Forum OpenACS Q&A: Getting rid of cookies

With cookies it is possible to track without asking the user for registration. Rhe you can track casual users.

Norbert Klamann

Cookies pose some problem - at least in Germany. Browsers by default are set to "ask if cookies should be accepted". Most people turn down all cookies, so all major German websites work without cookies as well.

Without cookies it's very ugly.

You can use http authentication and store the user state on the server.  This has many drawbacks, which is why hardly anyone does it, at least in the U.S.

Or you can encode a user identifier in each url, or if it's not much data, the state information itself.  This only works if all of your html links are generated dynamically.  And of course it's visible to the user in the url and won't survive URL surgery has a lot of other problems.

Joe, I take issue with your saying we are "short-sighted" for using cookies. Having been involved in building database-backed web sites for over 5 years, I thin I have some understanding of what is and isn't necessary or risky in building privacy-aware web sites.

Back in 1995, I helped build a web site, with *no* cookies, that allowed us to ingeniously track sessions, figure out which users were which, such that I was able to tell a friend "you visited the site on August 8th and stayed for 10 minutes, and came back on August 25th and stayed for 15 minutes." No cookies. Just programming, URL manipulations and tricks of navigation. The problem of privacy is in *no way* related to one particular technology.

Cookies are a perfectly fine technology which, when used correctly (the way ACS does), does not engender *any* additional privacy concerns. The problem is that the press has latched on to the idea that "using cookies violates your privacy." In fact, unless you check the box "remember my login" in ACS/OpenACS, your cookie will only last the duration of your session, which inherently means that you are no more at risk than with URL manipulations.

As for using the SSL session key as a unique identifier, my crypto background forces me to cringe at the thought that a session key would ever be visible to any part of the application. That is *not* a solution.

At the end of the day, if you're not using cookies on the web today, you are at a serious disadvantage. If you're of the mindset that you should never use cookies because of privacy concerns, you might as well not use the web at all, because your privacy is being violated, cookies or no cookies. The simple concept of tracking a session (using cookies or any other solution) opens up the door to privacy violations. If you don't want your session tracked, then you're in for a serious 1994 web-browsing experience.

I'm happy to hear complaints, suggestions, and anything else. However, the cookie-free ACS is not a priority today, as it solves no significant problem. If it is a priority for you, and you code up a clean, decent, unintrusive solution to it, we will be more than happy to include it in the distribution. However, calling us "short-sighted" isn't really going to get you much sympathy.

Joe, it's not that easy to build a non-cookie solution into the current OpenACS solution. There is a *lot* of legacy code that would make this task painfully difficult and time-taking. It is clear that you are unfamiliar with OpenACS internals. That is perfectly okay, and I'm happy to have people like you on board to discuss other perspectives.

What irks me, though, is that instead of asking questions, you are making assumptions. You assume that we are simply refusing to do this. You assume that it would be easy to do. You assume that since other sites have this feature, that OpenACS can and should have it, too.

Things aren't that way. I (and I expect others in the community) have no objection on principle to the non-cookie idea. It is simply that it would be a time-taking endeavor while more important tasks are on our list. Also, you claim that features of cookies can easily be duplicated as shown by the 1995 site I helped build, yet you do not know either system nor how such an add-on might affect the current OpenACS architecture! I am happy to help teach you how this stuff works, but I don't see you eager to find out.

At the end of the day, the OpenACS team has to prioritize. Refusing to use existing browser functionality in order to recreate a hacked-up version is not high on our list. We cannot spend time downgrading OpenACS to the lowest commond denominator while neglecting much needed features.

I want people like you on this community who can stir things up and offer new ideas or better ways of doing things. However, your contributions will be much more effective if you also try to learn and understand why things are the way they are. Until you do, I don't think it's too much to ask that you trust the decisions of more experienced developers.

Joe Harrington said:

Whenever I enable cookies, I get a .netscape/cookies file full of doubleclick.com and others who have on several occasions been cited for using these cookies to build and sell consumer databases that are a gross violation of privacy. *You* may use cookies responsibly, but some others don't.

As a user, I recommend you block doubleclick and any other abusers. (There are some handy tools to filter them at your machine; I just killed them at the router). As a developer, you might want to lend a hand at Mozilla to add (or re-add) cookie filters to Mozilla (or Galeon, which runs rather than walks). As a web developer, if people are not using your service b/c of cookie fear, perhaps you should examine your 'pull' content. "Is it worth risking cookie danger?"

Until the "technology" of cookies includes sufficient control on the client end, your responsible use of cookies on your particular site (and I do laud you for it) doesn't protect us from abuse by others.

Let me see if I get this -- until someone hacks together a collaborated 'cookie blacklist', auto-import into browsers, and site-by-site filtering (already there).... the use of cookies on ACS doesn't protect us from doubleclick.com? I'm confused (did I miss that ACS module?) -- perhaps you could clarify.

Given the fact that Germany and other nations are implementing legal responses to the privacy-abuse opportunity presented by the current cookie technology,

What legal difference is there between privacy invasion by cookie or privacy invasion by session tracking via {URL manipulation, navigation tricks, etc}. Even if said laws specifically say 'session tracking via cookies' any judge worth his/her salt would rule session tracking by other means as being under the same law (more probably, strike the law as ambiguous; sending it back to the legislature to fix/expand it).

I'm not (yet) a web guru

How many gurus can a field have? Isn't guruship determined by rarity?

Junkbuster has already been mentioned. I've been using it on and off for about 18 months. On the whole it's quite reliable and configurable. You can block cookies (and ad images and other stuff) using regular expressions, on a site-by-site basis, and you can allow cookie information in but not out. Installation is fairly straightfoward and mostly painless. Maintenance (adding new sites/urls/images/cookies to block/allow) is slightly more troublesome but not by much.

For a quick and dirty solution, edit your 'hosts' file and add entries like this:

127.0.0.1    www.doubleclick.net
127.0.0.1    ad.preferances.com
127.0.0.1    ad.doubleclick.com
etc...

note that some websites will be unaccessible using this method (though if you time slapping the [esc] button properly even these problematic sites can be perused).

I've also heard that simply making your cookies.txt file readonly will stop most of the potential abuse.

And finally Mozilla is coming along nicely. It's a fairly hefty download (~10mb for win32) and something of a memory pig with all the debug code still being loaded but still in a very usable state (I use Mozilla 30-40% of the time now). With Moz you can deny/allow images and cookies on a site by site basis, very handy.

Now about cookies in OpenACS: personally I gave up on (wholesale) blocking cookies about a year ago. For awhile I religiously emailed every webmaster/customer service rep to complain about their making cookie use mandatory, but it's just too tiring to keep up. In North America there are simply too many sites which are absolutely unusable without them. Even if OpenACS was retrofitted to avoid cookies it would only help those few (very few) sites which would use it.

Anyway, the proper place for privacy control is at the user's end; indeed, it's the only place where it's even possible.