unique secret string and the uid on the server would work).

Guessing or accidently getting someone else's valid session would be astronomically hard.

page.cfml?uid=5

would be bad

page.cfml?session=f19936b6aefab2ec2d54932b31065c58

would be safe. (2^128 is a huge space of possible session ids!)

Re:No, but...

[bluefoxlucid]

If it's random, you drain the entropy pool; if it's pseudo-random, a little analysis as you log into multiple sessions and track the numbers may reveal the state of the random number generator and reveal likely values. So now your 128 bit random number is either a drain on precious cryptographically-secure entropy (/dev/random); or your 128 bit pseudo-random number is simplified to 12 bits (/dev/urandom) (4096 potential values). You face either a DoS attack; or an attacker who can _almost_ do it and gains more knowledge of the state of your system at each failure.

They NEVER expire

[Anonymous Coward]

"bad" cookies, the ones you should be deleting, will have expiration dates years in the future. The server chooses the expiration date.

Best way to do it is to set cookies to delete 'When I close firefox'. That way it's cleaned every time you start the browser.

Deleting cookies

[harmlessdrudge]

Use a ramdrive. Nothing to do. They delete themselves. Or blackhole them in the first place. See http://everythingisnt.com/hosts.html

Re:Deleting cookies

[Anonymous Coward]

WTF is with the a link to an .EXE file for a fucking host list?

Let's put it like this

[Moraelin]

Let's put it like this: when you have someone whose very revenue depends on "detecting wolves", they'll cry "wolf!" All the time. They'll cry "wolf" at the neighbour's "alsacian wolf" dog even. I'm talking about anti-spyware and other "security" companies. Do they delete cookies? Well, I briefly had McAffee installed, and among other problems (such as being a piss-poorly programmed POS) it did exactly that. It tried to protect me from all those supposedly dangerous cookies, storing such "personal details" as the session ID on some site. I'm not kidding. Using half the sites that required logon (such as Gamespy's Fileplanet) was suddenly impossible. So based on that I'd say the concern is genuine. But it's probably not the users going through the menus to delete cookies. Joe Average probably wouldn't even know or care what a cookie is. But Joe Average likely has some POS security software installed that deletes the cookies for him

Re:Let's put it like this

[Chibi Merrow]

Even SpyBot and Ad-Aware offer to delete tracking cookies for you for advertisers like Doubleclick. That's kinda nice, in my opinion. And that's probably what's causing this phenomenon. People are sick of spyware, so when they run Ad-Aware they just tell it blindly to delete everything it finds.

Re:Let's put it like this

[Anonymous Coward]

I think you need to differentiate between session cookies and permanent cookies. It should be sufficient to log into any site using session cookies. And if sites want to store information between sessions, they can do it server side linking it to your login details - rather than to a permanent cookie.

So sites having these problems must be sites that require no logging in... or sites that are not well build.

So if I log into a site, I already know, that I review information about my self and they can track me.

However, sites I do not log, should not be able to track me. There deleting permenent cookies should be fine from anti virus makers' and the users' point of view.

Re:Let's put it like this

[SolidGround]

They're not deleting cookies for your benifit but for their own. They actively rely on the fact that most people can't tell the difference between an innocent cookie and malicious software/spyware.

Including cookies in their detection engine is meant solely to artificially inflate the number of 'threats' the program finds on every run and trick the clueless user into thinking they *really* need the software because "OMG! It found 100 threats!!!!! Microsoft crap!!!!".
It's also the reason why every single file and registry key counts as one threat as opposed to grouping everything together.

If Ad-Aware really wanted to keep you save, instead of the deleting the Doubleclick cookie it would replace it with the "don't track me" cookie Doubleclick provides to give one example.

Anti-spyware software is no different than anti-virus software. They both aim to instill 'fear' to retain users and to generate revenue.

Re:Let's put it like this

[Moraelin]

Your distinction between session cookies and persistent cookies is insightful and well taken. McAffee's "privacy" component, however, had a _major_ problem with non-permanent session cookies too. It terminally screwed half the sites where I logged on.

Now I'm not saying that it's what _all_ anti-virus programs do. It's probably just McAffee being POS. (They even screwed up one update and left two versions of itself automatically started at the same time. One of which couldn't be even uninstalled any more without manually editing the registry. So I'm really talking utter POS.)

But I'd also take a wild uninformed guess and say that they're _probably_ not the only ones who are clueless about it. Everyone and their grandma makes firewalls and "anti-spyware" nowadays, and I wouldn't be surprised if half of them didn't even know what they're doing.

Re:Let's put it like this

[KillShill]

if wahabism must be destroyed, which is an honorable thing to do, why not also go after the people who created it?

Re:Let's put it like this

[Chibi Merrow]

It's also the reason why every single file and registry key counts as one threat as opposed to grouping everything together.

Actually that's not the case w/ latest versions of Ad-Aware. The summary screen by default groups problem files/keys together instead of registering them as as seperate threats. It also lists tracking cookies as negligible objects, not critical ones. What, exactly, has you so jaded? You work for Claria or something? :P

Re:Let's put it like this

[Chibi Merrow]

if wahabism must be destroyed, which is an honorable thing to do, why not also go after the people who created it?

I wouldn't have a problem w/ it...

Nah

[Anonymous Coward]

I think most users don't actively delete their cookies, however a lot of users sometimes run tools such as SpyBot and Ad-Aware which all tag cookies as "spyware" and most normal users will just delete them when this happens.

There's also plenty of devices out there where clearing the cache wipes cookies not to mention rebuilding your PC and whatever else you do.

So I think the answer is that most people retain their cookies but the stats show otherwise because they accidentally lose them along the way.

Also, how do they know I deleted my cookie? Surely to tell I'd done so they need to know that I was the same user both times, how are they tracking that without using cookies?

SM

Web Developer

[Anonymous Coward]

As a web developer, session cookies are extremely handy - I hate using the session ID in the url or hidden fields - and then adding in IP checking to see if they have copied and pasted their url coomplete with SID to their friends.

Re:Web Developer

[psyon1]

And with AOL visitors, the IP will most likely change through the course of the visit, so that really breaks the IP checks also.

I still want to know when exactly cookies became evil.

Re:Web Developer

[Anonymous Coward]

Almost every site I go to asks to leave a cookie behind. I have mozilla set to keep my info on a per-session basis. On top of that, I have privoxy installed and it blocks all kinds of sites like doubleclick.net from dumping garbage on my machine.

Re:Web Developer

[psyon1]

Are you saying thats when they became evil? Its not possible all the sites have a use for the cookie? I use cookies so that people can login and so they can customize a site. You dont think other sites do that? As for ad networks, sorry to tell you guys, but they support free content. They will not go away, blocking their cookies does nothing more than make them find new ways of tracking which ads they have already shown you. Would you prefer to just see the same ads over and over and over and over?

Cookieculler

[Dr.Opveter]

I use Cookieculler to protect those cookies I value (cause not all cookies are out there useless) and I delete the rest frequently.

I don't

[Anonymous Coward]

I don't. Cookies are useful on a lot of sites. And let them track me. I don't care if they see that I never click on any of their ad links. And I'm sure I give their datamining tools a work out. My interests randomly change on a near daily basis. Hell, I'd be amazed if they could even guess my gender. :P

Re:I don't

[stevejsmith]

Hell, I'd be amazed if they could even guess my gender. :P

What kind of porn sites are you looking at?

We want cookies with new flavours!

[eebra82]

The software companies should come up with a new way of measuring visitors on their web sites. Cookies do tell a lot but people delete these on a regular basis. Hell, I do too. Who'd want your sister to find out that you actually got your login pre-registered already on that local porn site of yours? :-) Jokes aside, I wonder who's the most keen on knowing this: the ad sponsors or the people who work with the websites? "Hey, our statistics show that we got approximately 39% more visitors now! Good job Spock!" As more and more sites include community features, more and more users also log on to the web site they visit. How about measuring this, and then try to get an idea of how many unique IP:s you got, make a poll and then base the poll results on that?

Not deleting, but selectively storing

[Kr3m3Puff]

For a long time I have taken advantage of Mozilla and then Firefox's ability to pop up and let me know any time anyone hands me a cookie, quickly banning those sites that appear to be nothing but cross-site ad trackers.

Looking at the content of cookies, which Firefox allows demonstrates some interesting things, like my IP address more often than comfortable. Of course I love the "badly" written sites that try to hand me a PHP or ASP session cookie on the first page of the website. I usually nix those. At least tell me what you are doing for me before I decide to let myself be tracked.

Personally I won't go out of my way to block ads, but I will go out of my way to not allow the world at large watch my every click of the mouse.

On the other hand, the family members I invariably help with their computers regularly run Ad-Aware and delete cookies it identifies on a regular basis.

Re:Not deleting, but selectively storing

[XO]

Any PHP site that has user login ability is going to likely have to do that. Think about it.

Re:Not deleting, but selectively storing

[maxwell demon]

Why does it have to set a session cookie before you log in?

Re:Not deleting, but selectively storing

[Kr3m3Puff]

Exactly...

PHP will only attempt to set the Session cookie when you try to initiate a session. I think it is really bad form for your front page to be a page that contains a session initiation in PHP.

Re:Not deleting, but selectively storing

[XO]

example: slashdot's main page has the login box. It asks your browser if you have a session already, your browser says "why, no i don't", slashdot sends a cookie. Slashdot now knows that you have a session that doesn't know what it's logged in as, since it's not logged in.

so what

[El_Muerte_TDS]

They shouldn't have annoyed the visitors anyway with annoying ads.
Besides, there are other ways to track users without cookies. Or at least, most users don't use anonymous proxies anyway.

Adaware

[dave1g]

I think Adaware still marks cookies in its scan, so whenver I clean someone's computer with so much spyware, I just hit select all and then delete. I imagine most people dont go picking through it to save the cookies.

This is caused by Helpdesk.

[jidar]

Many many helpdesk employees at ISP's tell users to delete cookies. I worked helpdesk for awhile about 4 years ago and back then although sometimes it did help it was mostly snake oil. Some help desk employees at a large ISP did little else besides tell people to delete cookies and reboot. Regardless of whether it works or not the users have learned to do it on their own. A lot of calls these days will start with "I deleted my cookies already but it still doesn't work.."

Re:This is caused by Helpdesk.

[FidelCatsro]

Reminds me of a time i tried to report a fault to my ISP .
this was a while back and i cant remember the exact details , but this is the rough conversation.

Me : Hi , i was wondering if the were experiencing any downtime in *Area* tonight, I can't seem to get a connection

help desk : oh , are you sure you have the internet configured properly

Me : yes , I have not changed any config files since this morning and I even checked a back up to make 100% sure. I can not get any connection to your service

Help desk : have you tried deleting your cookies ?

Me : I was actually attempting an FTP connection

Help desk : sir could you try deleting your cookies

Me : What exactly would that accomplish , I am not having problems with my web browser . I simply am not able to connect to your service

Help desk : Sir , if you could just try that for me , and we will see.

Me : It will not help , I know there is nothing wrong with my computer and was simply enquiring if you had any down time tonight.

Help desk : Sir , please try to delete your cookies and reboot windows

Me : .... I don't use windows and as i have tried to tell you ,I do not need help only information

Help desk : Sir we can not help you if you do not let us

Me : ... um , may i speak to a member of tech staff or your supervisor please

Help desk : I'm sorry Sir , no one is available

Me : Good bye *hangs up the phone*

-----------

I tried again later in hopes of finding a competent member of staff and was greeted with an automated message informing me of a server upgrade and to expect down time in my area.

Not regularly, can I report that as a bug?

[Angelwrath]

[...]who is deleting cookies? Are you?

I wish I wanted to waste that time, but I can't. I recently deleted them.

What we REALLY need is anti-advercookie features in our browsers, preferably Firefox, so we don't need to delete the advertising, we can have the software do it. Think of it like modern anti-virus, but it scans and removes ad cookies. Oh sure, accept it for a session, but when the session ends, the cookie is deleted automatically

Advertising / unwanted cookies only. Slashdot cookies must stay. ;)

Re:Not regularly, can I report that as a bug?

[Proteus]

Oh sure, accept it for a session, but when the session ends, the cookie is deleted automatically

In the "Cookies" section of the "Privacy" panel in Firefox options, you can set the "Keep Cookies" dropdown to "Ask me every time". When you do this, a site attempting to set a cookie will trigger a dialog box, where you can choose to Allow, Deny, or Allow for Session. By clicking a checkbox on that dialog, you can remember your decision for a domain.

By doing that, session cookies are kept until you close your browser, but no longer. Sites you want to allow to set cookies (like /.), you can choose to Allow. Sites like doubleclick, you can choose to Deny.

Periodically

[SailorFrag]

Every month or two (really, whenever something prompts me to think about it, which is infrequent) I go through and delete all of the cookies except the ones I know do something I want (i.e. keep me logged into slashdot) or I personally know the people who run the site & am completely sure that they're not being used for anything I disagree with.

I tried selectively allowing cookies (making liberal use of the "always accept from this site" and "always deny from this site" buttons), but it was a pain, and cookies don't really hurt me. My browsing habits won't be hard to track anyway because I've got a distinctive user-agent (firefox on linux) and my IP changes infrequently.

My cookie settings

[Henry V .009]

I tell Firefox not to accept a cookie unless the site is on my exceptions list. When I add a site to my exceptions list, I always set it to "allow session cookies only."

I have to re-enter passwords when I restart my browser—but that's what password manager is for.

Re:My cookie settings

[dtfinch]

Session cookies are pretty harmless and often important. I allow all session cookies, and have an exceptions list for allowing permanent cookies.

I never delete cookies

[Anonymous Coward]

... because I rarely accept them. On the rare occasion I do, its for the session only.

Permit Cookies is the best extension for Firefox yet. http://mfe.gorgias.de/

I Love Reeking Havoc on Ad Companies

[kiehlster]

I practically laughed when I read this article. I totally delete every cookie that has the word "ad" in the url somewhere and then I delete some on top of that. Then I eat a cookie for good measure. And finally I sit back and laugh at the ad companies while their valuable consumer statistics get all screwed up. Oh, and not to mention, I have a number of ad websites resolving to my personal web server so I can browse the web ad-free while not screwing up the layout of the website in question. They get what's coming to them if they think they can advertise smilie faces and junk like that to me. I'll only tolerate google ads because at least they are sometimes relative to what I'm looking for. But I'm still going to delete their cookies.

adware removers

[XO]

xoftspy and ad-aware tend to remove tons and tons of cookies.

Personally, I leave them accepted. I don't give a crap if some database somewhere infers what my computer has been browsing.

I use Opera, which doesn't normally have it's cookies infiltrated by xoftspy and ad-aware.

But Opera kicks ass anyway.

In Soviet Russia

[gtrubetskoy]

...cookies delete you

My Cookie Usage

[RAMMS EIN]

I personally allow only session cookies.
Session cookies are a great way for websites to track authenticated users (better than the HTTP authentication mechanisms, anyway). Other than that, cookies are mostly used in ways I don't want them to be used:

  - Remembering authentication information. No thanks. If I wanted that, I'd get some software that remembered authentication information.
  - Remembering preferences. Better stored on the server side in almost all cases, IMO.
  - The privacy-invading sort of cookie.

I basically get the beneficial session cookies, while thwarting the uses I don't want. Another argument is that it's ok for people to know that I am this authenticated user, but it's not ok for sites to go storing information on my computer, without me requesting that.

I love cookies

[RingDev]

I love cookies. I think they are awesome. Cookies let Amazon know what I was looking at last so they can present me a list of books that I might and often do like with out having to search for hours.

Cookies let /. keep me logged in

Cookies help track my passwords so I don't have to look up each and every password each time I visit a site.

If cookies help some company that I'm visiting improve their marketing making it easier or better for me to get the product I need, that's awesome!

Call me a troll, but I'm not on the tin-foil hat wearing anti-coolaide conspiracy band wagon. I like things that make browsing easier and more productive.

-Rick

what cookies?

[Anonymous Coward]

my hosts file has reached 1 meg.. i dont get any of the damm ad cookies anymore.

tell you what ad scum... PAY me for tracking my habits. and i might allow you to.

you are trying to get something. for nothing. whats in it for me to have you track me all over hell?

Re:what cookies?

[stevejsmith]

The content on the website you're visiting, maybe?

Delete them?

[Anonymous Coward]

Delete them? Why would I have to do that when I don't accept them in the first place?

*confused*

Cookies

[Mr_Silver]

Who is telling the truth and who is deleting cookies? Are you?

No, because it's too much time and effort, I can't be arsed and a whole bunch of sites will randomly break and I'll have to remember all the usernames/passwords and configuration settings again. So i'd have to be selective about what I delete to ensure that doesn't happen and then you get a whole list of ones you need to keep or you accept/deny them when you go to a site and ... sorry ... but thats just too much like hard work and paranoia to make browsing the web remotely fun.

If you seriously think that users en mass are deleting cookies or that a bunch of Slashdotters with overly thick tin foil hats are indicative of the world, then you'd be very much mistaken.

Most people don't know or care there is such thing as cookies and even when they do, can't be bothered or simply see no need to go deleting them every time they exit their browser.

I have far more important things to worry about than worry about a bunch of cookies that doubleclick has set (technically they don't anyway as I block their adverts).

A rhyme for you all...

[theashworld]

A cookie a day, keeps privacy away.

WTF???

[Anonymous Coward]

"They help us do things like track our profitability per unique visitor, for instance. But if you don't know how many people are coming in, you don't really have a handle on whether your profitability is improving or not."

So, like, when I buy a copy of the New York Times from a vending machine, it has a way to tell if I bought yesterday's paper, which stories I read, and which ads led me to the store to buy something?

I've been reading, watching TV, and listening to the radio for half a century. I was impossible for you to track.

Why is what was once impossible now mandatory?

I call bullshit. These so-called "people" are lying, theiving scumbags. Were they all to die horribly tomorrow, the world would be a better place.

System Efficiency

[Durrill]

I was told during my A+ course that it should be routine for someone to blow away their cookies on a regular basis. Supposedly browsers check to see if any / all your cookies had expired everytime your browser loads up, the more cookies you have, the longer it takes to get your home page to load up. How can a textbook course such as A+, which seems to teach a standard on PC maintenance/repair/efficiency would be wrong about eliminating cookies. They even recommended, that if you could live without them, try and disable cookies. Though today, you can't get too far into a website that relies on such technologies.

Re:System Efficiency

[KillShill]

which is why such websites should die a horrible death.

Firefox has poor cookie management

[plover]

Out of the box (or out of the 'download' folder, I should say) Firefox has really poor cookie management. I have it set to prompt, but once I deny a site permission and realize I want to do business with them it takes many mouseclicks and a lot of stupid scrollbar searching to hunt down the cookieblock and delete it.

There are some cookie management extensions out there, but for "normal" people to better manage their privacy (or even to realize they have privacy right that they can manage) I'd like to see "prompt always, deny third party" turned on by default, and a cookie toolbar/rightclick option that allows you to accept/decline/delete them. As a matter of fact, that would be a nice option for the Firefox installer: a checkbox that says something like "[ ] Help me manage my privacy rights online." We could debate whether or not it should be on or off by default.

Or, weirder yet, what about something like the infamous Clippy? "Hi, I'm Foxy, and I'm here to help you with online privacy so you don't become a victim of identity theft, or a pawn of corporate marketing strategies!"

Re:Firefox has poor cookie management

[RobbieGee]

Opera has separate choices for third-party cookies.

Re:Firefox has poor cookie management

[dakirw]

I've found the Firefox cookie management to be reasonable. I usually allow cookies, but they're only kept until I close Firefox. I've also added sites to the Exception list.

Of course, for the truly paranoid cookie-averse , just uncheck the Enable Cookie checkbox and add exceptions to the sites list (/., your banking sites, etc.)

Re:Firefox has poor cookie management

[Duckman5]

A much more useful variation on your suggestion to simply disable cookies is to install the Permit Cookies Firefox extension. It allows you to set exceptions for sites without going through the preferences dialog. All you need to do is hit Alt+C and set your preferences for the particular site.

The only problem I've ever run into with this particular setup is those obnoxious sites which have a redirect in the middle that sets the cookie (MS Passport, for example). Other than that, it works great and I only get the cookies from sites I explicitly approve of.

Re:Firefox has poor cookie management

[SirPavlova]

Mozilla actually has a tools->cookies menu that lets you quickly block or unblock cookies from a site. Why doesn't firefox?

Remember what exactly Firefox is? It's Mozilla Lite. It was created specifically because people wanted a slimline browser without feature bloat. For some reason they think this is feature bloat... don't ask me why.

Magazine, Radio, TV, Roadside, Word of Mouth..

[Genjurosan]

So what if I'm deleting my cookies? They can't track what magazine's I pick up from the grocery store, what channels I watch on my crappy standard cable service, what I hear on Radio (the worst of the bunch, or what I see when I'm driving down the road.

So why are these babies crying about the users finally being impowered and taking things into our own hands? Did they assume that we would never catch on? I guess we should remain blind and stupid consumers eh? Now where is my Food Lion MVP card?

Re:Magazine, Radio, TV, Roadside, Word of Mouth..

[maxwell demon]

So what if I'm deleting my cookies? They can't track what magazine's I pick up from the grocery store, what channels I watch on my crappy standard cable service, what I hear on Radio (the worst of the bunch, or what I see when I'm driving down the road.

What? This hole must be plugged! We must immediatly:

• Add a back channel to each TV and radio, telling the advertisers what ads were played.
• Also, add a cam to those devices, so advertisers can check who actually recieved them. (Maybe you went to toilet during advertising? Shame on you, that's what the programme in between is for!)
• In addition, add cams to every store selling newspapers and/or magazines, to check who buys them.
• And not to forget the cam on every placard so that the advertising industry knows who looks at them.

of course I delete them

[Anonymous Coward]

I don't want my kids to find the porn sites I view!

me

[Anonymous Coward]

Used to do vet each and every cookie religiously as they came in, but now I can't be arsed to. I let all cookies through.

On the other hand, I'm now extraordinarily dedicated to purging every last ad from any page I use via adblock... Some of the text ads are even a fun challenge to eliminate. (Whereas some are totally impossible, too. You win some, you lose some.)

Keep what I want, ignore what I don't

[Gaima]

Personally I keep konqueror set to ask me everytime a site attempts to set a permenant cookie, and show me the details of it.
If I want/don't mind a cookie, I accept it, if not buh-buh cookie (webtrends, ads, anything that allows the page to render (thus has come from an image/ad), etc -> bit bucket)

I have also done this for the machine my brother and mum use, and attempted to teach them why (although I don't know if they've turned it off).

Not so much "deleting"...

[zecg]

...as "not allowing" them to be set in the first place. I allow a handful of sites (10 or so) that I use to put my passwords in the permanent cookies, Google's cookie and a few others as per-session and that's it. Cookies' dirty little secret is, the way they are used in a 99% (subjective assessment) of the sites, they really serve no useful purpose.

Re:Tough luck for users

[RingDev]

Not going to happen. You are either going to get MORE untargeted adds with a lower success rate, or LESS targeted add with a higher success rate. So if you keep your surfing details super private, you will get pop-ups for lavitra and enzyte. If you letter you habbits be known, you may still get those adds, but likely only if you visit a combination of elderly, porn, and health sites.

-Rick

Flash shared objects

[PsiPsiStar]

Most people don't delete their flash shared objects, which can serve the same purpose as cookies.

So they're still screwed.

Does anyone know of a spyware removal program that kills shared object files?

Re:Flash shared objects

[sh0rtie]

Does anyone know of a spyware removal program that kills shared object files?

not a program per say, but this works great as a Firefox extension, works on all the main platforms too.

The author states the reason such an extension exists and provides links to marketeers bragging about how they can beat cookie deleters by using the capability, of course if you combine this extension with the Flashblock extension they rarely get the chance to abuse the localstore

Re:Flash shared objects

[Lagged2Death]

I actually removed Flash from my work PC completely. And it turns out I don't miss it a bit. No more slow-loading, annoying animated ads. No more too-fancy mystery-meat website navigation. No more Homestarrunner or Flash games while I'm supposed to be working, either.

Re:Flash shared objects

[KillShill]

only if you're naive enough to have installed flash.

if you desperately need to see the bli**-bli** of the week, use a stand-alone flash player.

macromedia can **** off and die.

Re:Flash shared objects

[PsiPsiStar]

Considering I have to make stuff in flash (for e-learning. not ads) I didn't have much choice as to whether I wanted to install it or not.

why do I get the feeling...

[urdine]

That Slashdot users make up 100% of that 40% of users?

Thank you, people, for doing it!

[SolitaryMan]

Thanks you, people, for removing cookies, so all this "we watch you" stuff doesn't work.

I'm too lazy to do it myself...

What about editing cookies?

[G4from128k]

I've often wondered what kind of havoc would occur from editing cookies. I'd bet that most websites don't have input validation for read cookies because they assume they are just reading back the well-formed string they wrote to your machine.

I'm surprised there aren't more news stories of exploits based on mal-formed/overflowed cookie strings. But maybe there are exploits out there and the sites are too embarrassed to admit they were hacked with their own cookies.

Blame IE6/P3P

[Mobile Unit of the G]

The gradual adoption of IE6 has made cookies less useful. The default policies are pretty tough. You'll lose a lot of cookies if you don't specify a P3P policy and you'll probably lose some if you specify an honest P3P policy: I've noticed the decline in cookie acceptance for quite a long time. One big problem is that P3P doesn't have sufficient granularity to explain that a site's policies aren't terribly privacy violating. For instance, I work on a largely academic site that has interactive features that require user log in, valid emails, all that. We share psuedonymous logs with computer science researchers. IE6 would like our cookies if we did one or the other, but there's no way to convince it that we'll never share personally identifiable information with other parties.

Anyone NOT deleting their cookies?

[llevity]

I see all these posts about people who delete them every day, every time they close their browser, or they don't accept them to begin with.

Anyone just not give a damn? I mean, everyone's up in arms about privacy, and these lofty ideals of how it should be protected, etc. Just come out and say it. You don't want anyone else to see what porn sites you've been to.

Personally, I don't care about cookies. I don't have many illusions of privacy to begin with. I'm just non-egotistical enough to know that no one really cares about what sites I go to, as an individual.

They want to track my usage and habits? Fine. Throw me in a demographic, and call it a day. Use me as a statistic. Whatever.

Is everyone here paranoid, or do I have any fellow compatriots in the nation of apathy?

Re:Anyone NOT deleting their cookies?

[RingDev]

I do not delete cookies. I find them wonderfully helpful and think the paranoia surrounding them is completely assinine.

-Rick

Re:Anyone NOT deleting their cookies?

[Arpie]

I agree with you and the other poster.

Cookies are harmless, the paranoia surrounding them is mostly a media-induced frenzy, IMHO.

I'was actually surprised... I'd have expected more understading of the issue of the slashdot crowd, instead of "I allow only the cookies I want" or "I use this or that extension". Puh-lease. Worry about something more useful.

Cookies are small snippets of text used mainly so a website can have persistent sessions or settings. Period.

So what that doubleclick or someone else tracks which ads do you see? Why do you even care? How's
that invading your privacy? A cookie will not give anyone *personal* information about you that you have not willingly given up to start with.

Re:Anyone NOT deleting their cookies?

[Philzli]

Just ban every domain with doubleclick or xxx-tracker in its name.. :-)

Re:Anyone NOT deleting their cookies?

[bahwi]

I personally don't give a damn. Advertisers are out there to make money, it's not even a privacy issue. If you're a pornographer and you need camera Y and lens X to do it, what part of that statement do you think they care about?

Cookies don't do any harm, and there are other ways of keeping track of you. The internet isn't some dark alley way and a cookie is some freaky leash on you. The internet is a public place, if someone sees you go to store X and then to store Y big deal.

Everyone here is just paranoid and stupid.

"I want to profit off the information of where I visit."

Uh, ok. I'll buy those lists from you for a penny. Send me the following:
The list of all the sites you visited, for how long, which ads were on those pages and in what position, or did you have ad blocker on, was javascript enabled on that site, which links did you click to go where, duration of visit at each site.

Oh, you mean the advertisers do work to make all that stuff happen, and it's nothing you own or can even produce, just something you generate?

Cookies are stupid, I've always laughed at people who delete them, and reading the comments on here, I don't think I'll stop, but hey, each to their own. I'm still convincing friends that deleting cookies doesn't make your computer go faster.

Re:Anyone NOT deleting their cookies?

[capt.mellow]

yes, put me down as likewise apathetic abt it. however, if i'm on someone else's comp, i do clear everything out, because i'd really rather not let them go into my webmail/amazon/ebay accts. but on my own linux box at home, i leave it all on. i even use the 'remember form info/pw' stuff. it's lazy, but heck it's convenient.

Re:Anyone NOT deleting their cookies?

[HunterZ]

Is everyone here paranoid, or do I have any fellow compatriots in the nation of apathy?

You do, but they're all to apathetic to bother replying...

Re:Anyone NOT deleting their cookies?

[Bullfish]

The problem is not most of the "honest" companies trying to gather statistics, it's that you don't know who is collecting the data. The fact is anyone can attach a cookie benign or malicious to pretty much any site and you don't know who is doing it. Considering how much ID theft and the like has gone on, a little paranoia is not a bad idea

Re:Anyone NOT deleting their cookies?

[squoozer]

While I am not paranoid (IMHO) about cookies I do block obvious tracking cookies. To use your analogy of the Internet being a public space a tracking cookie is the equivalent of someone following you around taking notes about what you do. While you might not mind that I think the vast majority of people would which is why there are anti-stalking laws.

It's not really a privacy thing I just don't want to be followed everywhere I go.

Re:Anyone NOT deleting their cookies?

[maxwell demon]

The internet is a public place, if someone sees you go to store X and then to store Y big deal.

So you wouldn't mind if some advertiser sets a spy on you who records accurately where you are going every day, as long as he doesn't follow you when you leave public space?

Re:Anyone NOT deleting their cookies?

[fyoder]

Is everyone here paranoid, or do I have any fellow compatriots in the nation of apathy?

I rarely delete cookies. I decline/accept from the firefox dialogue that pops up, often selecting 'allow for session'. That's a very nice compromise value.

Re:Anyone NOT deleting their cookies?

[megarich]

As another poster posted out already, my problem is not so much privacy but they are making money off of me and I'm not seeing a dime of that! If my information is that valuable, pay me the money! I'll gladly give it to you for 1000's instead of a 3rd party doing it without my permission.

I mean am I the only one that this seems weird too? 3rd parties pay ALOT for that information but the user who the information is on gets squat. Instead they'll use other methods to trick us like "fill out for a chance to win this!" or "fill out this survey and you can get $1 off your next purchase". They'll pay anyone in the world for information about your habbits. Anyone that is but YOU and that's an f up system. One I don't want to be a part of.

Re:Anyone NOT deleting their cookies?

[Reapman]

(sacrasim mode on)omgwtf someone knows someone that knew something where they saw that i visisted a website. NOOOOOOOOOOOOoooooooooooooooooooooooo (sacrasim mode off)

Ya I don't care too much about cookies either. In all my years of "not carrying about cookies" so far I haven't caught a plague or been targeted by a sniper, so I'm pretty sure I'll survive still not carrying. I know I'm over simplying it, but in everything I worry about day to day, this isn't one of em. Nice to see I'm not the only "tinfoil hat free" person on /. ;-)

Re:Anyone NOT deleting their cookies?

[llevity]

As a previous poster pointed out, your information isn't worth thousands. It's probably not even worth a full penny.

People sell this information only after aggregating a whole pile of it from many, many different people that spans a lengthy period of time.

They probably compile it into a nicely formatted, stastical software useable format too.

So you're information isn't worth squat by itself. It's only bundled in with the other statistics that it is worthwhile.

On another note, those surveys and registrations you allude to are a little bit different. I personally fill them out as falsely as possible. Why? No, I'm not worried about my privacy. It's just the rebel in me wanting to throw a wrench (albeit a small one) into the system.

Besides, I bet the 90 year old single mothers from Estonia aren't getting a high enough representation in their aggregate statistics, so I'm helping.

Re:Anyone NOT deleting their cookies?

[Anonymous Coward]

Yes, 45.5% (plus/minus 2% margin of error) of the males in your age group do agree with you.

Re:Anyone NOT deleting their cookies?

[miscGeek]

Good, now all of the mind rays will be focused on you... Those things give me a headache :)

Re:Anyone NOT deleting their cookies?

[philipkd]

I don't delete my cookies because nothing is going to happen. There is no threat.

Re:Anyone NOT deleting their cookies?

[corvair2k1]

I agree. Cookies are a huge convenience, and the disadvantages are practically nil. When was the last time something terrible happened to you, and you said "If it weren't for those darn cookies, this wouldn't have happened." Besides, cookies aren't the only way you're being "tracked".

Why should someone be scared that they're being tracked? If you're going somewhere that the advertisers don't want you to know about, use an anonymizer.

Re:Anyone NOT deleting their cookies?

[SirSlud]

Illegal activity is illegal activity, but reputable cookie-setters tell you exactly what they store, and how they use it in their privacy policies.

Its a media frenzy, culture of fear thing, the paranioa people have about cookies. Its very difficult to collect anything *remotely* commercially useful about a person using cookies unless its flat out browser sniffing spyware.

If you're a banner network, the only way cookies are useful is to tell advertisers how well their campaign performed *after* the fact.

I wish people understood that, although what do I care. I'll try and set a cookie, and if I can't, your choice. The industry makes a big deal out of it because it makes it exponentially more difficult to report campaign performance to advertisers, and expotentially more difficult to only deliver an ad to you once instead of many times.

You know how people bitch about the same tv ad over and over and over again? Cookies prevent that from happening online. I take a pretty dim view of somebody who thinks they're protecting themselves or giving it to the man by blocking cookies.

All they're doing is making sure they see the same ads over again, and devaluing the CPM (not the value of internet marketing, just the cost of running ads. Internet marketing is not going a way, cookie or no cookie, it just makes it that much harder for your favorite freely available website to actually pay bandwidth costs.)

Re:Anyone NOT deleting their cookies?

[Anonymous Coward]

Well said. I ran AdSubtract for years and blocked adserver cookies. Then, in a great irony, I started working at interactive ad agencies and even DoubleClick. So, yes, maybe that makes me biased but from my vantage point, the whole freakout over cookies seems absolutely hysterical and absurd.

Here it is folks. The great expose from an analyst at an ad agency, former DCLKer, on the evil of cookies... Call it "Cookie Confidential".

SirSlud is right, the best thing about adserver cookies is frequency capping. The last thing both you (as a web user) and I (as a marketer) want to happen is for you to see the same ad a dozen times a day. It's a win-win if you let me place a cookie with this info.

The next best thing about adserver cookies is targeting. We need to communicate our clients' information to people who may be interested. I have two choices - I can blanket a huge swathe of the web via somewhat targeted advertising or I can just deliver the ad to those people who are most likely to be interested based on profile information associated with their cookie. With cookies, I can spend less and piss off fewer people and quite possibly make a lot of people happy. Again, sounds like a win-win.

The last big use of cookies by us marketers, is to figure out why you did what you did when you got to the website. Understanding usage patterns on a website and the ability to conduct A|B or multivariate tests is critical to making a website user-friendly, relevant and effective. If you are on the website, it is likely because you are trying to learn or do something. Cookies allow us to optimize websites. Win-win.

Re:Anyone NOT deleting their cookies?

[Anonymous Coward]

Amen to that... if you think having cookies is compromising your privacy, you're really not seeing the big picture. Direct marketers and database marketers have access to REAL information such as financial status, transaction history (e.g. buying a house or car), even health information (had a baby recently?) Spending time worrying about cookies is, IMHO, a big waste of time and energy.

Slashdot Stats

[KarMax]

It will be Good that some admin check how many of /. visitors/users accept cookies, as some form of "statics".

I have CookieCuller http://cookieculler.mozdev.org/index.html (a "modified version of the Cookie Manager built into the Firefox/Mozilla browser".
With that extension its easy to have some "protected" cookies, a list of "blocked" (sites who can not do nothing with cookies), and some other that will be cleaned at start. (and some other options).

Bye

Who even accepts these things?!

[Anonymous Coward]

I'm in with the crowd that selects every cookie they want with Mozilla. It's a wonderful feature that keeps me from having to delete cookies at all (at least until my friend uses my computer and starts clicking ACCEPT ACCEPT ACCEPT for no good reason). It makes the whole process easier, and it's easy enough to delete a whole batch if needed anyway.

The thing I would like to see though, is something to fix the problem of you needed one cookie from a web site to log in, but somewhere along the line banned it or others. Some sort of cookie sniffer that figures out what cookies are needed to log in, or at least allows you to "re-choose" which cookies to accept from a given site or not (without having to continually go and reconfigure options) woul be a goo next improvement for these browsers.

sort of

[baomike]

Long ago I adopted a habit of a "cookie file".
An edited/select group of cookies for some sites.
A simple shell script overwrites the inoperation cookie file.

Firefox question

[Stiletto]

I hope this doesn't get lost in the comments...

What ever happened to that very useful "Allow Cookies From This Site" menu item in Firefox? I leave cookies disabled by default, but when I get to a site that simply wont work without them, I liked having a quick way to go enable them for the site.

Now I have to go all through the preferences dialog, find the site in that long Allow/Block list and change it to Allow. Very annoying.

Is there a quick (two clicks max) way to turn on/off cookies for whatever is the current page?

Re:Firefox question

[Todd Knarr]

Take a look at the bottom-right corner. If a site's tried to set unallowed cookies, or tried to create a blocked pop-up, there'll be one or more icons down there. Clicking on the icons will bring up the appropriate dialogs to let you configure things.

Am I deleting cookies???

[jskline]

You bet your bippie!!! Yes indeed. I have a brain, and can remember most of my logins. The ones that I have trouble with, are noted in a secure application on my palm-pilot.

Sorry, but the numbers of nefarious web sites, advertisers, et al., have made me decide that cookies, and all that comes with them, are not worth the headaches.

That nifty new browser called Firefox, has a easily accessible feature in the tools menu to kill off all cookies, cache and other items with the swift stroke of just one button!!! It makes it so easy!! Plus the pop-up blocking abilities are just neat too. I've made it a point to expressly distain any site that uses large pop-over screens and adverts. An even bigger deterrent to sites are those that require "registration" just to view news and assorted items.

I started doing this regularly back when I was an Internet Explorer user and discovered that when I have to dump the cookies and such, I discovered that I wasn't killing off all of them. The machines would strangely keep all the old stuff. That's when I discovered Microsoft's trick of keeping several folders with copies of this stuff. After this, I thought that was really bad taste on Microsoft's part to be doing this. So now I'm a Firefox user!!

Firefox/Mozilla Rocks!!!

Firefox

[Alsee]

I have firefox set to delete cookies at the end of every session. The only exception permanent cookies I have are for Slashdot and Google. I'm sure many Firefox users autoclear cookies every session.

-

Cookies are overused and meaningless

[Junks Jerzey]

If a commerce or community site saves a cookie, then that's fine. There's a purpose for cookies on amazon and slashdot. But it seems that every little blog out there sets cookes, as do all little tech journals and so on. There's no reason for this.

cookies and spyware

[mverrilli]

More people are probably running spyware removal programs that also delete advertiser cookies. I guess that's what happens when advertiser get a little too aggressive.

Never

[tsa]

I never delete any cookies. I find it too much work and I'm not that concerned about my privacy.

toss cookies

[Anonymous Coward]

I prefer to toss my cookies not delete them.

Who started the cookies bad usage?

[ScroogeMcDuck]

There was a time I deleted every few days all the cookies on my system.
Now firefox does a nice job.

And anyway, who complains on the "cookies deleting users", should at first complain with the people who abused of them.

Re:Who started the cookies bad usage?

[psyon1]

Please explain to me how a cookie can be abused.

Re:Who started the cookies bad usage?

[ScroogeMcDuck]

Please explain to me how a cookie can be abused.

Their usage can.

Re:Who started the cookies bad usage?

[psyon1]

How so?

Re:Who started the cookies bad usage?

[ScroogeMcDuck]

Never heard of tracking cookies?

A new set of diapers please

[TheHawke]

It sounds like the marketers are whining becuase their new toys are broken.

Heh.

We were doing just fine before the advent of the cookie and malware. Now don't get me wrong, certain cookies are nice to have around to remember your preferences for newegg and slashdot. But we can do without the malware business, that's for sure.

We have one perfect marketing method that predates even the printed word: That's Word of Mouth. These days we got our forums, blogs and IM's to distribute news of how good or bad a product is or a how a company is performing. Peer advertising always bats a 1,000 when it comes to marketing.
Take a look at the legendary killer apps and you tell me how much marketing they actually spent on. WinAMP? Word Of Mouth via IRC. Winzip? WOM and out of need.

You push a product TOO hard and you are going to drive your prospectus away from you.

no. ad-blindness helps

[richlv]

no, i do not delete cookies. i don't much care about them (though i do not accept those with incorrect paths).
i just don't see ads - both on internet & tv. on internet this is somewhat easier with blockers, on a tv i have a reflex of turning down the sound when ads start and do something useful (like, er, make a tea).

if somebody can get out from my browsing habits what things i want - well, nice, in that case it shapes market in a way that i would prefer it.

i don't see the big deal with cookies & their deletion - just make good ads. there so few really good ads, it's disgusting how much crap people can create and handle.
i actually try to see ads that look interesting (and sometimes even several times. for example, some sprite ads ar great, even though i do not drink sprite) - but i miss most of them because i don't watch tv during ads...

and i can't remember when was the last time i saw an ad on the internet - i just concentrate on the content and don't see them. of course, lately subtle advertising is becoming more and more popular, for example, positive comments, positive articles and so on (and to keep the analogy with tv - movies showing people using different brand products).

if case somebody really dislikes ads (i do), probably capitalism should be ditched. there is no way advertising is going away, it is becoming only more and more visible and obtrusive.

No, I don't delete them - they never get created

[wowbagger]

No, I don't delete cookies - because they never get created in the first place. I have Moz+Multizilla set to ask me before creating a cookie, and unless *I* decide it is needed, the cookie is never created AND the site gets added to my "never accept cookies from this site" list.

So the sites that get hit the hardest by this are the sites that, by default, attempt to set a cookie whenever you visit the site. I take the attitude of "You shouldn't need a cookie for routine viewing, so buh-bye!".

Now, sites like /., or news.google.com, or any discussion forum into which I log in, or any e-commerce site - they get allowed to set cookies, because the cookie is of benefit to me .

Oh, and by the way: I use the same rule for Javascript and plug-ins - if the first thing some site insists upon doing is wanting to run Javascript or Flash I block it. JS and Flash are fine where appropriate, but as a routine item they are not needed.

I also don't allow third-party sites to set cookies - if I am visiting example.com, there is no reason that adserver.scumsuckers.com needs to set a cookie, run Javascript, load Flash, or anything else - serve up your ad image and be done with it.

And if some site rams an annoying animated GIF down my throat - they go on my image blacklist.

*AND*, if they annoy me enough, they go on my personal firewall/proxy blacklist and then they CANNOT bother me no matter WHAT they try to do.

It amazes me when I go to a friend's house and see the crap they put up with - my browsing experience is sooooo much nicer.

Advertisers: despite what you were taught in school, I am not a pair of eyeballs to view ads, a pair of ears to hear ads, a gullet to swallow crappy product, and an anus that craps cash for you. I am a person, and you abuse me at your peril.

Every Month

[RAMMS EIN]

I delete cookies as part of the monthly Windows reinstall.

Good cookies and bad cookies

[EXTmilky]

With deleting all cookies many people are doing themselves a big disfavour, because session IDs then mostly get embeded into URLs instead (= you loose the logging feature, while sites could still track you).

What's always left out in these discussions is the differentiation between good cookies and tracking cookies (especially long-lasting session ids). See also cookies(5). Lack of user education and bayesian cookie filters in browsers IMO.

/me crosses fingers

[tetrahedrassface]

"Death of Cookies, Spyware Greatly Exaggerated?"

I for one, kind folks pray it hasn't been.

D wah wah wah.. imagine users exercising thier rights.. wah wah wah.. :)

Knee-Jerk Reaction

[BlkPanther]

You guys all talk about cookies as if the only thing they are used for is making advertisers more money.... The fact is cookies have a real and valuable use. They can track useful information for other kinds of applications. And most cookies (at least the ones I create in my web apps) do not contain user information, instead they contain a GUID key to a database record that contains non-personal information about that users session on the website.... The kind of stuff that is useful for the user, like what category they were last at when they added a product to their shopping cart, or what affiliate they entered our website through and various other such items. These thing make our website easier to use and pose to "privacy" issue to our users.

Re:Knee-Jerk Reaction

[Russellkhan]

You should be yelling at advertisers for abusing your useful tool, not at users for protecting themselves from the abuse.

A simple way to do automated cleanup

[caudron]

All I did was write a simple script that cleans out my cookies and cache. I've set it to run daily on logout. Change $user to your username and $profile with your profile string and use it:

echo "drop firefox cache and history"
shred -u /home/$user/.mozilla/firefox/$profile/Cache/*
shred -u /home/$user/.mozilla/firefox/$profile/history.*

echo "grab all valid firefox cookies"
cat /home/$user/.mozilla/firefox/$profile/cookies.txt |grep slashdot >/home/$user/.mozilla/firefox/$profile/cookiesnew. txt
cat /home/$user/.mozilla/firefox/$profile/cookies.txt |grep mapquest >>/home/$user/.mozilla/firefox/$profile/cookiesnew .txt
cat /home/$user/.mozilla/firefox/$profile/cookies.txt |grep mywebgrocer >>/home/$user/.mozilla/firefox/$profile/cookiesnew .txt
cat /home/$user/.mozilla/firefox/$profile/cookies.txt |grep news.google >>/home/$user/.mozilla/firefox/$profile/cookiesnew .txt
cat /home/$user/.mozilla/firefox/$profile/cookies.txt |grep netflix >>/home/$user/.mozilla/firefox/$profile/cookiesnew .txt

echo "get rid of all cookies not explicitly kept above"
shred -u /home/$user/.mozilla/firefox/$profile/cookies.txt
mv /home/$user/.mozilla/firefox/$profile/cookiesnew.t xt /home/$user/.mozilla/firefox/$profile/cookies.txt

echo "done"

Just add a new line for each cookie that you want kept in the "grab all valid firefox cookies" section just as I did (noting the > vs >> piping).

I mean, it works for me, at least. Why do I shred instead of rm? Because I'm one of the lunatic fringe that likes the idea of actually deleting files that I tell to be deleted.

Coupled with Firefox's AdBlock add-on, I'm pretty comfortable with my browsing experience.

Re:A simple way to do automated cleanup

[maxwell demon]

The script can be improved:

#! /bin/bash
cd ~user/.mozilla/firefox/$profile/
 
echo "drop firefox cache and history"
shred -u Cache/* history.*
 
echo "grab all valid firefox cookies"
egrep '(slashdot|mapquest|mywebgrocer|news\.google|netfl ix)' <cookies.txt >cookiesnew.txt
 
echo "get rid of all cookies not explicitly kept above"
shred -u cookies.txt
mv cookiesnew.txt cookies.txt
 
echo "done"

Re:A simple way to do automated cleanup

[caudron]

Thanks for the feedback. I'll make the changes. It's much cleaner using egrep!

Re:A simple way to do automated cleanup

[jasenj1]

Only on Slashdot would this method be considered "simple".

- Jasen.

Re:A simple way to do automated cleanup

[maxwell demon]

I just noticed that there should be an error check after the cd command. You don't want to shred any files if the cd fails (e.g. because some newer Mozilla version uses a slightly different directory layout), and you are therefore most likely in a completely different directory.

The same probably also applies to the creation of cookiesnew.txt. If creation of that failed, you probably don't want to shred/replace the original cookies file.

You just..

[Marc2k]

You just can't publish and make a profit from information available regarding their CEO.

Re:You just..

[FLEB]

You could if you took the initiative to get some information about their CEO.

Re:You just..

[Anonymous Coward]

WHOOOOOOSH...

I do

[mce]

I have a cron script that scans my cookie file on a nightly basis. Anything that does not match my whitelist gets reported to me. If I don't like it (most of the time), it gets blacklisted and I never have to bother with it again. If I'm really sure that I want it, it gets whitelisted. If I'm not sure (yet), it simply gets deleted by default, but - for the time being - not listed.

Another thing that my script does, is edit cookies. Some sites of which I do want to retain cookies have ridiculous ideas about when they expire, so I automatically move the expiration date.

My Google cookie is auto-edited in another way. I want to keep it in order to force the language to English (stupid Google thinks it's neat to automatically redirect you to your local server and most of all your local language based on your IP address, but I strongly disagree). But I do not want them to track me in any way, so I randomly edit the ID info in the cookie. This makes the cookie invalid, so each time they give me a new one, but in the mean time I still get the language set properly.

Re:I do

[mce]

I forgot to mention that I have 2 blacklists. One is Mozilla's cookie manager/filter, set to not accept anything from the sites in question. The other one is my cron script that knows about certain cookies that it should auto-delete. The original idea behind that was to polute the cookie tracking database of the offending company: I wanted them to think that each time I visit their site they've run into somebody new, who "sadly" never returns.

Nowadays I rarely edit the second list, but still I do want to keep it around, because it uses powerful regular expression matching that Mozilla's filter doesn't support, AFAIK. This makes it easy to kill a lot of ad related cookies with just a few regular expressions.

I'm proud to say that I don't delete cookies.

[Glytch]

I simply don't accept them in the first place. (Except for Slashdot and a few others, of course.)

Death Of Cookies

[fledgear]

My Firefox browser is set to automatically delete ALL cookies when I shut it down.

firefox deletes all set cookies upon close

[Anonymous Coward]

i set firefox to surf via a proxy on my linux box.
the proxy (squid) is set to paranoia. so no
"via" header and no "user agent" headers, etc.
hotmail brakes as many other microsoft sites. many
sites using iis and something .net render nice
error messages. firefox accepts all cookies and
deletes them when i close firefox. also firefox is
set for zero cache on the local computer. squid
has 800 megs of hdd and about 80 gigs of ram to
use. caches everything up to 12 megs in file size.
i have learnd to not visit (or in other words:
support) sites that break with my paranoid squid
setting on. the web ist vast and if a resource
isn't available on .net "powered" site it is most
definetly available somewhere else.
the user forms the net, not the provider. it is
time you made your choice. if you don't buy it,
they can't sell it.

hold up

[ate50eggs]

no one has mentioned how completely unbeleivable the stat is. there's no way 39% of internet users are deleting cookies. I would say 20% know what cookies are - at most. I'm sure some people are blocking cookies because they set their ie security to "most secure."

Create a poll? How often do we delete them..

[Anonymous Coward]

So I'm confused. I'm a web programmer and pretty familiar with a variety of technologies, but I seem to be confused with why advertisers are concerned that users are deleting their cookies? I delete mine a few times a week. (Other people use my computer from time to time and I don't want certain stuff to be remembered) Surely advertisers can't expect that average users would let cookies live on for a month or more? That is a ridiculous assumption.

Not Deleting, just not saving

[Anonymous Coward]

I don't delete cookies! I just have Firefox set to not save them beyond the session. I guess that is deleting them at exit.

Poor, poor advertisers

[Blitzenn]

I feel so sorry for the advertisers, NOT! They can't track my buying habits and see what sites I frequent. Too f'ing bad! If they can't learn to keep stats on their end of the machine (server side), then perhaps they need better programmers and should start paying their own staff better. There is absolutely no need for an advertiser to keep information on MY machine unless they are trying to track me personally. That is over the limit, out of bounds, in my book. Cookies are great for login information and per session information containers as is noted in a number of comments here, but when advertisers abuse them by tracking my personal and cross session information, they create a problem. They made their own bed, now they have to deal with it. I find it hilarious that they are whining about not being able to try individual users and trying to spin it as a bad thing for users for them to lose this ability. They don't need personal/individual information. They can use their server side information just fine.

Re:Poor, poor advertisers

[Anonymous Coward]

So, I suppose you pay more at the grocery store so you don't have to accept their "loyalty program" card, don't use credit cards at all, don't rent movies and don't use any sites that require login.

What's that, you do? Well then you must not be aware of the fact that all these activities are tracked on an *individual* basis. You are also undoubtedly ignorant of the fact that these activities are associated with *personally identifiable information*, unlike anonymous website tracking.
</sarcasm>

Seriously, I am astonished that people are so concerned about marketers tracking their behavior so that they can deliver more relevant ads, and yet commonly use other technologies that are far more invasive without a second thought.

Re:Poor, poor advertisers

[Blitzenn]

Oh, I hear you loud and clear. I do chose to shop at stores that do not require me to become a member of some club to get there discount prices. It grates on my endlessly that stores do not see fit to give me their best prices simply because I would choose to shop there. If that is their policy, then I choose not to. I do not use credit cards, at all. and I do not have any store memberships, right down to sam's club and walmart. I do challenge this activity on all levels and am not hypocritical in my activities and practices. It is the apathy of the public that allows business to track our movements and purchases, it short giving away their freedom. For what? A discount that they should be given anyways for spending their hard earned cash with that vendor to begin with. I understand you are being sarcastic and merely pointing out what most people fail to see. I do however see it myself and choose not to particiapte. I have nothing to hide, but I am not going to freely give my personal information away. I think these practices on businesses part skew the very information they are trying to collect to begin with. HOw can you say that I prefer Brand x bread if I am forced to do my shopping at store A that only sells brand x at that store. It's not the case. If I shopped at store b then I might buy brand y instead. They skew their own efforts to understand their shoppers with their 'caging' of my ability to choose freely. So to what end? Only to gather my personel inforamion to no real benefit to them in the end. If more people understood what was really happening, I would hazard to guess more people would also opt out of the game as I have.

Delete them daily

[MobyDisk]

Cookies aren't evil. They are just misused, and misunderstood.

There's nothing wrong with using cookies to prevent me from having to logon to Slashdot 10 times a day. And there is nothing wrong with cookies telling Amazon.com that people who buy Movie X also like to buy Book Y. That is useful anonymous marketing information. I actually LIKE it when Amazon recommends things to me, because they are usually right!

The problem is when the cookie stays around for days and you never get a login prompt: that's a security problem. Or when marketers build long-term profiles on you, then try to grab identifying information from other sites you use.

I have Mozilla set to delete cookies every day, which seems to be the best balance. (Firefox unfortunately does not have this option).

Re:Delete them daily

[vertinox]

Or when marketers build long-term profiles on you, then try to grab identifying information from other sites you use.

Look... If a marketer wants to somehow make money off me making posts on /., reading webcomics and looking a pics of whiny cam girls on LJ all day, then more power to him. I just feel sorry for the poor sod who buys the data from him.

Re:Delete them daily

[greed]

I have Mozilla set to delete cookies every day, which seems to be the best balance. (Firefox unfortunately does not have this option).

Don't be too sure it doesn't; Firefox has almost every pref that Mozilla has.

What it often lacks is a user-interface for setting that preference. You can either frob user.js by hand, or use about:config. In this case, I believe you're after network.cookie.lifetime.days.

Re:Delete them daily

[Anonymous Coward]

Why do people think that it's just cookies that are tracking their purchasing habits? Every time you send a request to their servers they can track you from the back end. Deleting client side cookies isn't going to prevent them from tracking your habits.

Re:Delete them daily

[itsNothing]

You're logging onto slashdot 10 times a day? Whew! If i figure you're reading 5 minutes per time, that's about an hour a day. Good thing it's work related.

Re:Delete them daily

[Recovering Hater]

So here is the response you were looking for from the person who keeps an intelligent whitelist of sites with cookie permission. I also allow cookies on a one time use basis and deny third party cookies. Cookies are not the great satan of the internet.

Re:Delete them daily

[starfishsystems]

There's nothing wrong with using cookies to prevent me from having to logon to Slashdot 10 times a day.

Yes, single signon is nice. Though cookies are not exactly the most secure way to implement it.

And there is nothing wrong with cookies telling Amazon.com that people who buy Movie X also like to buy Book Y.

No, in this example, cookies are completely superfluous.

Amazon already had to manage your account information when you bought Movie X and Book Y. Its invoicing and shipping process depends on such data. So it's already correlated that you bought Movie X and Book Y. It would be a bizarre implementation indeed that ignored all that data and instead went off and parsed uncorrelated cookies instead!

from the to-lazy-to-delete-cookies dept?

[IainMH]

should be from the too-lazy-to-check-to/too dept ;-)

Anonymizer?

[dotpavan]

Can anyone suggest any free anonymizers available? And is it an effective mechanism to avoid cookies?

wrong department!

[Anonymous Coward]

should be from the "i'm-too-lazy-to-get-my-adverbs-right-dept"

Only 39%?

[hardcode57]

We need to mount an immediate education campaign to push that figure up towards 100%. It's a matter of basic hygene:when you've finished a task online, you kill the cookies. Not doing so is like not wiping your arse properly: the result is invariably uncomfortable.

Delete ?

[Cygnus78]

I save my all cookies for later reference. I love them. Sometimes I just browse through them for fun. My cookiesfolder is now 3,5GB and dates back to early 1994.

PS. I have a backup as well.

Firefox has poor cookie management

[oldmacdonald]

Out of the box ... Firefox has really poor cookie management. I have it set to prompt, but once I deny a site permission and realize I want to do business with them it takes many mouseclicks and a lot of stupid scrollbar searching to hunt down the cookieblock and delete it.

Yeah, what's up with this? Mozilla actually has a tools->cookies menu that lets you quickly block or unblock cookies from a site. Why doesn't firefox?

What a better way to reintroduce micropayments!

[Anonymous Coward]

Want to store a cookie on my machine? Pay me!

Buying food?

[RamboIII]

Do you remember when you got that card for your local grocery store? You know the one, it gives you a better price for almost everything, and on your reciept, it tells you how much money you seved. When you first applied for this thing, you had to (in most cases at least) include your social security number even. Don't think that they don't keep track of that. Hell, in this case, they're keeping track of your cookies, and how often you eat them!

This seems like more of an issue than cookies on your computer that can be deleted.

Opera's nice cookie option ...

[Anonymous Coward]

"Delete new cookies when exiting Opera"

It's perfect for me. Set all the cookies you want while I'm doing something, so I stay logged in and can do what I need to do. Close the browser, and they're all gone.

Eff. You. Dee.

[HelpfulPete]

Certainly there are abuses involving cookies, but the level of paranoid BS out there is deafening.

The average non-techie now believes that cookies are active programs which will peer into the deepest recesses of his life and possibly erase all his MP3s. The same people religiously wiping every cookie (and complaining about the NYTimes login hassle) are typically infected with a dozen types of REAL spyware and a virus or two.

In an age where an American citizen can't get on the friggin' Greyhound bus without providing zee papers and the government has lifted all our traditional privacy protections, worrying about having your banner-clicking habits tracked is more than a little silly.

As useful as Goto statements, and other thoughts

[WrongByDefinition]

"So cookies are a really good thing for managing the user's experience"

This is part I've always hated; that I have never been able to manage the experience myself. I do like some cookies very much (like the /. cookie) and hate other cookies just as much (stop following me, adverts!), and wish the mechanism could be rewritten to allow for more granular control over the type of cookie I allow. Sure, this is a nerd thing, and Joe Average would probably be more likely to just nuke everything that popped up, but at least they'd remain useful for the minority of people who know how to handle them.

In another vein: as they stand now, cookies are all but useless; I stand in wide-mouthed amazement whenever anybody tells me they use them for anything more than login storage or minor, non-mission critical stuff. If you can't count on them being there for even a minor part of the population (never mind upwards of 40%), they are as useful to web development as goto commands are to OOP programming.

I say dump cookies, and start working on something better so we can see '40% of users are reported as deleting their brownies on a regular basis!' and forget all about our cookie woes.

-----------

Take the database hit and be a man about it, damned it!
---Descartes

Seems to me..

[Idealius]

A good chunk of the people who delete their cookies do it because they don't want their employer to find out where they've been surfing.

(And yes, I know a lot of routers and net tools will log where the user surfs anyway, but IT depts. generally aren't the Gestapo.)

cookie swapping?

[oliverthered]

A while ago I heard about an interesting project to screw all those loyalty/tracking cards you get for shopping.
The idea is to swap cards with someone else every so often so that their data gets completely screwed up.

Could something similar be done with cookies to rm -rf the data recorded by the personal data collectors, bugmenot is about as closest thing I've found to cookie swapping.

Re:cookie swapping?

[Madcapjack]

Who needs to delete cookies? I just have a little program that overwrites the text with random text. Why? Well, spyware companies suck that's why. But you're not kicking them in the gut if you just delete the cookies. Nah, feed their databases with crap. That's what I say.

Re:cookie swapping?

[oliverthered]

That sounds like a interesting firefox adding project. It should be easy.

Re:cookie swapping?

[gnuorder]

I like the idea of cookie poisoning also. Instead of just putting in random text, put in data that would corrupt any valid data. If a project like that makes enough data worthless, the cookies will stop. The idea could be exported to spyware too.

What a splendid report that must be!

[Anonymous Coward]

If so, is cookie deletion a threat to the automotive industry?

.. Oh yes, I'm just dying to buy that report now, if only to see how they can possibly claim cookie deletion is a threat to car salesmen the world over...

Only for them.....

[Rolan]

It's only a problem for them. The rest of us don't have any problems with it, and really don't care that they see it as a problem.

Look beyond cookies

[joe2116]

Cookies are hardly the biggest problem. There are worse threats out there that Internet users should be worried about.

Re:Look beyond cookies

[maxwell demon]

From the linked page:
Yahoo Impulse tracks search behavior by using cookies
Note the last word I cited.

Re:Look beyond cookies

[joe2116]

Point taken. However, in addition to cookie deletion, the bigger problem is anti-spyware software identifying third party cookies as threats. Yahoo Impulse uses a first party cookie.

Why Cookies

[Anonymous Coward]

I dislike cookies. They are just too unsecured.

A good computer programmer can log the incoming IP address and the computer's name. You can keep track of all the actions they do on your site. By getting ride of cookies a company could sell this information to a collection house that call put it all together - base upon IP address. With IP address you know the location of the users and can do some good regional analysis. You could even dynamic adjust your site by the incoming region - so you do not need to worry if the individual has been to your site before - The people from the same region tend to like similar things philosophy.

As for the aspect of remembering passwords and such that could be held by nicely written option in the browser. The browser uses the URL (or the IP resolution of it) and can fetch the correct data from a locally stored secured file(s). Not allowing any other site to access any other files. Add in some hidden secure negotiations with the hosting site and the secure file on your local computer and presto you're done. Almost like a enchanced secure cookie.

It is one thing to have a site collect data about your actions on their site but it is another when the site tries to analysis other site's cookies. It is like going into Block Buster and them saying ... humm I see you downloaded lots of porn this month maybe you should not be renting Spy Kids in 3D you demented single bastard!

Nice idea, horrible implementation

[Anonymous Brave Guy]

As a matter of fact, that would be a nice option for the Firefox installer: a checkbox that says something like "[ ] Help me manage my privacy rights online."

By all means provide good options for customising cookie behaviour, and set reasonable defaults. But please don't do the above: that wording will add more confusion than it removes. What are "privacy rights"? How do you "manage" them, and why do you need to anyway? Why does being "online" make any difference? What "help" are you asking for here?

If you're going to add this to the installer, provide a one- or two-line plain English explanation of what an option actually does. This is possible without using either technobabble or meaningless drivel. Obsequious yet ultimately unhelpful UIs are one of the curses of today's software industry, and the sooner we get rid of them, the better.

Re:Nice idea, horrible implementation

[plover]

Oh, I absolutely agree with you on all the above points. This was simply a slashdot post of an idea, not a design for review (thus the 'something like' phrase above.) If we were to sit down and figure out what it actually should say, I imagine that would take rather longer.

That said, it's an incredibly tricky problem. When reduced to the "WWMI" problem (What Would Mom Install) it's apparent that you can't say things like "Helps protect privacy by preventing the browser from accepting cookies." Not only does my mom not know what a cookie is, she doesn't know what a browser is. She knows only that the blue "e" is the internet, or that now the red watermelon thing is the internet (in addition to poor cookie management, I think Firefox has horrible icons.)

I was serious when I mentioned an agent such as "Foxy" (stupid name.) Perhaps the checkbox should be labeled "[ ] Turn on 'Scorchy the Fox' to help me protect my online privacy." Maybe the icon on the toolbar could be a little henhouse, and Scorchy could come out belching feathers to offer suggestions about downloads, typing in names and passwords, accepting cookies, etc. While this probably ranks way up there among my more stupid ideas, the fact is many "normal" users absolutely love these cute agents. Clippy, Rocky the Dog, or whatever other Office Assistants come with Office these days, are really friendly ways to help uncomfortable people grasp difficult technical issues.

Re:Nice idea, horrible implementation

[utuk99]

And that is when I will find a new browser. The last thing I want is more anti-features like Clippy. I just set the browser to delete on exit and don't worry about it.

Re:Nice idea, horrible implementation

[pete6677]

That's what nice about Firefox: extensions. They wouldn't shove Clippy on everyone; instead those who wanted it could load the extension. User choice, what a concept. If only Microsoft could grasp it.

Re:Nice idea, horrible implementation

[Frank T. Lofaro Jr.]

All this talk of watermelons and cookies is getting my hungry.

Re:Nice idea, horrible implementation

[Anonymous Coward]

The people who would need the extension would never know to load it.

Re:Nice idea, horrible implementation

[plover]

those who wanted it could load the extension

But that attitude fails the WWMI test utterly: those who need it the most are the least capable of installing it on their own.

If it came in the installer, and if a checkbox was set by default to provide assistance (not necessarily privacy assistance, just assistance in general) then the Moms of the world could get their cute puppy dog helpers. Those of use who find such agents condescending would turn them off (no doubt b!tching to slashdot the whole time), and the author would provide a way to allow us to default it "off" in future installations.

Who is *NOT* deleting cookies?

[Anonymous Coward]

Library and college public access computer (kiosk/lab machines) usually have some method of reseting the state of the machine such as Centurion Guard and several of them do not provide for any roaming profiles.

Stopping cookies is a popular option in several HTTP proxy systems.

Stopping cookies is a popular option in several browser plugins.

Deleting cookies is common in several anti-spyware applications.

When it comes does to it, what organization or enterprise networks aren't deleting cookies for one reason or another?

The current standards of placing value on advertizing is flawed anyways. As long as the advantages outway the disadvantages of removing cookies then there is no point in keeping them. But I will provide a full browser history going back months to whoever is willing to knock 50% off purchasing any HDTV of my choice. Just show me the money.

Throw a wrench in their plans

[Avohir]

I use cookies, but I'm very nazi-ish about which ones I let stay. I block all 3rd party cookies, and I use a local http proxy to make sure none sneak through with underhanded iframe html and other things of that nature. Also, any time I see an annoying banner ad, i grab the url from the source of the page and add it to my hosts file block list (made easy with Hoster: http://www.majorgeeks.com/Hoster_d4626.html). Would that it were easier to manage these things, but unfortunately the internet isn't a perfect place.

For those that dont understand 3rd party vs 1st party cookies... the difference is this:

the way these tracking cookies work is when you're visiting site A, site A has a banner from site Z. If you have 3rd party cookies enabled, not only can site A set a cookie to your harddrive, so can site Z. Now, you go to site B which also uses site Z's ads... and site Z can see you were also at site A. Block 3rd party cookies however, and you cant get a cookie from site Z unless you actually VISIT site Z.

Disabling 3rd party cookies lets you keep their useful functions (login information at ebay, etc) and restrict the illegitimate ones (tracking my useage)

Re:Throw a wrench in their plans

[Retired Replicant]

I do the same, however, you should know that there are some adserving companies out there that have devised ways to incorporate cross-site tracking into the first-party cookies of the sites that their ads are served on. If a website has signed up for this type of ad service, its first-party cookies may be tracking you just like thrird party cookies can.

I am probably going to move to a system of blocking all cookies by default, and then anly allowing them on an as-needed basis for trusted stites.

Personal experience

[agent0range_]

After 3 years of tech support for one internet company or another I can say in my experience only 1 in 50 of my callers clear their cookies regularily. That's half as many people as there are in the 'cookies? what are cookies' group.

The rest of the world, it would seem, only clears their cookies out when asked to by tech support, and even then it's like pulling teeth.

Compromise...

[wtmcgee]

I think the best solution is the simple "only accept cookies from the sites you browse to" in most modern browsers. This keeps most spyware/adware cookies off your machine but still give you the convenience of using cookies.

I also go thru and manually delete some cookies from sites I don't visit on a weekly basis.

Me LIKE cookies!

[NetRAVEN5000]

Cookie Monster like cookies!
"C is for cookie, that's good enough for me!" :)
(Why do they call them "cookies" anyway?)

Seriously, though - I don't delete my cookies THAT much, and I don't get spyware since I'm using Linux, but I don't need those stupid cookies. KDE has something called KDE Wallet which automatically types in my passwords in an encrypted file (called a wallet), so the only one I need to know is the one to my KDE Wallet. It'll remember passwords for ANYTHING - Instant Messenger, e-mail, all my web sites. . . you name it.

What is Google Keeping From Us?

[Tidor]

They've uncovered a dark truth. In January 2039, we're all going to die! It's just like the Mayan calendar.

Users delete cookies because of porn

[Anonymous Coward]

That's it. Folks around here may go to great lengths to get rid of cookies and such. But most people who are deleting cookies are just deleting *everything*, history, cache and all after checking out some porn.

It isn't any more complex than that.

Not theft

[truthsearch]

Aside from the fact you don't own all of the information pertaining to you (the fact you drive a car of a certain color, for example), this isn't theft. How are they preventing you from profitting from it? They sell the information about you. Is there anything preventing you from selling the same information? No.

So go ahead, try to sell it.

Quack!

[Winkhorst]

Sorry to be a grammar pedant, but you left out a word. VOLUNTARY. Look it up. BEFORE you listen to Rush Limpballs.

Re:Quack!

[psyon1]

Are you saying people do not voluntarily give up their information to companies?

A company can not set a cookie with your name if they don't know it. Your browser does not just keep a permanent cookie with your name, that all sites can access.

If a company has your name to put it in a cookie, you gave it to them. You filled out a form, you hit submit, and you gave them your name.

GIMME COOKIE!!!

[ENOENT]

Me hungry! But cookies all dead!!

Mozilla

[Barny]

A great (and I admit, one of my favurite) features in mozilla is being able to "accept", "reject", "accept for session" and remember the above prefs for the current site.

I don't NEED to delete cookies, I only have cookies for the sites I want to store them (message boards, internet banking, etc). Sites that don't let me continue unless the cookie is set (some scum are doing this now) I usually just close the window and don't go there, if they are really nasty about how they word it, I tell mozilla to block images from them as well (so i can remember them in future).

We have the tools, use them. Once you have most of the sites you visit regularly set, you will barely notice your privacy being protected.

I am!

[asdfasdfasdfasdf]

I'm deleting the hell out of my cookies.

Of course, I'm on a static IP, and I'm a gmail user, so I suppose it probably doesn't account for much.

Screwed priority

[Ninjy]

I remove cookies from my systems whenever the hell I feel like it, thank you very much.

Pr0n sites and scrubbers...

[mengel]

Several points which lead to a simple conclusion:

• The businesses making the most money on the net and getting the most hits are pr0n sites.
• Many people are embarrased to have gone to pr0n sites.
• Lots of people get history scrubbers to destroy the evidence of their surfing.

So I suspect the majority of that 39% is people cleaning up after their pr0n surfing...

Re:Purge the evil (IE)

[HomerJayS]

I have a plug-in for the 'evil' IE browser that allows me to delete all cookies on browser exit. Plus is allows me to "white list" some cookies that aren't purged.

I get the benefits of purging the evildoers and still retaining my laziness by not having to login to sites such as Slashdot every visit.

Re:Firefox and Google

[jahknow]

See, I do the same with Firefox... but DON'T allow Google to keep their cookie. Using Gmail means I have an account with them, and having an account allowed me to see that google is compiling a "search history" on me. They can still build a history based on my static IP address but I don't want to make it too easy. Maybe that's why their cookie expires in 2038!

That said, slashdot.org can leave me all the cookies they want. Mmmm, cookies.

Slashdot cookies

[mysticgoat]

Using Firefox, I just deleted all cookies, turned on the cookie tracker, and came back to Slashdot.

Slashdot has set a total of 10 cookies: 8 as it was loading and 2 more when I logged in. The breakdown by length of life is interesting:

• 31 days: 3 cookies expire in 31 days
• 30 days: 1
• 1 day: 2
• midnight today: 1
• end of session: 3

2 of these have no significant content and seem to be used just to determine whether I am allowing cookies in this session; 1 is my log-in ID for the session and another is a repeat of this (maybe there are 9 cookies and this one is being listed twice?). The other 6 appear to be related to advertising.

It is certainly possible that some of these are providing advertisers with demographic data (my ISP is listed in the body of one cookie-- why else would that be there?). But I guess I need to trust that Slashdot and its advertisers will do nothing malicious with this info. Sort of the same way that I trust my hardware store won't sell me substandard counterfeit bolts.

$750!...

[imdx80]

..and you can't specify who you have the conversation with...

FU is for cookies....

[adnausium]

The problem is that the average user doesnt understand what cookies are, how they can be missused, when they are appropriate and how to manage cookies themselves. And there is many a business thats is/wants to take advantage of this fact. Perhaps in the next iteration of (enter your fav browser here) it should start with a popup box explaining the ins and outs of cookies for the layperson to understand. and of course most /.'ers could just skip it.

Blame Zone Alarm and AdAware

[miller60]

A lot of the deletions of ad-tracking cookies are tied to growing use of anti-spyware programs like AdAware, which typically flag a lot of adware cookies as potential problems. Most folks follow the "when in doubt, delete" philosophy with cookies found by AdAware and similar programs. I'd wager very few people will try to sort out their merit on a cookie-by-cookie basis.

The new version 6.0 of the Zone Alarm Pro firewall also includes an anti-spyware capacity, which runs automatic scans at set intervals. The default setting is to automatically delete tracking cookies. That's bound to mean more cookie deletions, as Zone Alarm is widely used.

Of course people are deleting cookies!

[Anonymous Coward]

Who wants to get caught by their spouse as having a bunch of cookies from p0rn sites?! I guess the rest aren't covering their tracks good enough.

web bugs

[Anonymous Coward]

Cookies aren't the only thing that advertisers use to keep track of you. Don't forget about web bugs - basically, any static image (often only 1 pixel in size, but it can be any size) can be used to keep track of you. Since your browser caches images, web servers can assign a unique modification date for each visitor. When your browser visits a site it has already visited, it will ask for the web bug image, and in the request, your browser will say "give me this image if its modification date is later than [a unique specified time]." That's when the server says, "Welcome back, Fred." The trick to foiling this? Don't use a cache. You really don't need one if you have broadband.

"Internet Marketing Expert"...

[Heretik]

... Spammer

Tomato, Tomahto...

Delete 'em? Nope, I poison 'em!

[OpenGLFan]

About once a week or two I'll get a few idle minutes, playing with my laptop while making dinner, and I'll just start opening up cookies and changing the data in there. Not to try to impersonate someone else, but just as every person's duty to scribble nonsense on some moron's database.

It's fun. It probably doesn't do anything, but it kills a minute or two of time, and it's more fun than "bejewled".

Sites I won't visit

[Anonymous Coward]

There are several times a week when I run into a site that requires cookies and/or registration. When I get error messages about these things, I do not proceed, thereby silencing those voices. There is NO need for news or other sites to do this kind of thing. I thought most intelligent sites tracked by IP address anyway...

What is a cookie?

[Anonymous Coward]

My computer doesn't understand them ;-)

You ARE getting paid

[Danger Stevens]

Absolutely right.

Moreover, when you visit a site and someone makes a cent or two off of information about you you're almost always being reimbursed for it.

Almost all of the non-subscription entertainment sites make money off ads. Online retailers can offer lower prices because the info they gather from customers makes them a company with better profit margins.

Maybe they're not handing you a check, but it's not like you're in a sweatshop or anything - nothing you mentioned sounds like telltale signs of an extractive economy.

Only insofar . . .

[Amiasian]

. . . as one's actions do not affect another individual can said privacy be allowed.
I don't trust secrecy (collective privacy) in most instances.

I rarely delete cookies

[Dracos]

Mostly because I don't allow a cookie to be set if I suspect the host is an ad server or whatnot, and only allow it to survive as a session cookie otherwise. Sites I frequent get to set necessary cookies normally.

Something the stats gloss over

[Todd Knarr]

One thing the "cookies aren't usually deleted" crowd tends to gloss over is the ability of browsers to force cookies to be session-only, or to delete cookies when the browser closes. People set up for this appear to all the stats engines as accepting cookies, but cookies set on them don't persist the way the stats engines expect them to. I think they gloss this over because it's all but impossible for a stats engine to detect this situation and count it.

The best estimates I can come up with are that something like 5-6% of all users have their browsers set to force even cookies from the site's domain to session-only (or discard them upon browser close), and something like an additional 16-17% either block third-party cookies completely or discard them at the end of a browsing session. And those percentages have been trending upwards over time.

I don't delete

[Gyga]

I just don't accept cookies from any site that I don't log into, you should see the list of sites I have on the blacklist.

People allow cookies in the first place?

[Anonymous Coward]

I'm surprised that so many posters here actually allow the cookies on their machine in the first place. Set Firefox to always ask, and after a week or two, all of the sites you normally visit will be in one of the allow/deny/allow+purge sections. After that, it's only occasionally that a cookie prompt comes up, and it's easy to just hit deny.

Firefox autodelete

[Tired_Blood]

In FireFox version 1.0.2 (what's currently in front of me):

Tools > Options > Privacy > Cookies > "Keep Cookies:" > "Until I close FireFox"

All of those steps are available through mouse clicks. It's not obscure and you don't need to edit a strange variable within a configuration file.

Of course, you'd need to close the browser every so often for this to be helpful.

Not often.

[supabeast!]

I don't usually bother deleting cookies - my massive adblock list tends to keep them from ending up on my machine in the first place. That said, I do end up going through and cleaning them out once or twice a year.

For 3 years

[BCW2]

When I used Netscape I deleted all cookies, then went to about 6 sites I had to login to (/. included), closed the browser. I went to the tree and saved the cookie file as cookies2. Now when I am through with my browser I delete the entire cookie file and save cookies2 as cookies. It was easy to copy the file into Firefox when I changed to it last year.

I have added a few sites to my file over the years, but I will decide what gets saved on my machine, not Gates or any other Markettwit.

No cookies here

[1251]

I too delete cookies after every browsing session, and even set IE and Firefox to delete automatically. No company has a right to know know what I view or what I do. It's the electronic equivalent of chaining a company representative to every man, woman and child on the planet, who is taking notes on what everybody does during the course of the day. It's an invasion of privacy.

Force user selection of cookie policy

[mpcooke3]

The fundamental problem in my view is that people are installing (or have pre-installed) software (web browsers) that allows companies to track their every move without fully explaining to users that this is going to happen.

I think it's outrageous that IE and Firefox don't ask users explicitly the first time a company tries to set a cookie if they want companies to be able to track them. I don't think if users were forced to choose and understand cookie policys they would allow ANY 3rd party cookie tracking (regardless of P3P policys) and yet by default firefox and IE allow all 3rd party (P3P) cookie tracking on their default medium setting without asking the user!

As soon as the default setting allows 3rd parties to track one 3rd party advertiser sells data to marketeers, then ALL 3rd party ad servers have to do the same to compete.

If another program leaked as much information to companies without your knowledge as IE and Firefox on the default cookie setting the software would be deemed spyware (or worse as it leaks information to thousands of companies!).

The idea that laws should be introduced to force websites to say they are spying using cookieing is a stupid legal solution to the technical problem that users are installing and using software that leaks their data in way that the average user would consider a privacy violation - BY DEFAULT!

I would suggest that the web browser should pop up a one time warning dialog the first time it sees a 3rd party trying to set a cookie. Something like this: "a 3rd party company not 'slashdot.org' is trying to record information on your computer, do you want to allow any 3rd parties to record data about your internet usage?"

Most people would say NO, this would change the cookie acceptance policy on the users browser so that no 3rd party tracking would ever work.

Cookie wiping by anti-spyware companies is just another kludge work around for not forcing users to choose a cookie security policy they are comfortable with.

Throw, not delete

[slasho81]

Users don't delete the cookies. They just throw away the computer when the spyware reaches critical mass.

Well yes and no

[PalmKiller]

I have firefox set to delete cookies on exit, so I guess a little fox is doing it for me

It's all about anti-spyware...

[WoTG]

IIRC, the original 39% guys are marketers, they're worried about the marketing cookies that are used by advertising networks. These cookies are routinely deleted by SpyBot and other anti-spyware applications.

If you think about how many people have to run an anti-spyware app at least once a year, then the 39% seems quite reasonable. But this has nothing to do with the cookies that remember my login ID to Slashdot or Yahoo.

ABSOLUTELY!!!

[Anonymous Coward]

Especially in Windows (in linux less often) because in windows massive amounts of temp internet files and cookies along with the sloppy install temp files from third party developers often lead to functional problems...as a result I delete all temp files (including cookies though they are arguably not temp files) as part of routine maintenance. In Linux/Firefox I do it as well just not as often.

Delete cookies?

[Dark_Lord_Prime]

No, but I maliciously rearrange their data to give the tracking system(s) an aneurism...

*evil laughter*

White list

[StormReaver]

I white list my cookies with Konqueror. Any site not on the list doesn't get to set cookies. If I go to a site I like or need, and cookies make the site more friendly (auto login and stored preferences), the site goes on the white list.

I have 14 cookies on the system I've been using for the last couple years. This works well since I don't usually surf or browse the web. I use the web because I want something specific. The only exception is a search result from Google when I'm looking for something specific. Then I'll visit sites I've never seen before. They don't get to set cookies either unless I'm sure I'll be returning frequently.

Re:Tough luck for content providers

[RingDev]

The problem with that is that if marketers are not making sales, they will stop advertising in those channels, which means content providers will lose their add revenue, which means they will turn to pay -per-content or close.

So go ahead and block all adds, you will know where to look when your favorite content provider loses their income ;)

-Rick

Ever See a Cookie Recite Shakespeare?

[fragmentate]

Cookies are benign. No one can track YOUR every move on the net -- at least not YOU specifically. Rather, they are tracking that browser. There's this massive misconception that cookies expose your life and habits for all the Web to read at their leisure. The reality is quite different.

If you go to a web site and they set cookies, only that site can actually read those cookies. If you don't want to be tracked by anyone other than the site you're visiting, simply turn off "third party cookies" (in IE5+). In Mozilla/Firefox simply enable cookies only for the originating site. You'd do better to manually accept all cookies, rather than automatically denying them all.

Cookies are not little pieces of malicious code that can run arbitrarily.

I work in the search industry, and cookies are a good healthy thing as they are used by the majority of sites. They allow airlines, retail stores, hotels, and any other vendor decide how and when to run sales. By tracking [anonymous] people's habits they can better target their pricing. Lots of people looking for PC3200 DDR RAM? Yep, tracking says lots of people are!

This is good for all of us.

Firefox autodelete In Linux

[ElleyKitten]

Firefox in Linux is slightly different:

Edit > Preferences > Privacy > Cookies > "Keep Cookies:" > "Until I close FireFox"

Except for a few trusted sites

[WillAffleckUW]

I nuke cookies with extreme prejudice, especially ones for "partners".

It's nobody's business. If I wanted to live in Soviet Amerika, I'd have voted for the failure.

Sounds resonab..wait what?

[zippthorne]

"I want the monetary value of my opinion."

Yet you post it to slashdot for all to see for free. Possibly you've even paid for the privilege. /. makes money from all the suckers who paid to read your post as well as the ads on the page whose impressions are generated by.. people reading your post.

Re:Sounds resonab..wait what?

[bobbyjack]

There are *ads* on this page?

Delete all cookies due to malware

[wired_parrot]

I used to allow all cookies. I wasn't worried about privacy issues and I found them convenient in many sites. And I let anti-spyware programs sort out the "bad" cookies.

Until a year ago, when I noticed a mysterious slowdown and occasional tendency to crash in my system. Ran adaware and spybot and got nothing. Ran a host of anti-virus tools and got nothing. After working with a slow computer for a week I decided to clear all my cookies. Guess what? Problem went away.

Having learned my lesson that even a combination of multiple anti-spyware tools won't catch all the invasive cookies in my system, I now set firefox to delete all cookies upon exiting my session all the time. And since firefox has auto form-completion, the convenience factor is not lost. Anti-spyware won't catch everything - in some cases because threat of lawsuits from spyware firms have forced anti-spyware makers to delist certain malware. So the only way I can feel safe is by deleting all cookies.

Close browser = cookie flush

[davidwr]

I have no reason to keep cookies around longer than the current session.

Neither do the web sites I do business with.

The argument for cookies

[takeya]

I'm not paranoid. I don't delete my cookies... Opera keeps them for as long as they're set for. Opera also has powerful cookie management/filters.I like to just "stay logged in" to my favorite services. It's a lot easier than retyping a password, that I'd probably have to look up, every time I wanted to log in to a site. I don't do online banking, I'm not going to get my identity stolen and I don't have any spyware.

I refuse cookies from ad servers, and accept them from login servers (slashdot, forums, etc. -- not yahoo because they don't keep me logged in anyway).

Deleting cookies doesn't affect my performance or the stability of the application, so I only see how good they can be.

Oh Please

[Anonymous Coward]

Your life is not that interesting that any of these companies give a shit about you personally. They're more interested in AGGREGATE data. Nobody really cares about how many pr0n sites you visit, just the number of total visits. Your personal net usage habits are WORTHLESS as an individual.

Ironically, your rant on tracking must not apply to Slashdot, mr. "It doesn't come easy (695416)".

Conspiracy theorists always dream up wild conspiracies that would never apply to their own lame, mundane lives.

Anybody remember the old Netscape trick?

[Anonymous Coward]

Does anybody else remember the trick with the old Netscape browsers of making your cookies.txt file read only?

I certainly don't like the idea of some faceless marketing droid tracking my online activity but I also don't care enough to spend a large amount of time worrying about it either.

Personally, I make it a habit to delete all of the cookies the same time I remember to go in and clean up my temp folders which is about once a week or so. Otherwise, I just don't care.

Nobody else has access to my computer so my pr0n history is safe and I do find it useful to go right back into my session for the sites I monitor frequently.

Security and fraud prevention is like defensive driving on the highway; you need to maintain your awareness of what's going on and the potential dangers but you also can't get so paranoid that it keeps you from getting in the car. I don't know about everybody else here but it should be common sense by now to know that you don't use your SSN to access your bank account from a public terminal over an unsecured wi-fi network? - duh!

I'll keep my cookies

[tgibbs]

I allow cookies from the sites I navigate to. The convenience outweighs privacy issues as far as I'm concerned. I like having sites show me ads for stuff that I might actually be interested in.

Re:I'll keep my cookies

[Carrot007]

Me to, I'd veen tell the advertisers what I want from them if it'd help.

Unfortunatly there seems to be no market for giving me money for nothing.

Re:I'll keep my cookies

[C_Kode]

Me to, I'd veen tell the advertisers what I want from them if it'd help.

The Opera browser allows this. (At least in the in-browser Opera ads)

Website Relationship Management

[cohomology]

What bugs me about cookies is the disparity between what I can do, and what websites can do. I would feel better if the relationship were more equal.

Companies have "Customer Relationship Management Systems" and "Approved Vendor" lists. As more of my life moves online, I feel the need for a "Website Relationship Management System." There are a small number of websites that I *want* to have a continuing relationship with, and for those I want tracking and reporting exceeding what I now get.

If a site used to use SSL, but no longer does, I want an alert.

If a site used to have a privacy policy at a specific URL, but it's moved or changed, I need to know.

If a site uses 10 cookies, but only one benefits me, I want to permit just the one useful cookie.

If a new tracking system gains popularity, I want to understand it so I can make a rational decision about whether to cooperate with it.

Computers should be the Great Equalizer, but we (programmers) don't have our act together yet -- any ideas about how this can be changed?

Re:Website Relationship Management

[slappyjack]

Computers should be the Great Equalizer, but we (programmers) don't have our act together yet -- any ideas about how this can be changed?

Yeah, get the morketers and otehr suits out of the programming process and let the programmers build the compatale software they've been wanting to.

I realize one of you tools will come back with some silly "thats not how the world works" reply, so here's my answer to that - Fuck the status quo. Custom isnt always good.

You don't need cookies to track users

[matt me]

You can track users pretty well by IP address and other methods. If you use Amazon with cookies disabled, it still shows your recently visited items after you wipe all your cookies. In fact, if you don't want Amazon to show your recently visited items to someone else using your computer, you have to go to their preferences and check a box. This of course, sets a cookie. QED

Re:You don't need cookies to track users

[Anonymous Coward]

Trying to track users by IP doesn't work with the big proxy farms like AOL or any Fortune500 company - where a ton of users come from the same IP Address - or even at my house where my wife and I have the same public IP of our Linksys router.

This problem is commonly used with load balancers and why companies like F5 applied for patents on using cookies to make persistent load balancing decisions instead of IP address. (persistent = send users to the same server on every request behind your load balancer.)

Re:Tough luck for advertisers

[shadowspar]

If every website that buried their stuff under obnoxious ads fell off of the 'net tomorrow, I would cheer.

It seems a common misconception that only sites rife with ads serve up any worthwhile content. In fact, I often find that the obnoxiousness of a site's advertising is inversely proportional to the value of its content.

In a seeming parallel to open source programming, many people and institutions will happily put content up on the web because they want or need to, not because some ad agency is paying them to do so. There was content on the web before advertising, and there'll be content on the web without it.

If it helps...

[Some_Llama]

If it helps to frustrate advertisers and marketing minions, then i'm all for it (and do). They spend enough of my day (everyday) frustrating me with the constant onslaught of Ads and marketing tactics to get me to be the ultimate consumer, I feel it is the least I can do to show them my gratitude.

Only pr0n cookies

[De_Boswachter]

[...] who is deleting cookies? Are you?
Only pr0n cookies. I need the /. cookies because I keep forgetting my pw all the time.

Or at least...

[sheldon]

"By then, we will have moved that counter to a 64-bit number."

We will all have moved to Australian outback... or updated our Resumes as Y2k39 consultants.

YEs I do

[Anonymous Coward]

I set mine to be session cookies all the time so when I start the browser is like I just installed it. I don't have any problems browsing this way.

No!

[Mars Ultor]

However, through the cookies scheme, I'm the only one not getting paid.

Wrong. Wrong. Very wrong. I know that some here have the mentality that information should be free. Unfortunately the electric companies, the hardware companies, and the bandwith companies can't give away their resources.

So if you like a site enough to visit it and use their information, then consider that your renumeration for the collection of your browsing habits. After all, you're using their service, and they're using you to make money to pay the bills and turn a profit.

The only objection I have is if a site's privacy policy doesn't explicitly state that cookies are in use on a site and/or what information is collected.

Re:Tough luck for advertisers

[RingDev]

But then you are depending on those with money to share content. I worked with a site for a video game mod last year. Great site, no adds, wonderful content (and mod files sizes in the magnitude of Megs). Worked off of donations, a few bucks here, a few bucks there would cover the bandwidth needs. After a while, the site's popularity grew, some links from other very popular sites to this site drove the bandwidth and server load through the roof. The site admin bumped the server to a tougher server, which could handle it, and eventually the guy running the site had to pay for a much higher end hosting solution and bandwidth. That shot his relatively low bandwidth bill to way beyond that of what a part time pet project could justify. He started enforcing free registration, and added google adds, which helped, but the cost of thousands apon thousands of users downloading multiple files from 1 meg to 50 megs was extremely costly, even with 3 mirrors. He added more advertising to help cover the cost. And the site is still up today.

Acording to your point of view, he should not have taken any advertising, because it would push people away from his site, but had he not taken any advertisment, his site would be perpetually unreachable until no one visted it due to it's instability.

Advertising, whether you like it or not, is what allows people with limited budgets to maintain high bandwidth publications.

-Rick

TRUE

[Anonymous Coward]

I'm too apathetic to say anything about it.

Sites that store login info in cookies

[Retired Replicant]

I would delete more of my cookies more regularly, but sites that store login info in the cookie (like Slashdot) make it difficult to just delete all cookies at once.

I have third-party cookies blocked by default in Firefox, and I usually go through my cookies once every few months to add the ones that I don't recognize to my "always block" cookies list. Generally, if I don't recognize the site name (especially if it is something like "www.intrusivemarketinganalprobe.com") it gets put in the "always block" list. Also, when I run Ad-Aware, I let it quarantine any cookies it marks as potential marketing/ad/spy tracker-cookies.

Re:Sites that store login info in cookies

[Russellkhan]

Sounds like my old plan. What allowed me to improve on this was discovering Cookie button, a Firefox extension. Now I leave the default setting as reject all cookies and click the little button to allow those sites that need it (I think I have about 12 allowed, but I'm probably more conservative than most would be).

Along similar lines, NoScript does the same thing for javascript and most here probably already know about AdBlock and Filterset G (the best pre-made set of adblock filters I know of).

The bigger they are......

[King_TJ]

...the more false-alarms they create.

Well, maybe not in *all* cases, but it sure seems to be a decent "rule of thumb". Norton and McAfee are probably the top 2 most popular vendors marketing "Internet Security" type packages - and both seem to flag the most false alarms, disrupt normal, smooth system operation, and "bloat" things FAR more than necessary.

Time and time again, when I'm trying to clean viruses or spyware off machines, I get the best results using relatively obscure, typically foreign-developed software products. And "personal firewall" software for Windows seems like much more of a "scam" or "solution in need of problems" than anything sensible or truly useful.

EG. Say you install "ZoneAlarm" on your Windows XP box because people promise you it's "much more secure and flexible than Windows' built in firewall!". Ok... Well, now you've got this product that's constantly harassing you EVERY TIME some new application or DLL tries to access the net for the first time. Typically, it tells you it has "no information to offer" on what that program really does, so it's up to you, the end-user, to determine if it's "safe" or not. Why would I ever assume that the typical Windows user knows better than applications themselves about which DLL files are "safe" vs. "threats"? But yet, that's pretty much the design model.

And furthermore, much of the supposedly "security" of these firewall products lies in the fact that they can "permanently block" malware from communicating out to the net. But that's *AFTER THE FACT* that the stuff got onto your machine! Who knows what other problems said malware is causing your computer in the meantime... but the user gets a false sense of security because ZoneAlarm "blocked" the stuff. That's like me saying "Hey, I have this cool security system in my house. Anyone can walk right in because I don't have locks on my doors, but once you set off the alarm, the criminal is rendered unable to communicate outside my house to his buddies ... so more burglars aren't alerted that it's safe to come in!"

Re:The bigger they are......

[maxpublic]

but the user gets a false sense of security because ZoneAlarm "blocked" the stuff.

No firewall is of any real value if you *let* malware through your security and allow it to install on your computer, e.g., by using IE. Relying on ZoneAlarm alone (or any firewall alone) is just plain silly; you need to go a few extra steps, such as chucking IE and installing Ad-Aware/Spybot to catch the crap that you, the user, accidentally let onto your system.

Blasting ZoneAlarm because it doesn't do everything and isn't idiot-proof is silly.

Max

Firefox Cookie Settings

[sapgau]

What I have setup:

Tools -> Options -> Cookies:
        - Keep Cookies: ask me every time

And when Firefox shows the dialog to ask me:
        - I set the checkbox "Use my choice for all cookies from this site"
        - Then I click Deny (or Accept).

So, once you deny (or accept) cookies from a specific site, it will remember your selection.

That way I don't need to delete all my cookies and then having problems logging again to Slashdot because Firefox can no longer logged me in automatically.

My $0.02

This is what I do.

[persona 419]

This is what I do.

use Firefox

under Edit:Preferences:Privacy, select the twisty for cookies and check "allow sites to set cookies" and "for the original site only"

Install extention "CookieCuller" and "Add 'n Edit cookies"

go to google.com and set your prefrences

using "add n edit" zero out the google cookie; change the first 16 hex digits to 0

use "cookieculler" protect this cookie, and any other cookies that you find useful

set "cookieculler" to delete unprotected cookies on startup (you must do it this way, don't upchuck cookies on shutdown)

use extention Flashblock to stop those annoying flash logos and help prevent "flash cookies"

use adblock and a good filterset (google for it)

(this last step is not really necceary, but it assures me that if google ever targets ads to me because I'm tech savvy and I've zeroed out my google cookie, at the very least, I'll never see them!)

Re:This is what I do.

[persona 419]

why zero out the google cookie? http://www.imilly.com/google-cookie.htm

Effective Cookie & Webbug filtering

[xQuarkDS9x]

All I can say is use Proxomitron for Windows and Grypen's Proxomitron Filters for effecitve cookie filtering along with a whole whack of other filters for ad's and anything else malicious.

d33z cookies...

[v3xt0r]

advertise d33z!

Woah

[Anonymous Coward]

It isn't something you freely gave. The article is all about deleting cookies, blocking cookies, etc. If you're doing that, it isn't being freely given.

Then the marketeers come out and tell us we should let them.

The OP is just saying "pay me if you want it". Not saying "I freely gave you this, so please pay me retrospectively".

automation...

[perlchild]

I'm wondering just how many of the "cookies" turned off people are of the enlightened variety, and how many are using security programs(think antispyware) who actively disable known ad-based cookies, and similar usage-tracking methods(like webbugs).

Wouldn't that explain the change, and the worry of the ad companies, without having to explain why the masses we know and loved changed their hats on "it's too hard, do it for me" issues like security, privacy and efficiency.

Who's modding here today?

[Russellkhan]

Someone from DoubleClick? Gator?

There's no flamebait in the parent post. It's a perfectly reasonably statement of a perfectly reasonable viewpoint. I'd mod it back up myself, but I've already posted to this article.

Cookies...mmmm...yummm

[RagingChipmunk]

When I get bored on slow afternoons, I'll go thru my cookies and delete anything unexpected. Then I'll flip the read-only flag on some, and when I'm feeling malicous, I'll alter the cookie contents - change some bytes, add some garbage...

Sometimes its fun to watch sites puke from corrupted cookies.

No, no ...

[Kozz]

it's "a penny for your thoughts". See, better profit margin.

Re:No, no ...

[Anonymous Coward]

No, it's a penny when someone else wants your thoughts.

When you throw your "two cents" in, the other person hasn't even asked for your thoughts, so you have to pay them to take them.

Even my wife deletes cookies

[Anonymous Coward]

My non-techie wife deletes the cookies on her machine about once a week. Somebody in her Mom's club told her to start doing it. Believe me - now that the Oprah crowd has started deleting cookies the value of internet marketing databases is pretty much zero.

Re:No, but... That's the beauty of IE.

[Anonymous Coward]

Use the Security Zones to refuse cookies in the Internet Zone and allow Cookies in the Trusted Zone for sites like those you mention.
I have eight cookies on my hard drive and can surf forever and the next time I look I'll only have eight cookies.

internet advertisting

[Anonymous Coward]

Quite a few posts deal with advertisements and the aggregation of our behavioral information that happens unbeknownst to us - in that regard, cookies perform one necessary function - they connect your browser to the data your behavior generates.

Just to clarify, many websites generate revenue by showing ads to you while you navigate their website. Ad networks, like the one I work for, can't independently put advertisements in front of your eyeballs. Websites elect to show you those ads in order to make money. I only mention this because there seems to be some misdirected anger along this line. As an online advertiser, all of our publishers are willing and, in fact, gladly showing you the ads many people hate so much.

That being said, I highly doubt the veracity of the claim that 39% of Internet users are deleting cookies. To be honest, it doesn't matter though. It's not important that we connect you to the information your actions generate - only that the actions themselves are connected to one another. You'd really have to enable cookies for only the sites of your choosing to really cripple the process because then each of your page views, delays, submissions, etc. become atomic. The offer ad networks no bigger picture because they aren't connected in any way.

Speaking as somebody who did this using Firefox for months, I don't recommend it. It's a major pain in the ass.

spyware exagerated ?

[stud9920]

When I see ads in Gmail for apartments not just in my hometown, but in my district (Brussels Europarliament), when I have actually been looking for appartments in that district, *though not through google*, I am not certain spyware has been exagerated except by the people who wrote them.

Annoyance

[vettemph]

From the report:
[For example, cookies help a computer limit how many times a user sees annoying ads like a floating, animated message.]

They need a cookie that can reveal my final visit to a web site. That the best time to show the annoying, floating animated ad, assuring that i will never return to the site.

ho ho ho! Falsehood in the Third Paragraph!

[slappyjack]

"Cookies are critical from a business perspective," said Lorraine Ross, vice president for sales at USAToday.com. "They help us do things like track our profitability per unique visitor, for instance. But if you don't know how many people are coming in, you don't really have a handle on whether your profitability is improving or not."

This is, in a word, totally false. False as the day is long. Any site with a decent eingineering team can munge links with a session ID and track people without cookies all damn day long.

Love the technical speak from people that just dont know anything about it.

Re:ho ho ho! Falsehood in the Third Paragraph!

[nagora]

Any site with a decent eingineering team can munge links with a session ID and track people without cookies all damn day long.

And if they go away and then come back to your home URL, how do you know it's the same person?

Re:Delete 'em? Nope, I poison 'em!

[C_Kode]

and it's more fun than "bejewled".

Blaspheme! May you burn hell you filthy dog!!!

Re:ho ho ho! Falsehood in the Third Paragraph!

[slappyjack]

They bookmark, or you look at IP addresses or even better, match it to a login on your site. This can be fairly easily done.

If youre just tracking visitors or clickthroughs, you DONT want to aggregate them, brcause you want to twist the humbers higher.

Re:Tough luck for advertisers

[shadowspar]

I have three words for you: peer to peer. In this kind of situation, the client-server architecture concentrates thousands of leechers on a single resource that may not be equipped to handle it (as your friend unfortunately found out). With p2p, downloaders can help you out with bandwidth, which is only fair and often doesn't cost them anything.

The current state of p2p isn't very highly evolved, but it's continuing to improve. I'm hopeful that in the future it'll totally eradicate the small-guy problem that you outline.

Only session cookies allowed

[k8to]

My proxy blocks all persistant cookies every single time. There's really no need for storing settings that I don't explicitly want, so I don't allow sites to do it. Ever.

Session cookies? All are accepted. No problem. Incidentally my brwoser sessions last a few days.

Oh really?

[Anonymous Coward]

"For example, cookies help a computer limit how many times a user sees annoying ads like a floating, animated message. Such "frequency caps," to use industry parlance, are common among publishers. "So cookies are a really good thing for managing the user's experience," she said."

I find Adblock works much better :)

I use Firefox + Permit Cookies extension

[Artemis3]

To block cookies by default unless a site absolutely needs it.

Cookie management in Firefox is a little bothersome, thats why i installed Permit Cookies extension, so you can easily whitelist sites by pressing ctrl-c. Then you can choose: allow, session, block, or remove the cookie for the site you are currently viewing.

Permit Cookies would be a little more user friendly if it worked just like NoScript extension (which does the same, but for javascript).

In my opinion both tools should be integrated into Firefox.

Who the HELL?!?!

[Anonymous Coward]

I don't care if cookies are on or off. I don't care if those companies loose valuable information when I or anyone else zaps our cookies.

It is none of their business where I go and what I do on my own machine. I pay my fees to my ISP. Money made on the side by those managing web sites are not my concern and NEVER should be.

These guys are loosers if they think I could give one iota of my time on this planet worried about whether they loose money or research data. They can go to hell if they think I owe them one bit (byte) of data from my computer about what I do. Total loosers.

Cookies aren't bad

[Luke-Jr]

Just like any technology, cookies can be abused-- but that doesn't make them inherently bad. I solve the problem simply by forcing all cookies to be session cookies :)

Stupidity

[dcam]

I don't think cookies should be out there at all," said Marc Rotenberg, executive director of the Electronic Privacy Information Center, an advocacy group based in Washington..

Without cookies most web applications will fail. While there are other methods to uniquely identify a session (hidden form input, querystring value), cookies remain the most effective.

Re:Delete 'em? Nope, I poison 'em!

[Mastadex]

So, how many times have you tried to log into slashdot as CowboyNeal???

re: ZoneAlarm, etc.

[King_TJ]

No - I think you're missing my point. I'm not "blasting ZoneAlarm" because it doesn't do everything and isn't "idiot-proof". I'm blasting it because it's an extra piece of unnecessary software for most people. If you disregard the fact that it allows you to block malware from communicating *after* it has already gotten in, then what else does it really accomplish that the built-in XP firewall doesn't?

Of course you need several products in tandem to adequately protect a PC. You want anti-virus software, anti-spyware software *and* a basic firewall. But assuming your anti-spyware and anti-virus software is up-to-date and doing its job properly, why would you see a real benefit from your firewall having extra "intelligence" to keep popping up alert dialogs whenever apps try to use the net?

Spyware authors simply engineer their programs to confuse and trick people into letting them past these types of firewalls anyway. EG. There's a popular piece of spyware that identifies itself as "winword.exe" - so most people think "Oh, it's Microsoft Word. That's ok." and authorize it to get past the firewall. I don't think it's fair to label everyone an "idiot" who doesn't figure that stunt out right away.

Best balance? Keep the ones that are useful.

[MacDork]

I have Mozilla set to delete cookies every day, which seems to be the best balance.

If you use a Mac, the best browser for cookie management has to be Omniweb. Here's a screenshot. See the little cookie icon at the bottom of the browser window? When you click it, that sheet with the red/yellow/green dots drops down and lets you accept/deny cookies on an individual basis. Just set the default to 'deny all' and then selectively accept the ones you want as you need them. It's very slick. The last time I used Mozilla I had to dig through the preferences constantly to achieve something similar. Only one other browser that I've used (iCab) has anything close, though I must admit that I've never tried Firefox.

wtf

[Darkman, Walkin Dude]

But that's a moot point considering bandwidth is so cheap and if you want to throw up some kind of large, bandwidth consuming site you can generally run it on donation.

While I mostly agree with the rest of your rant, in particular with reference to the lifestyle type advertising (very Tyler Durden there), its time and way beyond time that you, tinker bell, and the rest of slashdot woke up to some realities you won't find steeping in the comfortable groves of academia or mouldering away in your parents' basement.

Some people run online businesses. These are what got the internet to where it is today. These require online advertising to let people know whats available. Everyone's favourite website, google, does that run on donations? No, its 100% advertising based revenue. One hundred percent.

The only reason that the internet is so ubiquitous today is purely private enterprise. A PC in every home, spreading broadband access, these things would not exist without commercial enterprise, whose sole purpose is profit. Do you seriously think that the internet would even exist if it had been left in the hands of academics?

And its not just the internet that was built on the back of commercial enterprise, take a look at spaceflight and see how has been fizzling like a wet firecracker until Richard Branson et al stepped in to bring you your star trek.

So if you don't like the nasty advertising, I suggest you sod off and read a good book, and leave the internet alone. Donation based websites, I mean what the good fuck.

Re:Tough luck for advertisers

[RingDev]

Agreed, P2P can grow to be an amazing tool, but the social engineering behind it has to catch up to the technology. Integrating P2P connections into browsers (mozilla, IE7) will be a huge step, but even more so will be continuous improvements in wireless and ubiquitous technology coupled with a fluid social interface.

-Rick

Cookies can INCREASE security in some ways

[dennypayne]

If the site you visit is hosted by a load balancing device but the application is not built to maintain session state between separate physical servers (most apps aren't, the developers don't ever seem to think about the fact that the app might be running in multiple places), the load balancing device must then maintain persistence of each client to the correct server for the site to work.

If you are not allowing (at least) session cookies, the load balancing device must fall back to using your source IP address to maintain persistence. If your source IP is a proxy (ie, you are an AOL user, on a corporate network, behind a gateway router, etc) then your session may be confused with another session and you may end up inside someone else's session or vice versa. I've seen this behavior on several sites where I was dumped into someone else's session with no authentication because our connections originated from the same proxy.

The way to ensure that *only* the correct client gets back into their own session is to uniquely identify them, and the easiest way to do that (without rewriting the app to use sessions in the URL) is for the load balancing device to insert a session cookie that has information on which server the client was originally load balanced to and to read that cookie on subsequent connections. The application server never even has to know about the cookie.

Therefore I submit that people's attitudes that cookies only collect/store personal information and their reaction to turn off all cookies including session cookies can actually decrease their security by exposing their sessions to access by other users.

Denny

I used to have to deal with average users...

[Anonymous Coward]

I used to have to deal with average users a lot in my job as a support tech. The company was too small to employ a bunch of non-lits reading off a flowchart, so I just had to step users through things and try to work out problems myself.

I often had enough trouble stepping users through tasks like manually dialling a dial-up modem connection. The chances of 90% of users I dealt with having the first clue HOW to actually delete their cookies are minimal. Asking users to click on "Tools... Internet Options" was often met with enough confusion.

advertisers.

[Anonymous Coward]

As if advertisers are so important, college grad egos want to prove they are hot marketers for the kiss up to the boss; its how you get ahead in that world.

Most of the time, I have cookies as well as java & javascript OFF. Sites that must have these for me just to view or do simple things is not worth it, and can eat dirt !. I avoid the ad traps, I don't click on them, so, they will not know I ever saw the damn ad or not. Problem one imho is people are suckers most of the time, they go for the poorest ad some kid grad came up with and click away.

When I know a site, or its a site I do things that cookies and the *javas* are needed, then and only then I turn them on only for that time; then they all get turned off again !. Advertisers don't have any right pushing these things through *no choice* techs. An ad in a mag is paid for by the readers of that mag, and not by the people of the whole state the mag is sold in. So why should I be MADE to accept these tech on the computer, and the internet access I pay for !...

Re:Yes, the info resellers ARE stealing from us

[bob frost]

Indeed--what you say about our personal information being of value is so true. A couple of years back, in reflecting on the copyright wars and the corporate insistance on what is "their" property, I began to think how cavalierly they take our personal info and resell it (think ChoicePoint here). Figuring that the intellectual property juggernaut was not going away any time soon, I developed an idea of granting us, everyday citizens, property rights over our own personal info. That way, any company who took our info and resold it (esp w/o our consent) could be liable for , yes, copyright violations! I thought I was original in that idea, but it turns out that Pamela Samuelson, developed the idea in about 1999. Surprise, surprise--nothing came of it.