Slashdot Mirror
Death of Cookies, Spyware Greatly Exaggerated?
securitas writes "The New York Times' Bob Tedeschi interviews several Internet marketing leaders who debate recent reports that Internet users are deleting cookies en masse and causing serious problems for advertisers. Among the interviewed is Eric Peterson, co-author of the Jupiter Research report that claims 39 percent of Internet users delete cookies. Slashdot has recently had stories about this supposed trend in June and July. A shorter version of the article at IHT. Who is telling the truth and who is deleting cookies? Are you?"
Cookies aren't evil. They are just misused, and misunderstood.
There's nothing wrong with using cookies to prevent me from having to logon to Slashdot 10 times a day. And there is nothing wrong with cookies telling Amazon.com that people who buy Movie X also like to buy Book Y. That is useful anonymous marketing information. I actually LIKE it when Amazon recommends things to me, because they are usually right!
The problem is when the cookie stays around for days and you never get a login prompt: that's a security problem. Or when marketers build long-term profiles on you, then try to grab identifying information from other sites you use.
I have Mozilla set to delete cookies every day, which seems to be the best balance. (Firefox unfortunately does not have this option).
Here's what I do.
/. so I don't have to log in everytime.
Get Firefox to turn ALL cookies into session cookies by deleting them "when I close Firefox" in options.
Then make exceptions for the sites you want to track you. I do this for
From the article;
This anticookie fervor also hurts the deleters, she says. For example, cookies help a computer limit how many times the user is exposed to annoying ads like a floating, animated message. Since when should you trust a site not to annoy you with ads, block popups and use Adblock and Flashblock.
"...So cookies are a really good thing for managing the user's experience," she said." If this was true, we'd all be installing adware on our computers to deliver 'interesting relevant and targetted' advertising to enrich our web experiences wouldn't we? Bah!
increasintly, if you don't have cookies, holding a session is impossible (unique id's on the getline are going the way of the dodo) and, increasingly, sites want you to maintain sessions to do anything useful.
t tacks
For session tracking, cookies are now the standard, but there are other security precautions that can only accomplished by including a unique ID in every form.
Go read up about "session riding" or "cross-site request forgery". For example:
http://shiflett.org/articles/foiling-cross-site-a
See the code sample near the end of the page, under "Force the use of your own HTML forms".
where there's fish, there's cats